>If a site provides only HTTPS then sslstrip would fail as it can't fall back to HTTP

I don't believe this is true. Sslstrip would get the site in HTTPS and serve it to you in HTTP, right? Only pinning or hsts would prevent that, HTTPS only servers wouldn't help.

I guess they could mean hsts by HTTPS only, but the end of the article implies otherwise.

>Certificate pinning, though, is limited to Google sites at present

This is also false.

I'd also hope they'd mention something like HTTPS everywhere which also mitigates this.