<!--
	For problematic rules, see National_Archives.gov.uk-problematic.xml.

	For other UK government coverage, see GOV.UK.xml.


	Nonfunctional subdomains:

		- blog *
		- bookshop	(dropped)
		- media *
		- smartsource *

	* Refused


	Problematic subdomains:

		- ^	(cert only matches www)
		- labs	(works; expired 2012-06-23, self-signed)


	Partially covered subdomains:

		- discovery	(some pages redirect to http)


	Fully covered subdomains:

		- (www.) *	(^ → www)
		- community
		- images

	* Server is only configured for RC4 and weaker ciphers


	Observed cookie domains:

		- bookshop ¹
		- discovery ²
		- images ³
		- labs ⁴
		- smartsource ¹

	¹ Not secured by us <= we don't touch http cookies
	² Not secured by us <= incomplete coverage
	³ Secured by us
	⁴ Secured by us when set via https (rule off by default)


	Mixed content:

		- css, on:

			- labs from labs ¹
			- labs, www from www ¹
			- www from fonts.googleapis.com ¹

		- Images, on:
		- Images on labs from labs ¹
			- www from $self ¹

		- Web bugs on community, images, labs, www from smartsource ²

	¹ Secured by us
	² Unsecurable

-->
<ruleset name="NationalArchivesGovUK (partial)">

	<target host="nationalarchives.gov.uk" />
	<target host="*.nationalarchives.gov.uk" />
		<!--
			Some pages redirect to http:
							-->
		<exclusion pattern="^http://discovery\.nationalarchives\.gov\.uk/+(?!SearchUI/Content/)" />


	<securecookie host=".+\.nationalarchives\.gov\.uk$" name=".+" />


	<rule from="^http://(?:www\.)?nationalarchives\.gov\.uk/"
		to="https://www.nationalarchives.gov.uk/" />

	<rule from="^http://(community|discovery|images)\.nationalarchives\.gov\.uk/"
		to="https://$1.nationalarchives.gov.uk/" />
</ruleset>
