# Can you get malware from an HTTPS website?

Yes. HTTPS means the connection is encrypted and the server holds a valid certificate for the name in the address bar; it says nothing about whether the site or its downloads are safe. Attackers use HTTPS as routinely as everyone else, because certificates are free and automated, and much phishing and malware delivery runs over it. The padlock protects you from someone reading or altering traffic on the way, not from the content at the other end. Protection against malicious downloads comes from endpoint protection on the device, browser and e-mail filtering, keeping software updated and limiting who can install programs. On the network side, encryption hides the file but not the behaviour that usually follows an infection: a device suddenly contacting a new destination at regular intervals, scanning internal hosts or sending out unusual volumes of data. NetSenX detects those patterns on every plan, from flow metadata and without decrypting traffic.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/can-you-get-malware-from-an-https-website

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Can HTTPS traffic be intercepted by a man in the middle?](https://netsenx.com/en/faq/can-https-traffic-be-intercepted)
- [What is JA4 TLS fingerprinting?](https://netsenx.com/en/faq/what-is-ja4-tls-fingerprinting)
- [What is the difference between JA3 and JA4?](https://netsenx.com/en/faq/what-is-the-difference-between-ja3-and-ja4)
- [What is SNI, and why does it matter for monitoring?](https://netsenx.com/en/faq/what-is-sni-and-why-does-it-matter-for-monitoring)
- [What is Encrypted Client Hello (ECH)?](https://netsenx.com/en/faq/what-is-encrypted-client-hello)