What Is SSTP and Should You Still Use It in 2026?

You've bumped into "SSTP" somewhere concrete: a Windows VPN protocol dropdown, a router's admin page, or an IT email finally putting PPTP out to pasture. Fair question: what is this thing, and why is it still hanging around? (And yes, we know it's a little rich for a VPN company to calmly explain a protocol we don't even offer. Bear with us.)

SSTP (Secure Socket Tunneling Protocol) is a VPN protocol Microsoft introduced with Windows Vista Service Pack 1 and Windows Server 2008. It tunnels your traffic through an encrypted TLS (Transport Layer Security) channel on TCP (Transmission Control Protocol) port 443, the same port your bank's website uses for HTTPS, so it can pass through networks that only allow standard web traffic. It's simple to use on Windows, where it's already built in.

If that sounds like technical soup, here’s the fuller picture: what SSTP is actually good for, where Microsoft is taking it next, and why it’s probably not the protocol you want to be using every day.

What Is SSTP?

Like any VPN protocol, SSTP just defines how the encrypted tunnel between your device and a VPN server gets built. What makes it different is the pipe it builds that tunnel inside of, and the fact that it's a proprietary protocol Microsoft controls end to end, not open source and community-auditable like OpenVPN.

Rewind to the mid-2000s: VPNs were notoriously frustrating to use on the road. The popular protocols back then (PPTP and L2TP/IPsec) worked great on your home network, but they relied on specific ports that public Wi-Fi loved to block. You’d connect smoothly from home, only to hit a brick wall the second you tried working from a hotel, coffee shop, or conference center.

Microsoft's fix was clever. Instead of inventing a new kind of traffic for firewalls to learn and eventually block, SSTP hides the VPN tunnel inside the one kind of traffic almost no network wants to touch: HTTPS on port 443.

Blocking SSTP with simple port rules would also hit ordinary HTTPS traffic, like online banking and webmail, which is exactly why this approach was so attractive on restrictive networks. Under the hood, SSTP wraps an older data-framing protocol called PPP (Point-to-Point Protocol, essentially the container for your actual traffic) inside that TLS channel.

SSTP has been built into Windows since Vista Service Pack 1. There have been third-party SSTP clients for Linux and BSD (a Unix-like OS family), though support there is far less mainstream than on Windows. In Microsoft's current Azure VPN Gateway docs, SSTP is framed as a point-to-site protocol: one client device connecting into a private network. That's different from site-to-site VPNs, which link whole networks together and aren't where Microsoft is steering SSTP today.

That port-443 trick is clever enough to make you wonder why SSTP didn't become the default everywhere. Fair question. Here's how it actually works.

How SSTP Works

Strip away the acronyms, and SSTP is basically a clever disguise.

When you hit connect, your device opens a line to the VPN server using Port 443, the same exact digital doorway your web browser uses to load secure websites. The server validates its credentials just like a bank’s website would, locks down the connection with HTTPS encryption, and SSTP quietly slips your private VPN traffic right inside.

To a basic network firewall, nothing looks out of place. It can't see what's moving through that encrypted pipe; all it sees is a device casually loading secure web traffic. Since blocking Port 443 would break half the internet, the firewall just steps aside and lets your connection through. That’s why SSTP is so remarkably good at sneaking past stubborn hotel or coffee shop Wi-Fi.

Of course, the disguise isn't completely foolproof. If you’re on a strictly managed corporate network that actively decrypts and inspects web traffic, the firewall will peek inside the pipe, spot the VPN data hiding under the hood, and slam the door shut anyway. On top of that, SSTP’s underlying tech is getting a bit long in the tooth, while modern protocols like OpenVPN have moved on to lighter, faster encryption standards. SSTP is mostly stuck in the previous generation.

Still, a trick this clever feels like it should have won the VPN wars. So why didn't it?

What SSTP Gets Right

Slashing through strict firewalls is SSTP’s headline feature, and it’s a genuinely great one. Its Port 443 disguise neatly dodges the exact blocking headaches that made older protocols like PPTP and L2TP/IPsec such a nightmare on hotel and office networks.

Beyond its main trick, SSTP actually has a few under-the-hood advantages that don't get enough credit:

• Stronger Authentication: Many older IPsec setups relied on a shared secret (essentially a single password everyone on the network shared). SSTP uses individual server certificates instead. That eliminates a massive security shortcut that plagued L2TP/IPsec deployments for years.
• Debunking the "POODLE" Myth: If you Google "Is SSTP secure?", you’ll see plenty of articles claiming SSTP is vulnerable to the infamous POODLE security bug because it uses SSL 3.0. That info is completely outdated. POODLE was a flaw in ancient SSL 3.0, not modern TLS. Microsoft patched this a decade ago, and any properly configured machine today runs SSTP on modern TLS 1.2. The vulnerability is a legacy configuration issue, not a flaw with SSTP itself.
• Built-in Windows Convenience: Because SSTP is natively built into Windows, there are no third-party apps to install, and it syncs seamlessly with Windows login credentials and smart cards. It's the protocol equivalent of the wrench sitting in your junk drawer—you might not go out of your way to buy it, but you're glad it's there when you need a quick fix.

(Just to be clear: debunking that old POODLE rumor clears SSTP of one bad accusation, but it doesn't mean the protocol is completely flawless!)

So yes, SSTP is clever, surprisingly well-defended, and undeniably convenient for Windows users. We’ll give it that. So why aren't modern VPN apps using it, and why is Microsoft quietly moving away from it? The answer comes down to a few major structural flaws, and they're up next.

Where SSTP Falls Short

For all its clever tricks, SSTP comes with some heavy drawbacks. Here’s why it struggles to keep up with modern VPN protocols.

1. It Falls Apart on Bad Wi-Fi ("TCP Meltdown")

This is the big one that actually ruins your connection. Because SSTP runs inside TCP, it layers one reliability check on top of another, a classic issue known as TCP-over-TCP.

When packet loss happens (which is constantly on weak hotel or coffee shop Wi-Fi), both layers start fighting over lost data. It’s like two people trying to catch the same falling glass from opposite sides; instead of helping, they just collide and smash it. 

On a congested network, SSTP doesn't just slow down gracefully; its performance drops off a cliff. Modern protocols like WireGuard or OpenVPN (using UDP) don't stack these layers, letting them handle poor Wi-Fi much better.

2. The "Closed-Door" Trust Problem

While Microsoft published SSTP's specifications, its Windows implementation remains closed source. You’re essentially trusting a security lock you’re not allowed to take apart, rather than an open-source lock (like WireGuard or OpenVPN) that independent security experts inspect, test, and debate in public. For privacy-minded users, that lack of public auditing is an immediate dealbreaker.

3. It's Clunky Outside the Windows World

SSTP is fundamentally a Windows-first tool. While third-party setups exist for Mac, Linux, or mobile devices, support is rare and often unreliable.

Even Microsoft treats it as a second-class citizen these days:

• Point-to-Site only: Microsoft’s Azure documentation positions SSTP strictly for individual remote users, not for linking entire office networks together.
• Missed upgrades: Newer Azure sign-in features (like modern Entra ID authentication) are reserved for OpenVPN, leaving SSTP behind.
• No UDP mode: Unlike OpenVPN, SSTP was never given a lighter UDP mode to bypass those Wi-Fi lag spikes.

When you put it all together, the reason SSTP vanished from consumer VPN apps is simple: a closed-source, Windows-focused, TCP-only protocol just can't compete with open-source options like WireGuard and OpenVPN that work smoothly on every device you own.

Every protocol has tradeoffs, but what usually settles the argument is what a company does with its own creation, and Microsoft has been sending some very mixed signals about SSTP's future.

Is SSTP Being Retired? Microsoft's Confusing Answer

If you look at what Microsoft is doing with SSTP right now, you’ll get two completely opposite answers depending on where you look.

On one hand, Microsoft gave SSTP a noticeable promotion in Windows Server 2025. The new Routing and Remote Access Service (RRAS) no longer accepts outdated PPTP or L2TP connections out of the box, explicitly naming SSTP and IKEv2 as the primary replacements. For local network admins and standard Windows 10/11 machines, SSTP isn't going anywhere; it remains built-in and ready to go.

On the other hand, Microsoft is actively showing SSTP the door in its cloud platform, Azure VPN Gateway. Since March 31, 2026, admins have been blocked from enabling SSTP on new or existing Azure gateways, and by March 31, 2027, any remaining SSTP cloud connections will stop working entirely. The reason boils down to scale: Azure hard-caps SSTP at just 128 concurrent connections per gateway regardless of tier, which Microsoft cited as a core reason for its retirement.

Read those two moves side by side, and the contradiction vanishes. On-premises servers needed a quick, built-in safety net for admins abandoning broken PPTP connections, and SSTP was already sitting there waiting. Azure, however, is where Microsoft builds for the future without decades of legacy baggage. There, the verdict is clear: SSTP is a transitional bridge in managed decline. It’s still supported where it fits, but IKEv2 and OpenVPN are what Microsoft is actually steering everyone toward.

Given all of that, the practical question deserves a straight answer.

Should You Use SSTP in 2026?

The short answer? It depends on who you are.

If you’re a regular user tweaking settings in a commercial VPN app: no. Your best move is to stick with WireGuard for speed and performance. If you run into strict network blocks, switch to OpenVPN (or an obfuscated protocol built specifically to stealth past aggressive firewalls) as your backup.

However, if you're a sysadmin managing Windows Server RRAS after Microsoft’s recent security hardening: yes. SSTP remains a reliable, fully supported bridge, ideally paired alongside IKEv2, while you plan your long-term infrastructure strategy.

One thing shouldn't get lost in SSTP's gradual decline: the core idea behind it was brilliant. Slipping VPN traffic inside standard HTTPS encryption was the right move. It just needed a modern, open-source engine to carry it forward.

The Good Idea Inside SSTP Lives On

SSTP's real insight was never the protocol details. It was the move itself: hide the VPN tunnel inside TLS on port 443, so that blocking it means blocking the web. That's a genuinely good idea, worked out almost two decades before much of what came after it.

It's also the same idea behind our Stealth protocol, and yes, we're aware that pointing to our own protocol here makes us a biased narrator. The logic holds up regardless: Stealth wraps OpenVPN in a layer of TLS using Stunnel (an open-source encryption tool), so it resembles ordinary HTTPS traffic to anything trying to filter it, built on auditable components instead of one closed vendor's stack. WStunnel takes the same idea over WebSocket, for networks that fight even harder.

SSTP's problem was never the idea. It was the packaging.

If you're stuck on a network that blocks everything except the open web, be smart about it: the fix isn't a protocol Microsoft is quietly winding down. It's one built the same way, kept open on purpose.

Frequently Asked Questions