  HSTS (HTTP Strict Transport Security) serves to protect websites from certain
attacks by allowing web servers to inform browsers that only secure HTTPS
connections should be used. However, this still leaves the initial connection
unsecured and vulnerable to man-in-the-middle attacks. The HSTS preload list,
now supported by most major browsers, is an attempt to close this initial
vulnerability. In this study, the researchers analyzed the HSTS preload list to
see the status of its deployment and industry acceptance as of December 2017.
The findings here show a bleak picture: adoption of the HSTS Preload List seem
to be practically nil for essential industries like Finance, and a significant
percentage of entries are test sites or nonfunctional.
