If I set HTTPS-Everywhere to block all unencrypted requests, and my connection is man-in-the-middled by a malicious Tor exit node when I connect to a website that, by default, uses HTTPS, then will the extension prevent the site from loading entirely, and thus, prevent my login credentials or other data from being sniffed by the node?

1 Answer 1


Yes. If HTTPS-Everywhere is set to block all unencrypted requests, your browser will never establish a plain HTTP connection without TLS, no matter what.

How the rest of the networks looks, and where on it the attacker is is irrelevant here. The man in the middle may be a malicious Tor exit node, a hacked router, your ISP, but they will still not be able to downgrade anything to HTTP since your browser will not accept such a connection.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .