Report requirements status even if a site is preloaded about hstspreload.org HOT 4 CLOSED

For preloaded sites, we purposely don't show whether a site satisfies current requirements, because not all the same requirements apply to all sites on the list.

You can check for an individual site at the API endpoint:
https://hstspreload.appspot.com/api/v2/preloadable?domain=github.com

Once we have a database to keep track of which requirements apply to which site, we should show this data.

from hstspreload.org.

Thanks. I'm looking forward to it.

from hstspreload.org.

Once we have a database to keep track of which requirements apply to which site, we should show this data.

We can now query for bulk preloaded sites efficiently:

from hstspreload.org.

For https://twitter.com/vcsjones/status/910328524954902533

(I apologize ahead of the time that the JS code is not super-clean.)

We actually always race the preloadable and status checks:

Right now, we always ignore the preloadable result if the status is preloaded. You have to tell it to show the issues from the preloadable outcome here:

You'll also want to update the status string to explain "preloaded, but missing out on best practices (technically, requirements)" when there are issues (errors or warnings).

Now, that will have the problem that you don't know if a domain is bulk preloaded, so the string will show even for domains where the requirements don't apply. I suggest attaching this to the status result by extending the DomainState struct with a boolean bulk field based on the protected value, calculated from api.bulkPreloaded like at:

You should then be able to read the value in JS and decide to show the issues/custom status based on that.

from hstspreload.org.