Are HTTPS headers encrypted?

The whole lot is encrypted^† - all the headers. That's why SSL on vhosts doesn't work too well - you need a dedicated IP address because the Host header is encrypted.

^†The Server Name Identification (SNI) standard means that the hostname may not be encrypted if you're using TLS. Also, whether you're using SNI or not, the TCP and IP headers are never encrypted. (If they were, your packets would not be routable.)

The headers are entirely encrypted. The only information going over the network 'in the clear' is related to the SSL setup and D/H key exchange. This exchange is carefully designed not to yield any useful information to eavesdroppers, and once it has taken place, all data is encrypted.

HTTP version 1.1 added a special HTTP method, CONNECT - intended to create the SSL tunnel, including the necessary protocol handshake and cryptographic setup.
The regular requests thereafter all get sent wrapped in the SSL tunnel, headers and body inclusive.

With SSL the encryption is at the transport level, so it takes place before a request is sent.

So everything in the request is encrypted.

HTTPS (HTTP over SSL) sends all HTTP content over a SSL tunel, so HTTP content and headers are encrypted as well.

To understand, what is encrypted and what not, you need to know that SSL/TLS is the layer between the transport-layer and the application-layer.

in the case of HTTPS, HTTP is the application-layer, and TCP the transport-layer. That means, all Headers below the SSL-Level are unencrypted. Also, SSL itself may expose data. The exposed data includes(for each layer's Header):

NOTE: Additional Data might be exposed too, but this data is pretty sure to be exposed.

MAC:

1. Source MAC address(Current Hop)
2. Destination MAC address(Next Hop)

IP(assuming IPv4):

1. Destination IP address
2. Source IP address
3. IP Options(if set)
4. Type-Of-Service(TOS)
5. The number of hops the current packet passed, if TTL is set to 64

TCP:

1. Source Port
2. Destination Port
3. TCP-Options

Theoretically, you can encrypt the TCP-Headers, but that is hard to implement.

SSL:

1. Hostname(if SNI is being used)

Usually, a browser won't just connect to the destination host by IP immediantely using HTTPS, there are some earlier requests, that might expose the following information(if your client is not a browser, it might behave differently, but the DNS request is pretty common):

DNS: This request is being sent to get the correct IP address of a server. It will include the hostname, and its result will include all IP addresses belonging to the server.

HTTP: the first request to your server. A browser will only use SSL/TLS if instructed to, unencrypted HTTP is used first. Usually, this will result in a redirect to the seucre site. However, some headers might be included here already:

1. User-Agent(Specification of the client)
2. Host (Hostname)
3. Accept-Language (User-Language)