What is a man-in-the-middle attack?
A man-in-the-middle attack is when someone secretly sits between your visitor and your website, for example on shared cafe Wi-Fi, and reads or changes what passes between them. Passwords and login sessions can be captured this way.
Also called: MITM
ON THIS PAGE
What it means
Data crossing the internet passes through many networks. If it isn't encrypted, anyone on the path can read it. With a plain http:// address, that includes logins and personal details.
HTTPS encrypts the connection so the person in the middle only sees scrambled data. The remaining risk is a visitor arriving on the plain http:// version first, before being sent to the secure one.
Why it matters for vibe-coded apps
Most hosting gives you HTTPS by default, but a missing redirect or an old mixed-content link can still leave a door open.
- Passwords and session cookies can be copied in transit.
- A visitor can be sent a changed page that steals their details.
- Browsers show scary warnings that make people leave.
Example
A site that works on both http and https.
http://yourapp.com -> loads the page, no redirect
(no Strict-Transport-Security header)http://yourapp.com -> 301 redirect to https://yourapp.com
Strict-Transport-Security: max-age=63072000; includeSubDomainsTurn on the forced redirect in your host or DNS provider, then add the header so browsers don't even try http.
How to check if your app has this problem
- 1Type http:// (not https://) followed by your domain and see if you're redirected.
- 2Look for the Strict-Transport-Security header in a free check or browser developer tools.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Turn on forced HTTPS in your host or CDN settings.
- 2Add the Strict-Transport-Security header.
- 3Replace any http:// images, scripts or links in your pages.
- 4Set the Secure flag on your login cookies.
Force HTTPS across my whole app: redirect all http:// requests to https://, add a Strict-Transport-Security header with a 2 year max-age, mark session cookies Secure, and change any http:// resource links to https://.
Check if your app has this problem
Paste your website and we'll check for man-in-the-middle attack issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- HTTPSThe padlock: an encrypted connection between your site and its visitors.
- Security headersSettings your site sends that tell browsers how to protect visitors.
- X-Frame-OptionsA header that stops other websites from showing your site inside a hidden frame.
- JSON Web Token (JWT)A signed pass your app hands a user after they log in.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.