Glossary · Security

Man-in-the-Middle Attack

A man-in-the-middle attack secretly intercepts or alters communication between two parties who believe they are talking directly to each other.

Updated October 6, 2026

A man-in-the-middle (MITM) attack occurs when an attacker positions themselves between two communicating parties, reading or modifying the traffic without either party noticing.

Why it matters

On open Wi-Fi or compromised networks, unencrypted traffic can be read or changed. HTTPS with valid certificate checking prevents most MITM attacks, because the attacker cannot present a trusted certificate for your domain. HSTS stops downgrade attempts to plain HTTP.

Attackers can also use rogue Wi-Fi hotspots, poisoned DNS answers or compromised routers to get into that middle position.

Example

A user on public Wi-Fi visits http://shop.example. A rogue access point rewrites the page to capture the login form. If the site used HTTPS with HSTS, the browser would refuse to load it over HTTP.

Common mistakes

  • Clicking through browser certificate warnings.
  • Allowing HTTP on a site and relying on users to type https.
  • Assuming a VPN protects you from a malicious site itself.

Get notified when this term updates

Plus occasional practical tips on uptime and monitoring, nothing else. Unsubscribe anytime.

Keep reading

Glossary · SecurityHSTS (HTTP Strict Transport Security)HSTS is a response header that tells browsers to use HTTPS only for your domain, blocking downgrade attacks and skipping insecure HTTP redirects.Glossary · SecurityMan-in-the-Middle Attack (MITM)A man-in-the-middle attack places an attacker between two parties so they can read or alter traffic that both sides believe is private.Glossary · SecuritySSL StrippingSSL stripping is a man-in-the-middle attack that keeps a victim on plain HTTP by removing the redirect to HTTPS.Guide · SSL & SecurityCookie Flags Explained: Secure, HttpOnly and SameSiteWhat the Secure, HttpOnly, SameSite, Domain, Path and cookie prefix attributes do, how to set them in common stacks, and how to debug cookies that go missing.7 min readGuide · E-commerceE-commerce Site Security Checklist: 30 Checks for Online StoresA practical security checklist for online stores covering HTTPS, headers, payment pages, third-party scripts, admin access, updates, backups and monitoring.7 min readGuide · SSL & SecurityHow to Check an SSL Certificate Expiry Date (3 Easy Ways)Find out when your SSL certificate expires using a free online checker, your browser, or one command, and learn what to do if the date is close or has passed.7 min read

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.