HTTPS Everywhere Atlas

Embedded content loaded from third-party domains (for example, YouTube, Google Analytics, ad networks, or CDNs) may also be affected. You can test this by loading the web page in question in a browser with HTTPS Everywhere installed and pulling down the HTTPS Everywhere rules menu. This will show a list of HTTPS Everywhere rules that were applied as the page was loaded, including rules that might have affected embedded content from other domains.

<!--
	Insecure cookies are set for these hosts: ᶜ

		- norsk-tipping.no
		- www.norsk-tipping.no

	ᶜ See https://owasp.org/index.php/SecureFlag


	STS header includes includesubdomains
	for ^, www

--><ruleset name="Norsk-Tipping.no">

	<target host="norsk-tipping.no"/>
	<target host="*.norsk-tipping.no"/>

		<!--	STS header applies to one level only, so:
									-->
		<exclusion pattern="^http://(?:[^./]+\.){2,}norsk-tipping\.no/"/>

			<!--	+ve:
					-->
			<test url="http://this.host.norsk-tipping.no/"/>
			<test url="http://exists.not.norsk-tipping.no/"/>

		<test url="http://www.norsk-tipping.no/"/>


	<!--	Not secured by server:
					-->
	<!--securecookie host="^(?:www\.)?norsk-tipping\.no$" name="^(?:NorskTipping|TS[\da-f]{8})$" /-->

	<securecookie host=".+" name=".+"/>


	<rule from="^http:" to="https:"/>

</ruleset>

<!--
	Insecure cookies are set for these hosts: ᶜ

		- norsk-tipping.no
		- www.norsk-tipping.no

	ᶜ See https://owasp.org/index.php/SecureFlag


	STS header includes includesubdomains
	for ^, www

--><ruleset name="Norsk-Tipping.no">

	<target host="norsk-tipping.no"/>
	<target host="*.norsk-tipping.no"/>

		<!--	STS header applies to one level only, so:
									-->
		<exclusion pattern="^http://(?:[^./]+\.){2,}norsk-tipping\.no/"/>

			<!--	+ve:
					-->
			<test url="http://this.host.norsk-tipping.no/"/>
			<test url="http://exists.not.norsk-tipping.no/"/>

		<test url="http://www.norsk-tipping.no/"/>


	<!--	Not secured by server:
					-->
	<!--securecookie host="^(?:www\.)?norsk-tipping\.no$" name="^(?:NorskTipping|TS[\da-f]{8})$" /-->

	<securecookie host=".+" name=".+"/>


	<rule from="^http:" to="https:"/>

</ruleset>

The HTTPS Everywhere developers welcome corrections and updates to rules. Please see our developer information and documentation of the ruleset format. If filing a bug in the Tor Project's Trac bug tracker, you can use the shared username and password cypherpunks / writecode; please ensure that the bug is marked as applying to HTTPS Everywhere.

Information current as of:

current release 6a955e7 2018-11-01 05:00:06 -0700;
next release e7f9f87 2018-12-14 12:11:54 -0700;