When you visit a website, you typically see a little padlock on the left side of the URL address bar. That symbol — or something similar, depending on the browser — indicates a secure connection under Hypertext Transfer Protocol Secure (HTTPS).
Normally, under Hypertext Transfer Protocol (HTTP), data is sent in plain text, which could enable a hacker to intercept sensitive data like passwords. With HTTPS, however, there’s an added encryption layer to the HTTP language via the Transport Layer Security (TLS) protocol.
Nowadays, browsers and websites default to HTTPS, even if you enter http:// vs. https:// as a prefix. But there’s a type of cyberattack called SSL stripping that can override this default security mechanism, forcing you to use unencrypted HTTP communication.
Here, we’ll take a closer look at what SSL stripping is, how an SSL stripping attack works, and ways to prevent those attacks.
What Is SSL Stripping?
SSL stripping is a type of man-in-the-middle (MITM) cyberattack that downgrades an HTTPS connection attempt to HTTP by blocking or modifying redirect responses. It’s often called an HTTPS downgrade attack, as you’re downgrading from HTTPS to HTTP.
The SSL here stands for Secure Sockets Layer stripping Although the term “SSL stripping” remains common, modern implementations target TLS, as SSL has been deprecated for years. It involves preventing TLS encryption, the term SSL stripping has prevailed, despite the underlying protocol shift.
How SSL Stripping Works
An SSL stripping attack requires a bad actor to intercept your connection with a website and force you to use HTTP instead of HTTPS. This requires the attacker to gain an on-path position between the victim and the website, allowing them to intercept and modify traffic in transit. Tools such as SSLstrip can automate this downgrade behavior once the attacker has achieved on-path positioning.
More specifically, SSL stripping involves the following steps.
1. Attacker Gets in the Middle of the Victim and Website
The hacker first needs to launch an MITM attack, such as via ARP spoofing (also called ARP poisoning) or a rogue access point. For example, on a corporate network, an attacker might trick your laptop into thinking their device is the router, while tricking the router into thinking their device is your computer. Or, on public Wi-Fi, a hacker might set up a fake Wi-Fi network that resembles the correct one. From there, the attacker can relay data between the victim and the website while potentially reading it in plain text, if they can implement additional steps below.
2. Victim Requests a Website via HTTP
For SSL stripping to work, there needs to be an opportunity to visit a website via HTTP.
Popular websites and modern browsers use HTTP Strict Transport Security (HSTS) to automatically request HTTPS first, before any attempt at an HTTP connection takes place. Even if the user types in “http://”, there would be an automatic redirect to the HTTPS version before any data is exchanged — this preempts SSL strip attempts.
However, not every site and browser supports HSTS, or a user might adjust their browser settings to avoid this default option. Also, sites that support HSTS can still be vulnerable the first time they’re visited by a given user if they’re not on a browser preload list.
So, in some cases, a user might type in a website without an “http://” or “https://” prefix, or they might start with “http://”, and there could be an opportunity for the SSL stripping attack to move forward.
3. Attacker Blocks Victim’s HTTPS Upgrade
If there’s an opportunity to visit an HTTP site based on certain site and browser settings, then the SSL stripping attack works by intercepting the request to redirect from HTTP to HTTPS. In that case, the user establishes an HTTP session with the hacker, while the hacker establishes a real HTTPS session with the correct website. That enables the attacker to see the victim’s unencrypted communication, while still following the necessary protocols a site may have, like for encrypted communication on a banking website.
Note that if an attacker successfully blocks the HTTPS upgrade, the victim wouldn’t see the padlock (or whatever is used to indicate an encrypted connection). So, there’s still an opportunity for the victim to back out before exposing much, even if the MITM attack and initial SSL strip are successful.
Does SSL Stripping Still Work in 2026?
HSTS has helped reduce the effectiveness of SSL stripping, especially because some browsers are even preloaded with the HTTPS versions of certain websites before they’re ever even visited by a user. Still, there are plenty of sites that don’t support this, and there are also more complex attacks that could make SSL stripping work in 2026.
For example, on a public Wi-Fi network, an attacker might have an easier time engaging in ARP poisoning that lets their device control where it sends your browser traffic. With DNS spoofing, they might then direct you to a similar but different domain that is not built to support HSTS, ultimately making SSL stripping possible.
How To Prevent an SSL Stripping Attack
Preventing SSL stripping attacks requires a multi-layered approach. Some of the responsibility falls on website owners, such as supporting HSTS. But from a user’s perspective (which enterprise IT can help support), consider steps such as:
- Using an HTTPS-first browser
- Using a VPN for an extra layer of encryption, particularly on public Wi-Fi
- Checking for the padlock or similarly relevant security settings within the browser
- Paying attention to browser warnings, i.e., not advancing if the browser says a site is unencrypted
Protecting Against SSL Stripping With SecureW2
While there are ways to protect against SSL stripping at the browser and user levels, it helps to initially establish a stronger perimeter. While Wi-Fi security alone cannot prevent all downgrade attacks, preventing rogue access points and unauthorized devices significantly reduces the likelihood of successful on-path positioning.
The SecureW2 JoinNow passwordless platform makes it easy to implement and manage certificate-based 802.1X authentication. In particular, with 802.1X EAP-TLS authentication, there’s mutual identity verification between devices and networks, so you can be more confident that devices connect to legitimate enterprise networks, while also keeping rogue devices out.
Ready to strengthen your network security with a passwordless solution? Schedule a SecureW2 demo today.
