SSL Stripping

SSL stripping is a downgrade attack in which an attacker positioned between a user and a website intercepts the initial HTTP request and prevents the upgrade to HTTPS. The attacker talks HTTPS to your server but serves the victim plain HTTP, so they can read or change everything.

Why it matters

Most users type a bare domain, so the first request often goes out as http://. Normally your server answers with a redirect to HTTPS, but that redirect is itself unprotected and can be rewritten. The victim sees a working site, perhaps without a padlock, and may not notice.

HSTS is the standard defense: once a browser has seen the header, it will refuse plain HTTP for your domain. Preloading closes the first-visit gap. Public Wi-Fi, compromised routers and malicious proxies are the typical settings.

Example

Defensive configuration:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

And on the HTTPS responses:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Common mistakes

• Thinking a 301 redirect alone is enough protection.
• Sending HSTS on the HTTP response, where browsers ignore it.
• Not covering subdomains, leaving a weak entry point.

Related

• HSTS
• Man-in-the-middle attack
• Redirect 301/302
• Tool: HSTS checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.