diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 7d13a29fcf1..a562aa03eeb 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -758,7 +758,8 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     if(flow->detected_protocol_stack[1] == NDPI_PROTOCOL_UNKNOWN) {
       /* Avoid putting as subprotocol a "core" protocol such as SSL or DNS */
       if(ndpi_struct->proto_defaults[flow->guessed_protocol_id].subprotocol_count == 0) {
-	if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) {
+	if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN &&
+	   flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) {
 	  flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id;
 	  flow->detected_protocol_stack[1] = flow->guessed_protocol_id;
         }