HTTPSWatch (United States)

HTTPSWatch tracks the HTTPS support of prominent websites. Click to show details about a site’s HTTPS support. See the About page for more information.

Newspapers

8/4/1
Chicago Sun-Times (www.suntimes.com) Bad
  • Certificate hostname verification fails.
Tell Chicago Sun-Times they should improve their HTTPS support:
Chicago Tribune (www.chicagotribune.com) Bad
  • Certificate hostname verification fails.
Tell Chicago Tribune they should improve their HTTPS support:
Daily News (www.nydailynews.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Tell Daily News they should improve their HTTPS support:
The Denver Post (www.denverpost.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site redirects to HTTP.
Tell The Denver Post they should improve their HTTPS support:
The Guardian (www.theguardian.com) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Thank The Guardian for providing high quality HTTPS:
Los Angeles Times (www.latimes.com) Bad
  • Certificate hostname verification fails.
Tell Los Angeles Times they should improve their HTTPS support:
The New York Post (www.nypost.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Tell The New York Post they should improve their HTTPS support:
The New York Times (www.nytimes.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Tell The New York Times they should improve their HTTPS support:
POLITICO (www.politico.com) Bad
  • Certificate hostname verification fails.
Tell POLITICO they should improve their HTTPS support:
Der Spiegel (www.spiegel.de) Bad
  • A verified TLS connection can be established. SSL Labs grade is C.
  • The HTTPS site redirects to HTTP.
Tell Der Spiegel they should improve their HTTPS support:
USA Today (www.usatoday.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set but the max-age is less than 30 days.
  • HTTP site redirects to HTTPS.
Tell USA Today they should improve their HTTPS support:
The Wall Street Journal (www.wsj.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Tell The Wall Street Journal they should improve their HTTPS support:
Washington Post (www.washingtonpost.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Tell Washington Post they should improve their HTTPS support:

News

10/2/1
ABC News (abcnews.go.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is C.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Tell ABC News they should improve their HTTPS support:
BBC (www.bbc.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site redirects to HTTP.
Tell BBC they should improve their HTTPS support:
Buzzfeed (www.buzzfeed.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set but the max-age is less than 30 days.
  • HTTP site redirects to HTTPS.
Tell Buzzfeed they should improve their HTTPS support:
CBS Sports (www.cbssports.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Tell CBS Sports they should improve their HTTPS support:
CNN (www.cnn.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site redirects to HTTP.
Tell CNN they should improve their HTTPS support:
Daily Mail (www.dailymail.co.uk) Bad
  • Certificate hostname verification fails.
Tell Daily Mail they should improve their HTTPS support:
ESPN (espn.go.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is C.
  • The HTTPS site redirects to HTTP.
Tell ESPN they should improve their HTTPS support:
Forbes (www.forbes.com) Good
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Thank Forbes for providing high quality HTTPS:
Fox News (www.foxnews.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Tell Fox News they should improve their HTTPS support:
NBC News (www.nbcnews.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site redirects to HTTP.
Tell NBC News they should improve their HTTPS support:
NPR (www.npr.org) Bad
  • A verified TLS connection can be established. SSL Labs grade is B.
  • The HTTPS site redirects to HTTP.
Tell NPR they should improve their HTTPS support:
Time Magazine (time.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site redirects to HTTP.
Tell Time Magazine they should improve their HTTPS support:
TMZ (www.tmz.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Tell TMZ they should improve their HTTPS support:

Banking

1/7/3
Chase (www.chase.com) Good
  • A verified TLS connection can be established. SSL Labs grade is A-.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Bank of America (www.bankofamerica.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A-.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Citi (online.citibank.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Wells Fargo (www.wellsfargo.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A-.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Bank of New York Mellon (www.bnymellon.com) Mediocre
  • A verified TLS connection can be established. (SSL Labs report)
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
U.S. Bancorp (www.usbank.com) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
HSBC (www.hsbc.com) Bad
  • A TLS-related error (TLSV1_UNRECOGNIZED_NAME) occurs when trying to connect.
PNC (www.pnc.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Capital One (www.capitalone.com) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
TD Bank (www.tdbank.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
BB&T (www.bbt.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.

Travel

1/5/1
Southwest (www.southwest.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Delta (www.delta.com) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site returns an error status (403) on request.
American Airlines (www.aa.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header doesn't contain a max-age directive.
  • HTTP site redirects to HTTPS.
United Airlines (www.united.com) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Thank United Airlines for providing high quality HTTPS:
Kayak (www.kayak.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Travelocity (www.travelocity.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Expedia (www.expedia.com) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.

Universities

4/6/1
Brown (www.brown.edu) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A-.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Columbia (www.columbia.edu) Bad
  • A verified TLS connection can be established. SSL Labs grade is B.
  • The HTTPS site redirects to HTTP.
Cornell (www.cornell.edu) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is B.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Dartmouth (dartmouth.edu) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Harvard (www.harvard.edu) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTTPS site redirects to HTTP.
MIT (web.mit.edu) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Princeton (www.princeton.edu) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is B.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.
Stanford (www.stanford.edu) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
University of Chicago (www.uchicago.edu) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
University of Pennsylvania (www.upenn.edu) Bad
  • Certificate hostname verification fails.
Yale (www.yale.edu) Mediocre
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is not set.
  • HTTP site redirects to HTTPS.

US Government

2/0/11
National Weather Service (www.weather.gov) Bad
  • A verified TLS connection can be established. SSL Labs grade is A.
  • The HTML page loaded over HTTPS has mixed content.
  • Strict-Transport-Security header is not set.
  • HTTP site doesn't redirect to HTTPS.
Internal Revenue Service (www.irs.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
HealthCare.gov (www.healthcare.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
USAJOBS (www.usajobs.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Citizenship and Immigration Services (www.uscis.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Social Security Administration (www.ssa.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
NASA (www.nasa.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
National Oceanic and Atmospheric Administration (www.noaa.gov) Bad
  • connect() to port 443 times out.
Federal Trade Commission (www.ftc.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Office of Personnel Management (www.opm.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
EPA (www.epa.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Bureau of Labor Statistics (www.bls.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A+.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
The White House (www.whitehouse.gov) Good
  • A verified TLS connection can be established. SSL Labs grade is A.
  • A page can be successfully fetched over HTTPS.
  • Strict-Transport-Security header is set with a long max-age directive.
  • HTTP site redirects to HTTPS.
Thank The White House for providing high quality HTTPS: