HTTP
Unencrypted HTTP application traffic.
Websites, APIs, health checks, redirects to HTTPS and internal service communication.
Client to server
Do not send sensitive data without TLS. Prefer redirecting public traffic to HTTPS and constrain administrative endpoints.