HSTS (even with the embedded list) only works if the website operator opts-in. Just one example where your suggestion might break sites: Let's assume a site h

HSTS (even with the embedded list) only works if the website operator opts-in. Just one example where your suggestion might break sites: Let's assume a site hosts non-SSL content on www.example.com and SSL content on example.com. Now the site want's to default to SSL by changing most of the links and by automatically redirecting every non-SSL www.example.com request to a SSL secure.example.com. For "traditional" browsers this approach would work fine: Even if non-SSL resources are linked users are redirected to the right place. With the new Chrome approach chrome might block some of the content, but makes it clear why this was done. Users can also override this block (at least for now). With your suggestion this page will break as the browser tries to access the SSL version at www.example.com, which might not exist, or which might not have a correct certificate. Granted, this is just one example, and there are other cases where this approach might work fine. But the Web is just too complex to predict how such hacks will work out. I cannot think of a single such hack that did not create long term problems eventually.