HTTPS attack mitigation