At some (hopefully in about a year) we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers. This would prevent many of these at

At some (hopefully in about a year) we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers. This would prevent many of these attacks. Unfortunately this is some time away as there are a handful of other subdomains on theguardian.com that are not yet HTTPS (you can only preload a domain along with all of its subdomains). We'll also continue to look at key pinning, although that's also some time away due to the increased burden of certificate management (essentially we'd need to have at least two valid certificates, one kept offline, at all times to mitigate against another heartbleed or similar attack).