Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commbank.com.au https

Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commbank.com.au https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commba... CUA does have it - https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au Bankwest does but has some awful problems elsewhere - https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest.com.au&s=203.37.86.1&latest https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest.... But yeah, Westpac and NAB don't, and in addition to the ones you tested, ANZ and St. George don't have it either. That's pretty unacceptable really.