Python-Repository-Hub
diff --git a/‎pages/guide.md‎
Lines changed: 1 addition & 1 deletion b/‎pages/guide.md‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎pages/hsts.md‎
Lines changed: 2 additions & 2 deletions b/‎pages/hsts.md‎
Lines changed: 2 additions & 2 deletions
diff --git a/‎pages/index.md‎
Lines changed: 1 addition & 1 deletion b/‎pages/index.md‎
Lines changed: 1 addition & 1 deletion
@@ -58,7 +58,7 @@ Under either approach, web services used by non-browser clients (e.g. APIs) must
 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
 ```
 
-* The domain has been successfully [submitted and added to the HSTS preload list](https://hstspreload.appspot.com).
+* The domain has been successfully [submitted and added to the HSTS preload list](https://hstspreload.org).
 * Individual website subdomains are still encouraged to set their own HSTS policies.
 
 HSTS preloading a parent domain allows agencies to avoid inventorying and configuring an HSTS policy for every individual subdomain. However, this approach also automatically includes **all** subdomains present on this domain -- including intranet subdomains. All subdomains will need to support HTTPS in order to remain reachable for use in major browsers.
 
@@ -84,7 +84,7 @@ Firefox, Safari, Opera, and Edge also incorporate Chrome's HSTS preload list, ma
 
 ## How to preload a domain
 
-The Chrome security team allows anyone to [submit their domain to the list](https://hstspreload.appspot.com/), provided it meets the following requirements:
+The Chrome security team allows anyone to [submit their domain to the list](https://hstspreload.org), provided it meets the following requirements:
 
 * HTTPS is enabled on the root domain (e.g. `https://donotcall.gov`), and **all subdomains** (e.g. `https://www.donotcall.gov`) -- especially the `www` subdomain, if a DNS record for it exists. This necessarily includes any subdomains in use solely on intranets.
 * The HSTS policy includes all subdomains, with a long `max-age`, and a `preload` flag to indicate that the domain owner consents to preloading.
@@ -148,6 +148,6 @@ Here are some links to do that with other web servers:
 
 * [Browser support for HSTS](http://caniuse.com/#feat=stricttransportsecurity)
 * [HSTS web developer documentation](https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security) maintained by the Mozilla community
-* Chrome's [HSTS preload list](https://chromium.googlesource.com/chromium/src/+/master/net/http/transport_security_state_static.json), and their [submission form](https://hstspreload.appspot.com/).
+* Chrome's [HSTS preload list](https://chromium.googlesource.com/chromium/src/+/master/net/http/transport_security_state_static.json), and their [submission form](https://hstspreload.org).
 * ["Upgrading HTTPS in Mid-Air"](https://www.internetsociety.org/sites/default/files/01_4_0.pdf) - A paper analyzing the current detailed practice of HSTS and [HTTP Public Key Pinning](https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning), as of November 2014.
 * ["The first .gov domains hardcoded into your browser as all-HTTPS"](https://18f.gsa.gov/2015/02/09/the-first-gov-domains-hardcoded-into-your-browser-as-all-https/), by 18F.
@@ -53,7 +53,7 @@ HTTPS only guarantees the integrity of the connection between two systems, not t
 
 **Planning for Change:** Protocols and web standards improve regularly, and security vulnerabilities can emerge that require prompt attention. Federal websites and services should deploy HTTPS in a manner that allows for rapid updates to certificates, cipher choices (including [forward secrecy](/technical-guidelines/#forward-secrecy)) protocol versions, and other configuration elements. Agencies should monitor [https.cio.gov](https://https.cio.gov) and other [public resources](/resources/) to keep apprised of current best practices.
 
-**[Strict Transport Security](/hsts/):** Websites and services available over HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS going forward. This reduces insecure redirects, and protects users against attacks that attempt to downgrade connections to plain HTTP. Once HSTS is in place, domains can be submitted to a ["preload list"](https://hstspreload.appspot.com) used by all major browsers to ensure the HSTS policy is in effect at all times.
+**[Strict Transport Security](/hsts/):** Websites and services available over HTTPS must enable HTTP Strict Transport Security (HSTS) to instruct compliant browsers to assume HTTPS going forward. This reduces insecure redirects, and protects users against attacks that attempt to downgrade connections to plain HTTP. Once HSTS is in place, domains can be submitted to a ["preload list"](https://hstspreload.org) used by all major browsers to ensure the HSTS policy is in effect at all times.
 
 **Domain Name System Security (DNSSEC):** The new policy outlined in this Memorandum does not rescind or conflict with M-08-23, ["Securing the Federal Government's Domain Name System Infrastructure"](https://www.whitehouse.gov/sites/default/files/omb/memoranda/fy2008/m08-23.pdf). Once DNS resolution is complete, DNSSEC does not ensure the privacy or integrity of communication between a client and the destination IP. HTTPS provides this additional security.