Man-in-the-middle attacks intercept your users' connections to steal credentials and data. HTTPS alone isn't enough — learn how HSTS and TLS hardening close the remaining gaps.
Anay Pandya
1,590 words
Anay Pandya
Founder of ZeriFlow · 10 years fullstack engineering · About the author
Key Takeaways
Man-in-the-middle attack prevention is fundamentally about ensuring that every bit of data your users exchange with your server is encrypted, authenticated, and tamper-proof. MITM attacks allow an attacker positioned between a client and server to eavesdrop, modify, or inject traffic — stealing credentials, session tokens, sensitive form data, or silently altering the page your user sees.
<div class="zf-stat-callout" style="background:#0d1117;border:1px solid rgba(16,185,129,0.25);border-left:3px solid #10b981;border-radius:4px;padding:16px 20px;margin:24px 0"> <p style="margin:0 0 4px;font-size:10px;font-weight:700;text-transform:uppercase;letter-spacing:0.15em;color:#10b981;font-family:monospace">ZeriFlow Data — 12,400+ sites analyzed</p> <p style="margin:0;font-size:13px;color:#e2e8f0;line-height:1.6;font-family:monospace">ZeriFlow scan data: only 41% of analyzed sites implement HTTP Strict Transport Security (HSTS). Without it, users on captive portals or hotel Wi-Fi are trivially redirected to HTTP.</p> </div>
Keep reading
Is your site actually secure?
Run a free check — 60 seconds
Is your site exposed? Run a free ZeriFlow scan →
On a local network, Address Resolution Protocol (ARP) maps IP addresses to MAC addresses. ARP has no authentication — any device can broadcast fake ARP replies claiming to be the default gateway. When an attacker does this, all traffic on the subnet routes through their machine first.
This is the classic "coffee shop attack." An attacker on the same WiFi network as your user runs an ARP spoofing tool (arpspoof, Ettercap), becomes the man-in-the-middle, and can read or modify all unencrypted traffic.
Defense: This attack is neutralized by end-to-end encryption (HTTPS). If traffic is encrypted, the attacker sees only ciphertext they can't decrypt. However, there's a wrinkle: SSL checker stripping.
SSL stripping (Moxie Marlinspike, 2009) exploits situations where a browser makes its first connection to a site over HTTP before being redirected to HTTPS. The attacker, positioned as MITM, intercepts the initial HTTP request and serves the user an HTTP version of the site while maintaining an HTTPS connection to the real server.
The user never sees HTTPS. The padlock never appears. All traffic flows in plaintext through the attacker.
Defense: HTTP Strict Transport Security (HSTS) — the header that tells browsers to never attempt an HTTP connection to your domain, even before the first visit (via preload lists).
An attacker sets up a rogue access point with the same SSID as a legitimate network ("Starbucks", "AirportFree"). Devices may auto-connect. If users access sites over HTTP or accept invalid certificates, all traffic is captured.
Defense: Combined HTTPS enforcement, HSTS, and valid certificates with strong cipher suites prevent usable data capture even on a hostile network.
At the internet routing level, attackers can announce false BGP routes, redirecting traffic for an IP block through their infrastructure. This has been used to intercept cryptocurrency transactions and steal credentials at scale. In 2018, traffic destined for Amazon Route53 was hijacked, redirecting cryptocurrency wallet users to a phishing server.
Defense: HTTPS with certificate verification, HSTS, and DNSSEC all contribute to making BGP hijacking attacks harder to execute without detection.
Deploying HTTPS correctly is the baseline:
TLS version: Require TLS 1.2 minimum; TLS 1.3 preferred. Disable TLS 1.0 and 1.1 — they're deprecated and contain known vulnerabilities (BEAST, POODLE).
Cipher suites: Prioritize suites offering Perfect Forward Secrecy (PFS). ECDHE key exchange ensures that if a server's private key is later compromised, past sessions can't be decrypted. Disable RC4, DES, 3DES, and export-grade ciphers.
Certificate validity: Ensure your certificate hasn't expired and is issued by a trusted CA. Automate renewal with Certbot or your hosting provider's integration.
Redirect all HTTP to HTTPS: A server-side permanent redirect (301) from all HTTP URLs to their HTTPS equivalents ensures no content is accidentally served over plain HTTP.
ZeriFlow's scan checks your TLS version, cipher suite strength, certificate validity, and HTTP-to-HTTPS redirect configuration — the four pillars of solid TLS deployment.
HSTS is a response header that instructs compliant browsers to refuse all HTTP connections to your domain for a specified duration:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadDirectives explained:
- max-age=31536000 — browser enforces HTTPS for one year from last receipt
- includeSubDomains — applies the policy to all subdomains
- preload — signals eligibility for browser preload lists
The preload list is built into Chrome, Firefox, Safari, and Edge. If your domain is on it, browsers enforce HTTPS even before they've ever visited your site — the very first connection is HTTPS, with no HTTP fallback window for SSL stripping to exploit.
Submit your domain at hstspreload.org after confirming that all subdomains support HTTPS, since includeSubDomains is required for preload.
Important: Start with a short max-age (e.g., 300 seconds) and test thoroughly before deploying a year-long policy. HSTS errors (a subdomain that loses HTTPS support while the policy is cached) can make your domain unreachable for affected users until the max-age expires.
HTTP Public Key Pinning (HPKP) was a header that allowed websites to specify which certificate public keys browsers should accept, preventing fraudulently issued certificates from being trusted even if issued by a legitimate CA. In theory, it defeated CA compromise and BGP hijacking scenarios.
In practice, HPKP was deprecated in Chrome (2018) and removed from most browsers. The risk of misconfiguration — accidentally pinning a certificate you can't renew, locking users out of your site permanently — outweighed the benefits for most deployments.
Certificate pinning in native mobile apps remains valid and widely used, implemented in the application layer. For web applications, Certificate Transparency (CT) logging combined with monitoring provides a more practical alternative: every certificate issued for your domain is logged publicly, so you can detect fraudulent issuance quickly.
Tools like cert.sh, Facebook's CT Monitor, or SSLMate Certspotter alert you when a new certificate is issued for your domain.
DNSSEC cryptographically signs DNS records, ensuring that when a browser resolves your domain, the DNS response hasn't been tampered with in transit. Without DNSSEC, a MITM at the DNS level can redirect your domain to a malicious server even if that server uses a fraudulent certificate.
DNS over HTTPS (DoH) and DNS over TLS (DoT) encrypt DNS queries themselves, preventing ISP-level eavesdropping on which domains users are querying and protecting against DNS spoofing on hostile networks.
| Setting | Recommended | Avoid |
|---|---|---|
| Protocol | TLS 1.3, TLS 1.2 | TLS 1.0, TLS 1.1, SSLv3 |
| Key exchange | ECDHE, DHE | RSA (no PFS) |
| Certificate key | RSA 2048+ or ECDSA 256 | RSA 1024 |
| HSTS max-age | ≥ 31536000 | < 86400 |
| OCSP stapling | Enabled | Disabled |
Test your TLS configuration with Qualys SSL Labs for a detailed grade report. A score of A or A+ indicates a well-hardened configuration.
includeSubDomains in HSTS (all subdomains HTTPS)A: HTTPS prevents passive eavesdropping and makes active MITM attacks much harder. But without HSTS, SSL stripping can downgrade connections to HTTP before encryption kicks in. And without certificate monitoring, fraudulent certificates could allow a sophisticated attacker to perform MITM even on HTTPS. HTTPS plus HSTS plus CT monitoring is the complete answer.
A: Yes, in specific scenarios. If a user's device trusts a rogue CA certificate (often installed by corporate proxies or malware), that CA can issue a certificate for your domain and intercept HTTPS traffic. Certificate pinning or CT monitoring can detect this, but no client-side defense is absolute if the attacker controls the trust store.
A: PFS ensures that the session encryption keys are generated freshly for each connection and never stored. Even if an attacker records encrypted traffic today and later obtains your server's private key, they cannot decrypt past sessions. Without PFS (RSA key exchange), a key compromise retroactively exposes all recorded traffic.
A: Yes. ZeriFlow verifies the presence of the Strict-Transport-Security header, checks the max-age value, and flags configurations missing includeSubDomains or with too-short max-age values.
A: BGP hijacking primarily targets high-value targets (cryptocurrency, financial services). For most sites, the combination of HTTPS, HSTS, and CT monitoring provides sufficient protection and makes BGP hijacking attacks non-profitable. The effort required to successfully intercept HTTPS traffic with a valid certificate via BGP hijacking is extremely high.
Man-in-the-middle attacks exploit weak or absent encryption, missing HSTS headers, and unmonitored certificate issuance. The defense stack is well-understood: TLS 1.2+ with PFS ciphers, HSTS with a long max-age and preload, and Certificate Transparency monitoring. Each layer closes a specific attack window.
Audit your configuration now — before attackers find the gaps.
<!-- zf-internal-links -->
Related resources
Website Vulnerability Scanner
Run a broader website security audit across headers, TLS, DNS, cookies, SEO, and disclosure checks.
Security Headers Checker
Check CSP, HSTS, X-Frame-Options, and other response headers.
SSL Checker
Review TLS certificate, HTTPS, and transport security signals.
DMARC Checker
Validate email authentication records for domain spoofing protection.
CSP Checker
Review Content-Security-Policy coverage and common gaps.
June 24, 2026
Best Security Tools for AI Startups
Monitor your security score
Schedule recurring scans and catch regressions after deployments.