Our HSTS header is set with an expiry of a year. Provided you've visited the Guardian in the last year then you will not be able to click through an invalid certificate, nor can an attacker intercept an HTTP connection as none will be made.

At some stage we hope to list theguardian.com in the preloaded HSTS list that ships with the browsers, but unfortunately this is some time away as there are a handful of other subdomains on theguardian.com that are not yet HTTPS (you can only preload a domain along with all of its subdomains).