This part was new to me: http://en.wikipedia.org/wiki/Strict_Transport_Security http://en.wikipedia.org/wiki/Strict_Transport_Security This is an additional (d

This part was new to me: http://en.wikipedia.org/wiki/Strict_Transport_Security http://en.wikipedia.org/wiki/Strict_Transport_Security This is an additional (draft status) header that tells the user agent to always (or up to X seconds in the future) use HTTPS for that site and it seems, to disallow any connections using bad certificates. Currently only Chrome and latest dev version of Firefox seem to support it. Chrome apparently has a pre-loaded list of always-https domains, like www.paypal.com -- who are also the people behind this draft proposal.