I'm seeing HSTS on 0/3 of Australian banks (I'm even seeing RC4 on one of them).

https://www.ssllabs.com/ssltest/analyze.html?d=commbank.com.... https://www.ssllabs.com/ssltest/analyze.html?d=nab.com.au&s=... https://www.ssllabs.com/ssltest/analyze.html?d=westpac.com.a...

Commonwealth's online banking is actually at my.commbank.com.au and does have HSTS - https://www.ssllabs.com/ssltest/analyze.html?d=www.my.commba...

CUA does have it - https://www.ssllabs.com/ssltest/analyze.html?d=ob.cua.com.au

Bankwest does but has some awful problems elsewhere - https://www.ssllabs.com/ssltest/analyze.html?d=ibs.bankwest....

But yeah, Westpac and NAB don't, and in addition to the ones you tested, ANZ and St. George don't have it either. That's pretty unacceptable really.

These are real issues that you can report to them.

You can (and should) also be using HTTPS Everywhere: https://www.eff.org/https-everywhere.

I think it's a nice plugin until you forget that you're using it and you rage for minutes/hours trying to understand why you can't access some website.

It might be worth it.

I remember spending hours trying to figure out why Google Adsense wouldn't render correctly. In the end I figured out that it was Adblock's fault :))

This only applies to websites which land on a plain HTTP page and then load links to HTTPS pages. Entering “ https:// “ explicitly before any URL accessed will fully mitigate this.