<!--
	For problematic rules, see Washington-Post-Company-mismatches.xml.

	slate.me and wapo.st are handled in Bit.ly_vanity_domains.xml.


	Other Washington Post Company rulesets:

		- CDN_Slate.com.xml
		- Slate.com.xml
		- WaPo_Labs.com.xml
		- Wash_Post.com.xml
		- WP_digital.net.xml


	CDN buckets:

		- washingtonpost.com.112.2o7.net

			- metrics

		- washpost.bloomberg.com

		- d2t2kgdkdgawhh.cloudfront.net

			- wp-eng-static.washingtonpost.com

		- css.washingtonpost.com.edgesuite.net
		- js.washingtonpost.com.edgesuite.net
		- media[23]?.washingtonpost.com.edgesuite.net
		- projects.washingtonpost.com.edgesuite.net
		- www.washingtonpost.com.edgesuite.net

		- knowmore.washingtonpost.com.inscname.net

		- washingtonpost-001.inscname.net

			- apps.washingtonpost.com

		- s5.parature.com

			- help.washingtonpost.com

		- pqasb.pqarchiver.com/washingtonpost/


	Nonfunctional domains:

		- washingtonpost.com subdomains:

			- apps			(404)
			- feeds			Refused
			- games			Dropped
			- knowmore		(404)
			- live			(404)
			- media2 *
			- media3 **
			- origin		(refused, redirects to www)
			- projects **
			- pwapi			(refused)
			- realestate		Dropped

	* 504, akamai
	** 503, akamai
	⁵ Redirects to http


	Problematic domains:

		- (www.)wapo.st				(times out)

		- in *washingtonpost.com:

			- ^			Refused
			- findnsave		(mismatched, CN: *.findnsave.com)
			- help			(works; mismatched, CN: *.parature.com)
			- media			(503, Akamai)
			- nie			(Mixed css)
			- metrics		(mismatched, CN: *.112.2o7.net)
			- wp-eng-static		(cloudfront)

		- (www.)washingtonpostmedia.com		(mismatched, CN: washpost.com)
		- (www.)washpostco.com			(akamai, mostly corporate-ir.net)


	Fully covered hosts in *washingtonpost.com:

		- (www.)?	(^ → www)
		- account
		- advertising
		- commerce
		- css
		- id
		- img
		- js
		- media		(→ ssl.washingtonpost.com)
		- metrics	(→ washingtonpost-com.112.2o7.net)
		- postpoints
		- ssl
		- ssl1
		- subscribe
		- subscription
		- syndication
		- voices
		- wordpressmultisite
		- wp-eng-static		(→ d2t2kgdkdgawhh.cloudfront.net)


	Insecure cookies are set for these domains and hosts:

		- .washingtonpost.com
		- account.washingtonpost.com
		- id.washingtonpost.com
		- ssl1.washingtonpost.com
		- subscribe.washingtonpost.com
		- subscription.washingtonpost.com
		- www.washingtonpost.com


	Mixed content:

		- css, on:

			- postpoints from netdna.bootstrapcdn.com ¹
			- nie from css.wpdigitalink.net ²

		- Font on syndication from img.wpdigital.net ¹

		- Images, on:

			- nie from www.washingtonpost.com ¹
			- postpoints from wordpressmultisite.wpprivate.com
			- syndication from $self ¹
			- www from commerce.washingtonpost.com ¹
			- www from media.washingtonpost.com ¹
			- www from media3.washingtonpost.com

	¹ Secured by us
	² Unsecurable <= refused
-->
<ruleset name="Washington Post.com (partial)">

	<!--	Direct rewrites:
				-->
	<target host="account.washingtonpost.com" />
	<target host="advertising.washingtonpost.com" />
	<target host="commerce.washingtonpost.com" />
	<target host="css.washingtonpost.com" />
	<target host="id.washingtonpost.com" />
	<target host="img.washingtonpost.com" />
	<target host="js.washingtonpost.com" />
	<!--target host="nie.washingtonpost.com" /-->
	<target host="postpoints.washingtonpost.com" />
	<target host="ssl.washingtonpost.com" />
	<target host="ssl1.washingtonpost.com" />
	<target host="subscribe.washingtonpost.com" />
	<target host="subscription.washingtonpost.com" />
	<target host="syndication.washingtonpost.com" />
	<target host="voices.washingtonpost.com" />
	<target host="wordpressmultisite.washingtonpost.com" />
	<target host="www.washingtonpost.com" />

	<!--	Complications:
				-->
	<target host="washingtonpost.com" />
	<target host="media.washingtonpost.com" />
	<target host="metrics.washingtonpost.com" />
	<target host="wp-eng-static.washingtonpost.com" />


	<!--	Not secured by server:
							-->
	<!--securecookie host="^\.washingtonpost\.com$" name="^(AWSELB|X-WP-Split|client_region|de|devicetype|galleryPlays|osfam|rpld0|rpld1|s_pers|s_sess|s_vi|wapo_last_ip|wapo_saved_ip|wapo_sess_id|wapo_vis_id|wp_pageview)$" /-->
	<!--securecookie host="^account\.washingtonpost\.com$" name="^sto-id-\d+$" /-->
	<!--securecookie host="^findnsave\.washingtonpost\.com$" name="^csrftoken$" /-->
	<!--securecookie host="^knowmore.washingtonpost.com$" name="^wpni_poe$" /-->
	<!--securecookie host="^ssl1\.washingtonpost\.com$" name="^sto-id-\d+$" /-->
	<!--securecookie host="^subscribe\.washingtonpost\.com$" name="^sto-id-\d+$" /-->
	<!--securecookie host="^subscription\.washingtonpost\.com$" name="^(?:JSESSIONID|sto-id-\d+)$" /-->
	<!--securecookie host="^www\.washingtonpost\.com$" name="^(JROUTE|JSESSIONID|backplane-channel|photoJSONAdConfig|wpni_poe)$" /-->

	<!--securecookie host=".*\.washingtonpost\.com$" name=".+" /-->
	<securecookie host="^(?:account|id|ssl1|subscribe|subscription|www)\.washingtonpost\.com$" name=".+" />


	<rule from="^http://washingtonpost\.com/"
		to="https://www.washingtonpost.com/" />

	<rule from="^http://media\.washingtonpost\.com/"
		to="https://ssl.washingtonpost.com/" />

	<rule from="^http://metrics\.washingtonpost\.com/"
		to="https://washingtonpost-com.112.2o7.net/" />

	<rule from="^http://wp-eng-static\.washingtonpost\.com/"
		to="https://d2t2kgdkdgawhh.cloudfront.net/" />

	<rule from="^http:"
		to="https:" />

</ruleset>
