HTTPS protects the content of your messages and work documents in transit, and DNS services such as 1.1.1.1 can encrypt name lookups when encrypted DNS is enabled — but neither hides everything from your ISP. For businesses, the key point is that the content of a request to a service is protected, while the connection endpoint may remain visible. If you need to hide destination addresses of traffic, a VPN is the suitable tool.
What the ISP sees with HTTPS
HTTPS encrypts the exchange between the browser and the website. With a correctly secured connection, the internet provider does not read your password, message text, page path or query parameters. For example, a search phrase inside an HTTPS request is not visible to it, although the search engine itself does receive it.
What remains visible: the server's IP address, connection time and volume of data transferred. The domain can also be revealed through plain DNS or the initial TLS exchange, the connection protection protocol. So the padlock in the browser does not mean the name of the visited service is hidden.
An IP address does not always allow the website to be determined precisely: one address can serve many domains. But you cannot rely on such ambiguity as protection for business activity.
| Means of protection | What it hides from the ISP | What remains visible |
|---|---|---|
| HTTPS | Content of requests and responses | Destination IP, time, volume; often the domain |
| DNS over HTTPS (DoH) | Contents of DNS queries | Website IPs and connection characteristics |
| DoH together with ECH | DNS queries and the website name in the initial TLS exchange, where ECH is supported | Destination IP, time and volume |
| VPN | Destination addresses for traffic inside the tunnel | The VPN server's address, time and volume |
Why switching DNS to 1.1.1.1 is not enough
DNS translates a website name into the IP address the device connects to. DoH, or DNS over HTTPS, protects the segment between the device and the DNS service: ordinary DNS queries are not encrypted, and switching the resolver address does not by itself guarantee encryption. The ISP does not read DoH queries, but the chosen DNS service processes them. After receiving the response, the browser connects to the website's IP directly. Encrypted DNS hides the queries, but not the websites' IPs.
Check the actual state of your protection. The Firefox documentation describes how to see the DoH status in the browser's DNS over HTTPS settings: it shows whether it is Active, Not active or Off, and the default mode allows falling back to system DNS under certain conditions. An enabled setting does not yet prove that every query is protected. A browser setting also does not automatically extend to other applications.
Enlarge image
When ECH hides the website name
ECH encrypts part of the initial TLS exchange in which the website name may be transmitted. Together with encrypted DNS, this closes two channels of domain disclosure. However, server-side support is required; the feature does not work for every connection and may be disabled by organisational policy. These conditions are described in Mozilla's ECH help article.
ECH does not change the traffic route. The server's IP remains visible, so the claim "with HTTPS the ISP will never know the website" is incorrect.
When to choose a VPN, and when HTTPS is enough
If the task is to protect the content of work requests in transit, HTTPS does this without a VPN. If you need to hide destination service addresses from the ISP, use a VPN with routing of the required traffic and DNS through the tunnel.
| Your task | Practical action | Limitation |
|---|---|---|
| Protect your password and page content | Use HTTPS and do not bypass certificate errors | The website receives the data you send |
| Hide DNS queries from the ISP | Enable DoH and check its status | Direct connections to IPs remain visible |
| Hide the addresses of visited services | Route the required applications and DNS through a VPN | Trust is shifted to the VPN operator |
| Hide how much data you transfer | Encryption does not change this | The ISP counts the bytes transmitted |
As EFF explains, a VPN shifts trust to its operator. Study the data retention policy. And a VPN does not make you anonymous to the sites themselves: EFF notes that logging into an account, cookies and browser fingerprints can still identify you.
For example, an employee opened a contractor's portal via HTTPS and DoH. The content of the documents is protected, but the ISP sees the portal's IP. When this connection is passed through a VPN, the ISP sees the VPN server's address, along with the time and volume of the connection — a change of route, not a guarantee of anonymity.
What to check before you start
- Make sure the website uses HTTPS without certificate warnings.
- If you rely on hiding DNS queries, check that DoH shows the Active status in your browser's DNS over HTTPS settings — an enabled setting alone does not prove protected resolution.
- When using a VPN, verify the routing settings for the required application, and remember the honest limit of what you can confirm: even if the configured resolver matches the one actually in use, this does not prove that DNS for every application passes through the tunnel. Split tunnelling exclusions leave selected traffic outside the tunnel, and one successful test does not confirm the protection of all connections.
If DNS protection alone is not enough and you need to hide the addresses of the services you visit from your ISP, connect CitadelVPN via a compatible VPN client. The dashboard has a subscription URL — a link for downloading the list of connections. Add it to your client, update the list and select a connection: this procedure is described in the VLESS guide. Then check the route of the application you need and DNS against the list above. If the setup raises questions, support engineers will help you sort out the routing and clarify how the chosen client behaves when the tunnel drops.
Frequently asked questions
Does a private window help?
It limits the saving of history on the device. Chrome and Firefox explain directly: private mode does not make visits invisible to the network. Downloaded files and bookmarks are retained.
Does a VPN hide your activity from your employer?
A VPN changes network visibility, but employer monitoring on a managed device is governed by that device's management software and policies, not by the VPN — check with your IT department what is monitored locally.
Which protection to choose for your task
HTTPS protects content; DoH protects DNS queries; ECH hides the site name in the initial TLS exchange where the server supports it. To hide destination addresses from the ISP, a different route is needed, such as a VPN. Start with the checklist above: confirm HTTPS, check the DoH status and understand the limits of what a VPN configuration review can confirm.