<commit_before><!DOCTYPE html>
<html>
<head>
  <meta name="viewport" content="width=device-width, initial-scale=0.5">
  <title>HSTS Preload List Submission</title>
  <link rel="shortcut icon" href="favicon.ico">
  <link rel="apple-touch-icon" href="static/app-icon.png"/>
  <link type="application/opensearchdescription+xml" rel="search" href="search.xml"/>

  <link rel="stylesheet" href="static/css/style.css">
  <link rel="stylesheet" href="static/css/form.css">
  <script src="static/js/base.js"></script>
  <script src="static/js/view.js"></script>
  <script src="static/js/form.js"></script>
</head>
<body class="theme-green">

<div class="content form">
  <form id="domain-form" class="hidden">
    <h2><label for="domain">
      Enter a domain for the HSTS preload list:
    </label></h2>

    <input id="domain" name="domain" type="text" placeholder="example.com"
      autocorrect="off" autocapitalize="off" spellcheck="false">
    </input>
    <br>
    <input id="check" type="submit" value="Check status and eligibility">

  </form>

  <!-- We un-hide the form using inline JS so that (when JS is enabled)
       it shows in the normal rendering order as if it was never hidden. -->
  <script>document.getElementById("domain-form").classList.remove("hidden");</script>
  <noscript>Submitting entries to the HSTS preload list via this site requires Javascript.</noscript>

  <div id="result-waiting" class="hidden">
    <div id="spinner" class="spinner"></div>
    <br>
    <p id="checking"></p>
  </div>

  <div id="result" class="hidden">
    <p id="status"></p>
    <p id="summary"></p>
    <div class="issues">
      <div id="errors" class="issues-list"></div>
      <div id="warnings" class="issues-list"></div>
    </div>
  </div>

  <form id="submit-form" class="hidden">
  <hr>
    <h2>Submit</h2>
    <div id="checkboxes">
      <label>
        <input type="checkbox" id="checkbox-owner"><span>I am the site owner of <tt><span class="domain-text">example.com</span></tt> or have their permission to preload HSTS.</span>
      </label>
      <span id="oops">
        (If this is not the case, <tt><span class="domain-text">example.com</span></tt> may be sending the HSTS <tt>preload</tt> directive by accident. Please <a id="oops-mailto" href="mailto:<EMAIL>">contact <EMAIL></a> to let us know.)
      </span>
      <br><br>
      <label>
        <input type="checkbox" id="checkbox-subdomains"><span>I understand that preloading <tt><span class="domain-text">example.com</span></tt> through this form will prevent <strong>all subdomains and nested subdomains</strong> from being accessed without a valid HTTPS certificate:
        <span class="subdomain-example"><tt>*.<span class="domain-text">example.com</span></tt></span>
        <span class="subdomain-example"><tt>*.*.<span class="domain-text">example.com</span></tt></span>
        <span class="subdomain-example"><tt>...</tt></span>
        </span></label>
    </div>
    <br>
    <input id="submit" type="submit" disabled
       value="Submit to the HSTS preload list">
    <div id="submit-success" class="submit-feedback hidden">
      <hr>
      <h2>Success</h2>
        <p><tt class="domain-text">example.com</tt> is now pending inclusion in the HSTS preload list!
        </p>
        <p>Please make sure that <tt class="domain-text">example.com</tt> <b>continues</b> to satisfy all preload requirement, or it will be removed. Please revisit this site over the next few weeks to check on the status of your domain.</p>
        <p>Also consider scanning for TLS issues <a id='ssl-labs-link' href='https://www.ssllabs.com/ssltest/analyze.html'>using SSL Labs</a>.</p>
    </div>
    <div id="submit-failure" class="submit-feedback hidden">
      <hr>
      <h2>Failure</h2>
      An error occurred. Please start over.
    </div>
  </form>
</div>

<div class="content">
  <section id="information">
    <h2><a class="hash-link" href="#information">Information</a></h2>
    <p>
      This form is used to submit domains for inclusion in Chrome's <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security">HTTP Strict Transport Security (HSTS)</a> preload list.
      This is a list of sites that are hardcoded into Chrome as being HTTPS only.
    </p>
    <p>
      Most major browsers (Chrome, <a href="https://blog.mozilla.org/security/2012/11/01/preloading-hsts/">Firefox</a>, Opera, Safari, <a href="https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/">IE 11 and Edge</a>) also have HSTS preload lists based on the Chrome list. (See the <a href="http://caniuse.com/#feat=stricttransportsecurity">HSTS compatibility matrix</a>.)
    </p>
  </section>

  <section id="submission-requirements">
    <h2><a class="hash-link" href="#submission-requirements">Submission Requirements</a></h2>
    <p>If a site sends the <tt>preload</tt> directive in an HSTS header, it is considered to be requesting inclusion in the preload list and may be submitted via the form on this site.</p>
    <p>In order to be accepted to the HSTS preload list through this form, your site must satisfy the following set of requirements:</p>
    <ol>
      <li>Serve a valid <b>certificate</b>.</li>
      <li><b>Redirect</b> from HTTP to HTTPS on the same host.</li>
      <li>Serve all <b>subdomains</b> over HTTPS.</li>
        <ul>
          <li>In particular, you must support HTTPS for the <tt>www</tt> subdomain if a DNS record for that subdomain exists.</li>
        </ul>
      <li>Serve an <b>HSTS header</b> on the base domain for HTTPS requests:
        <ul>
          <li>The <tt>max-age</tt> must be at least eighteen weeks (<tt>10886400</tt> seconds).</li>
          <li>The <tt>includeSubDomains</tt> directive must be specified.</li>
          <li>The <tt>preload</tt> directive must be specified.</li>
          <li>If you are serving an additional redirect from your HTTPS site, that redirect must still have the HSTS header (rather than the page it redirects to).</li>
        </ul>
      </li>
    </ol>
    <p>
      For more details on HSTS, please see <a href="https://tools.ietf.org/html/rfc6797">RFC 6797</a>.

      Here is an example of a valid HSTS header:
    </p><commit_msg>Clarify that you don't have to listen on HTTP<commit_after><!DOCTYPE html>
<html>
<head>
  <meta name="viewport" content="width=device-width, initial-scale=0.5">
  <title>HSTS Preload List Submission</title>
  <link rel="shortcut icon" href="favicon.ico">
  <link rel="apple-touch-icon" href="static/app-icon.png"/>
  <link type="application/opensearchdescription+xml" rel="search" href="search.xml"/>

  <link rel="stylesheet" href="static/css/style.css">
  <link rel="stylesheet" href="static/css/form.css">
  <script src="static/js/base.js"></script>
  <script src="static/js/view.js"></script>
  <script src="static/js/form.js"></script>
</head>
<body class="theme-green">

<div class="content form">
  <form id="domain-form" class="hidden">
    <h2><label for="domain">
      Enter a domain for the HSTS preload list:
    </label></h2>

    <input id="domain" name="domain" type="text" placeholder="example.com"
      autocorrect="off" autocapitalize="off" spellcheck="false">
    </input>
    <br>
    <input id="check" type="submit" value="Check status and eligibility">

  </form>

  <!-- We un-hide the form using inline JS so that (when JS is enabled)
       it shows in the normal rendering order as if it was never hidden. -->
  <script>document.getElementById("domain-form").classList.remove("hidden");</script>
  <noscript>Submitting entries to the HSTS preload list via this site requires Javascript.</noscript>

  <div id="result-waiting" class="hidden">
    <div id="spinner" class="spinner"></div>
    <br>
    <p id="checking"></p>
  </div>

  <div id="result" class="hidden">
    <p id="status"></p>
    <p id="summary"></p>
    <div class="issues">
      <div id="errors" class="issues-list"></div>
      <div id="warnings" class="issues-list"></div>
    </div>
  </div>

  <form id="submit-form" class="hidden">
  <hr>
    <h2>Submit</h2>
    <div id="checkboxes">
      <label>
        <input type="checkbox" id="checkbox-owner"><span>I am the site owner of <tt><span class="domain-text">example.com</span></tt> or have their permission to preload HSTS.</span>
      </label>
      <span id="oops">
        (If this is not the case, <tt><span class="domain-text">example.com</span></tt> may be sending the HSTS <tt>preload</tt> directive by accident. Please <a id="oops-mailto" href="mailto:<EMAIL>">contact <EMAIL></a> to let us know.)
      </span>
      <br><br>
      <label>
        <input type="checkbox" id="checkbox-subdomains"><span>I understand that preloading <tt><span class="domain-text">example.com</span></tt> through this form will prevent <strong>all subdomains and nested subdomains</strong> from being accessed without a valid HTTPS certificate:
        <span class="subdomain-example"><tt>*.<span class="domain-text">example.com</span></tt></span>
        <span class="subdomain-example"><tt>*.*.<span class="domain-text">example.com</span></tt></span>
        <span class="subdomain-example"><tt>...</tt></span>
        </span></label>
    </div>
    <br>
    <input id="submit" type="submit" disabled
       value="Submit to the HSTS preload list">
    <div id="submit-success" class="submit-feedback hidden">
      <hr>
      <h2>Success</h2>
        <p><tt class="domain-text">example.com</tt> is now pending inclusion in the HSTS preload list!
        </p>
        <p>Please make sure that <tt class="domain-text">example.com</tt> <b>continues</b> to satisfy all preload requirement, or it will be removed. Please revisit this site over the next few weeks to check on the status of your domain.</p>
        <p>Also consider scanning for TLS issues <a id='ssl-labs-link' href='https://www.ssllabs.com/ssltest/analyze.html'>using SSL Labs</a>.</p>
    </div>
    <div id="submit-failure" class="submit-feedback hidden">
      <hr>
      <h2>Failure</h2>
      An error occurred. Please start over.
    </div>
  </form>
</div>

<div class="content">
  <section id="information">
    <h2><a class="hash-link" href="#information">Information</a></h2>
    <p>
      This form is used to submit domains for inclusion in Chrome's <a href="https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security">HTTP Strict Transport Security (HSTS)</a> preload list.
      This is a list of sites that are hardcoded into Chrome as being HTTPS only.
    </p>
    <p>
      Most major browsers (Chrome, <a href="https://blog.mozilla.org/security/2012/11/01/preloading-hsts/">Firefox</a>, Opera, Safari, <a href="https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/">IE 11 and Edge</a>) also have HSTS preload lists based on the Chrome list. (See the <a href="http://caniuse.com/#feat=stricttransportsecurity">HSTS compatibility matrix</a>.)
    </p>
  </section>

  <section id="submission-requirements">
    <h2><a class="hash-link" href="#submission-requirements">Submission Requirements</a></h2>
    <p>If a site sends the <tt>preload</tt> directive in an HSTS header, it is considered to be requesting inclusion in the preload list and may be submitted via the form on this site.</p>
    <p>In order to be accepted to the HSTS preload list through this form, your site must satisfy the following set of requirements:</p>
    <ol>
      <li>Serve a valid <b>certificate</b>.</li>
      <li><b>Redirect</b> from HTTP to HTTPS on the same host, if you are listening on HTTP.</li>
      <li>Serve all <b>subdomains</b> over HTTPS.</li>
        <ul>
          <li>In particular, you must support HTTPS for the <tt>www</tt> subdomain if a DNS record for that subdomain exists.</li>
        </ul>
      <li>Serve an <b>HSTS header</b> on the base domain for HTTPS requests:
        <ul>
          <li>The <tt>max-age</tt> must be at least eighteen weeks (<tt>10886400</tt> seconds).</li>
          <li>The <tt>includeSubDomains</tt> directive must be specified.</li>
          <li>The <tt>preload</tt> directive must be specified.</li>
          <li>If you are serving an additional redirect from your HTTPS site, that redirect must still have the HSTS header (rather than the page it redirects to).</li>
        </ul>
      </li>
    </ol>
    <p>
      For more details on HSTS, please see <a href="https://tools.ietf.org/html/rfc6797">RFC 6797</a>.

      Here is an example of a valid HSTS header:
    </p>
{'fraction_non_alphanumeric': 0.16043886150421371, 'fraction_numerical': 0.008427412943234219, 'mean_word_length': 3.565880217785844, 'pattern_counts': {'":': 0, '<': 431, '<?xml version=': 0, '>': 431, 'https://': 10, 'lorem ipsum': 0, 'www.': 4, 'xml': 4}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1414183', 'n_tokens_mistral': 4133, 'n_tokens_neox': 3967, 'n_words': 1173}