# What Is SSL Stripping (HTTPS-to-HTTP downgrade)?

> SSL stripping is a man-in-the-middle attack that keeps a victim on plain HTTP by intercepting the redirect or links that would have moved them to HTTPS.

Source: https://ssl.sh/glossary/ssl-stripping/
Last updated: 2026-11-10

SSL stripping was presented by Moxie Marlinspike in 2009 together with his sslstrip tool. An attacker on the network path, for example on shared Wi-Fi, intercepts the victim's first plaintext request; users typically type `example.com` without a scheme. Instead of passing the server's redirect to HTTPS back to the victim, the attacker fetches the HTTPS site itself and relays it over HTTP, rewriting `https://` links to `http://`. The victim never sees a certificate warning, because no TLS connection to the victim is ever attempted.

## Why it matters
It defeats HTTPS without breaking any cryptography, by exploiting the plaintext step before TLS begins. A server-side 301 redirect does not help, since the attacker controls that response. The defenses live in the browser: [HSTS](https://ssl.sh/glossary/hsts/) makes it upgrade to HTTPS internally before any request leaves the machine, and [HSTS preload](https://ssl.sh/glossary/hsts-preload/) does the same even for the first visit. HTTPS-first and HTTPS-only browser modes reduce exposure further. SSL stripping is a specific form of [man-in-the-middle](https://ssl.sh/glossary/man-in-the-middle/) attack and a close relative of protocol [downgrade attacks](https://ssl.sh/glossary/downgrade-attack/).

## Example
```text
Victim   -> http://example.com           intercepted by the attacker
Attacker -> https://example.com          real TLS connection to the server
Attacker -> Victim: HTTP copy of the page, every https:// link rewritten to http://
```

Check that a site has the defenses in place:

```bash
curl -sI http://example.com  | grep -i '^location'
curl -sI https://example.com | grep -i strict-transport-security
```

## Common misconceptions
- **Redirecting HTTP to HTTPS prevents SSL stripping.** The redirect travels over HTTP and the attacker can simply not forward it; only HSTS stops the browser from sending that request.
- **A site without a login page has nothing worth stripping.** An attacker can inject scripts, ads or fake download links into any page served over HTTP.
- **Users would notice a certificate error.** There is no error; the victim just sees an `http://` address, which many users never check.

## Related terms

- [HSTS](https://ssl.sh/zh/glossary/hsts/): HSTS 是一个 HTTP 响应头，告诉浏览器在指定时间内只通过 HTTPS 访问该站点，并且遇到证书错误时不允许用户继续访问。
- [HSTS 预加载](https://ssl.sh/zh/glossary/hsts-preload/): HSTS 预加载是内置在浏览器中的一份域名列表，列表内的域名始终通过 HTTPS 访问，连首次访问、尚未收到 HSTS 头之前也受保护。
- [中间人攻击](https://ssl.sh/zh/glossary/man-in-the-middle/): 中间人攻击是指攻击者暗中插入通信双方之间，转发并可能篡改流量，而双方都以为自己在直接和对方通信。
- [降级攻击](https://ssl.sh/zh/glossary/downgrade-attack/): 降级攻击是指攻击者迫使客户端和服务器协商出比双方实际支持的更旧的协议版本或更弱的算法，从而利用其中的弱点。
- [HTTPS](https://ssl.sh/zh/glossary/https/): HTTPS 是在 TLS 加密连接之上传输的 HTTP，默认使用 443 端口，使网页内容、Cookie 和表单数据被加密，并验证服务器身份。
- [混合内容](https://ssl.sh/zh/glossary/mixed-content/): 混合内容是指通过 HTTPS 加载的页面中，部分脚本、图片、iframe 等子资源仍通过明文 HTTP 加载，削弱了整个页面的安全性。