By domain.  However, with a requirement for HTTPS, it doesn&#x27;t matter if MITM hijacks that domain and points it at another IP, because the server on that IP can&#x27;t present a valid certificate for that domain, so it won&#x27;t load at all.<p>Pinning makes that even more secure, but even without pinning, requiring HTTPS raises the bar from a simple MITM to obtaining a fraudulent certificate from a trusted certificate authority (risking a blacklist of that CA in all browsers).