diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index 42124bc71..2332b6985 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -401,7 +401,7 @@ malformed:
 	case LWS_CALLBACK_RECEIVE_CLIENT_HTTP_READ:
 		lwsl_debug("%s: RECEIVE_CLIENT_HTTP_READ: read %d\n",
 				__func__, (int)len);
-		if (!h)
+		if (!h || !h->info.rx)
 			return 0;
 
 #if defined(LWS_WITH_SS_RIDESHARE)
@@ -456,7 +456,7 @@ malformed:
 
 	case LWS_CALLBACK_CLIENT_HTTP_WRITEABLE:
 		lwsl_info("%s: LWS_CALLBACK_CLIENT_HTTP_WRITEABLE\n", __func__);
-		if (!h)
+		if (!h || !h->info.tx)
 			return 0;
 
 		if (!h->rideshare)
diff --git a/lib/secure-streams/protocols/ss-mqtt.c b/lib/secure-streams/protocols/ss-mqtt.c
index e00ab6798..388f6d62b 100644
--- a/lib/secure-streams/protocols/ss-mqtt.c
+++ b/lib/secure-streams/protocols/ss-mqtt.c
@@ -80,7 +80,7 @@ secstream_mqtt(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 	case LWS_CALLBACK_MQTT_CLIENT_RX:
 		// lwsl_user("LWS_CALLBACK_CLIENT_RECEIVE: read %d\n", (int)len);
-		if (!h)
+		if (!h || !h->info.rx)
 			return 0;
 
 		pmqpp = (lws_mqtt_publish_param_t *)in;
@@ -109,7 +109,7 @@ secstream_mqtt(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		break;
 
 	case LWS_CALLBACK_MQTT_CLIENT_WRITEABLE:
-		if (!h)
+		if (!h || !h->info.tx)
 			return 0;
 		lwsl_notice("%s: ss %p: WRITEABLE\n", __func__, h);
 
diff --git a/lib/secure-streams/protocols/ss-raw.c b/lib/secure-streams/protocols/ss-raw.c
index e37b6710a..88c9bf989 100644
--- a/lib/secure-streams/protocols/ss-raw.c
+++ b/lib/secure-streams/protocols/ss-raw.c
@@ -75,7 +75,7 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 	/* chunks of chunked content, with header removed */
 	case LWS_CALLBACK_RAW_RX:
-		if (!h)
+		if (!h || !h->info.rx)
 			return 0;
 
 		if (h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, 0) < 0)
@@ -85,7 +85,7 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 	case LWS_CALLBACK_RAW_WRITEABLE:
 		lwsl_info("%s: RAW_WRITEABLE\n", __func__);
-		if (!h)
+		if (!h || !h->info.tx)
 			return 0;
 
 		buflen = lws_ptr_diff(end, p);
diff --git a/lib/secure-streams/protocols/ss-ws.c b/lib/secure-streams/protocols/ss-ws.c
index cdd19f942..ba78f7831 100644
--- a/lib/secure-streams/protocols/ss-ws.c
+++ b/lib/secure-streams/protocols/ss-ws.c
@@ -74,7 +74,7 @@ secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 	case LWS_CALLBACK_CLIENT_RECEIVE:
 		// lwsl_user("LWS_CALLBACK_CLIENT_RECEIVE: read %d\n", (int)len);
-		if (!h)
+		if (!h || !h->info.rx)
 			return 0;
 		if (lws_is_first_fragment(wsi))
 			f |= LWSSS_FLAG_SOM;
@@ -90,7 +90,7 @@ secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		return 0; /* don't passthru */
 
 	case LWS_CALLBACK_CLIENT_WRITEABLE:
-		if (!h)
+		if (!h || !h->info.tx)
 			return 0;
 		// lwsl_notice("%s: ss %p: WRITEABLE\n", __func__, h);
 
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 8424fe310..12768a3f1 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -90,10 +90,14 @@ lws_ss_event_helper(lws_ss_handle_t *h, lws_ss_constate_t cs)
 				    (void *)h, NULL);
 #endif
 
-	if (h->h_sink &&h->h_sink->info.state(h->sink_obj, h->h_sink, cs, 0))
+	if (h->h_sink && h->h_sink->info.state &&
+	    h->h_sink->info.state(h->sink_obj, h->h_sink, cs, 0))
 		return 1;
 
-	return h->info.state(ss_to_userobj(h), NULL, cs, 0);
+	if (h->info.state)
+		return h->info.state(ss_to_userobj(h), NULL, cs, 0);
+
+	return 0;
 }
 
 static void
diff --git a/lib/secure-streams/system/captive-portal-detect/captive-portal-detect.c b/lib/secure-streams/system/captive-portal-detect/captive-portal-detect.c
index 82b749491..02427e392 100644
--- a/lib/secure-streams/system/captive-portal-detect/captive-portal-detect.c
+++ b/lib/secure-streams/system/captive-portal-detect/captive-portal-detect.c
@@ -36,21 +36,6 @@ typedef struct ss_cpd {
 	uint8_t			partway;
 } ss_cpd_t;
 
-/* secure streams payload interface */
-
-static int
-ss_cpd_rx(void *userobj, const uint8_t *buf, size_t len, int flags)
-{
-	return 0;
-}
-
-static int
-ss_cpd_tx(void *userobj, lws_ss_tx_ordinal_t ord, uint8_t *buf,
-		   size_t *len, int *flags)
-{
-	return 1;
-}
-
 static int
 ss_cpd_state(void *userobj, void *sh, lws_ss_constate_t state,
 	     lws_ss_tx_ordinal_t ack)
@@ -95,8 +80,6 @@ lws_ss_sys_cpd(struct lws_context *cx)
 	memset(&ssi, 0, sizeof(ssi));
 	ssi.handle_offset	    = offsetof(ss_cpd_t, ss);
 	ssi.opaque_user_data_offset = offsetof(ss_cpd_t, opaque_data);
-	ssi.rx			    = ss_cpd_rx;
-	ssi.tx			    = ss_cpd_tx;
 	ssi.state		    = ss_cpd_state;
 	ssi.user_alloc		    = sizeof(ss_cpd_t);
 	ssi.streamtype		    = "captive_portal_detect";