How to protect against mitm attacks in first connection? - no HSTS Preload

Question

i have been searching around this area about mitm attacks and realize that every single page that doesn't have HSTS preload is vunerable to mitm attacks in first connection to the site. the solution to this, is to add it to the HSTS preload list : https://hstspreload.org/

But for differents reasons some websites can't implement this because as a bug bounty team told me 2 days ago:

"we are limited in some technical example.com subdomains. At foreseeable future, we can't force HTTPS on all subdomains because it breaks dependent infrastructure"

does anybody know another way to protect agaisnt this attack without adding the domains and all subdomains into the HSTS preload list??

Answer 1

every single page that doesn't have HSTS preload is vunerable to mitm attacks in first connection

That's only true if you connect initially to the HTTP version of the website. If you manually add (or verify the presence of) https:// when going to the site, or if you use a browser extension like HTTPS Everywhere, you don't have to worry about being kept on the unencrypted site and MITMed.

If you want to be absolutely sure that you can't connect to a non-HTTPS site, you can configure the extension to block all unencrypted websites. This will allow you to avoid the risk of MITM without needing to manually verify that the website you are on is indeed using encryption.

Unfortunately, it's not possible for a website to prevent this attack on its own without preloaded HSTS. It's entirely up to the users of the website to be aware of the encrypted status of their session.