# SSL stripping attacks

> SSL stripping removes HTTPS encryption without you noticing. How this man-in-the-middle attack works, why HSTS is not a complete fix, and how to stay safe.

Canonical: https://www.phishclean.com/threats/ssl-stripping-attacks
Last updated: 2026-08-13

You're at a coffee shop. You type your bank's URL into the browser. Everything looks normal — the page loads, you log in. But someone on the same network just read your password in plain text. That's SSL stripping.

Moxie Marlinspike demonstrated SSL stripping at Black Hat DC in 2009. In just 24 hours of running the tool on a Tor exit node, he captured hundreds of credentials for Yahoo, Gmail, Hotmail, PayPal, LinkedIn, and Facebook. The attack remains viable on networks without proper HSTS enforcement.

## How SSL stripping actually works

The core idea is deceptively simple. When you type "bank.com" into your browser, the first request goes out over plain HTTP — not HTTPS. Normally, the bank's server responds with a redirect: "Hey, come back over HTTPS instead." Your browser follows the redirect and everything is encrypted from that point on.

An SSL stripping attacker sits between you and the server (a man-in-the-middle position). They intercept that initial HTTP request, follow the HTTPS redirect themselves, and then serve you the page over plain HTTP. You get the real content from your bank — but none of it is encrypted on your side of the connection.

The attacker sees everything. Every keystroke, every password, every session cookie.

### The attack flow looks like this:

**Your Browser** HTTP request

→

**Attacker (MitM)** Intercepts & strips

→

**Real Server** HTTPS connection

The key detail: the connection between the attacker and the real server is fully encrypted over HTTPS. The server has no idea anything is wrong. It's only your side — the link between your browser and the attacker — that's been stripped down to unencrypted HTTP.

## Why you won't notice it happening

Most people don't actively check for the padlock icon in their browser's address bar. And even if they did, some SSL stripping tools go further:

- **Favicon spoofing** — The attacker inserts a padlock favicon to mimic the browser's HTTPS indicator
- **URL similarity** — The URL still shows your bank's real domain, just with `http://` instead of `https://`
- **Normal page behavior** — Everything works exactly as expected because the attacker is proxying real content from the legitimate server

Marlinspike's original tool, `sslstrip`, even replaced HTTPS links within the page content so that subsequent navigation stayed on HTTP. Every link you clicked kept you in the unencrypted channel.

## Where SSL stripping happens

This attack requires the attacker to be in a man-in-the-middle position. Practically, that means:

- **Public WiFi** — Coffee shops, airports, hotels. ARP spoofing or a rogue access point puts the attacker between you and the router.
- **Compromised routers** — Home routers with default credentials or unpatched firmware. More common than you'd think.
- **Corporate networks** — An insider or compromised machine on the same network segment.
- **Tor exit nodes** — Malicious exit node operators can intercept unencrypted traffic.

## Can HSTS prevent SSL stripping?

HTTP Strict Transport Security (HSTS) is the primary defense against SSL stripping. When a server sends an HSTS header, it tells the browser: "For the next X seconds, only connect to me over HTTPS. Don't even try HTTP."

# HSTS header example  
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

This works well — after the first visit. And that's the problem.

HSTS has a "first visit problem." The very first time you visit a site, your browser doesn't know it should use HTTPS. That first request goes over HTTP, and that's the window an attacker needs. One request is all it takes.

### Gaps in HSTS protection

Even with HSTS deployed, there are edge cases:

- **First visit vulnerability** — Until your browser has seen the HSTS header at least once, it doesn't know the site requires HTTPS. The HSTS preload list covers major sites (Google, Facebook, Twitter), but most websites aren't on it.
- **Expired HSTS policies** — HSTS has a max-age. If you haven't visited a site in a while and the policy expires, you're back to square one.
- **Subdomain gaps** — Unless the `includeSubDomains` directive is set, HSTS only applies to the exact domain. An attacker could redirect you to `http://m.bank.com` or `http://secure.bank.com` instead.
- **Browser data clearing** — Clearing browser data or using incognito mode wipes stored HSTS policies. Every session starts fresh.

Honestly, HSTS alone isn't enough. It's a critical piece of the puzzle, but it leaves real gaps that attackers actively exploit.

## How PhishClean detects HTTPS downgrades

PhishClean's HTTPS Downgrade Alert is one of its 27 detection signals. It works differently from HSTS because it monitors the actual behavior of your browser session rather than relying on server-side headers.

Here's what it checks:

- Detects when a page that should be served over HTTPS is loaded over HTTP
- Flags mixed content — HTTPS pages loading resources (scripts, forms, iframes) over plain HTTP
- Monitors for [hidden iframes](https://www.phishclean.com/threats/hidden-iframe-attacks) that load over HTTP within an HTTPS page
- Alerts when form actions point to HTTP endpoints on pages that appear to be login or payment forms

All of this runs locally in your browser. No data is sent anywhere. PhishClean doesn't need to know which sites you visit — it just watches for the patterns that indicate something has gone wrong with the encryption.

## Protecting yourself beyond HSTS

- **Use a VPN on public WiFi.** A VPN encrypts all traffic between your device and the VPN server, preventing local network attackers from intercepting your HTTP requests. It's not perfect, but it eliminates the most common attack scenario.
- **Type `https://` explicitly.** If you type the full `https://` prefix, your browser connects directly over HTTPS without the initial HTTP request that attackers exploit.
- **Enable HTTPS-Only Mode.** Firefox and Chrome both offer settings that block or warn about HTTP connections. Firefox: Settings → Privacy & Security → HTTPS-Only Mode. Chrome: `chrome://flags/#https-only-mode`.
- **Install a browser security extension.** Tools like PhishClean detect HTTPS downgrades in real time — catching the attack even when HSTS and browser settings fall short.

## Related threats

- [Phishing attacks](https://www.phishclean.com/threats/phishing-attacks): SSL stripping is often combined with phishing to harvest credentials on fake pages.
- [Hidden iframe attacks](https://www.phishclean.com/threats/hidden-iframe-attacks): Invisible iframes can load HTTP content inside HTTPS pages, bypassing encryption.
- [Formjacking](https://www.phishclean.com/threats/formjacking-attacks): Injected scripts that steal form data — another attack that targets unencrypted connections.
- [PhishClean vs Safe Browsing](https://www.phishclean.com/compare/phishclean-vs-chrome-safe-browsing): Chrome's blocklist doesn't detect HTTPS downgrades. See the full comparison.

## Frequently asked questions

Is HTTPS enough to prevent SSL stripping?

HTTPS alone doesn't prevent SSL stripping because the attack happens before HTTPS is established. The attacker intercepts the initial HTTP request and prevents the upgrade. HSTS helps, but only after your first visit to a site. A browser-level detection tool like PhishClean catches downgrades that HSTS misses.

Does a VPN prevent SSL stripping?

On public WiFi, yes — a VPN encrypts all traffic between your device and the VPN server, so local attackers can't intercept your HTTP requests. But a VPN doesn't protect against compromises beyond the VPN endpoint, or against malicious content injected by the destination server itself.

Can HSTS completely stop SSL stripping attacks?

HSTS significantly reduces the risk but has real gaps: the first-visit problem (your browser doesn't know about HSTS until it visits the site once over HTTPS), expired policies, missing subdomain coverage, and cleared browser data. The HSTS preload list covers major sites, but most of the web isn't on it.

## Detect HTTPS downgrades automatically

PhishClean monitors every page for encryption issues — locally, in real time. Your browsing data stays on your device.

[Install PhishClean](https://www.phishclean.com/#install)

Last updated: 13 August 2026