[Xyrcode]

Alright, just did some more research onto the topic, it seems to work on all sites except Gmail and Twitter because they use HSTS headers, which GOOGLE and FIREFOX supports, which makes it not vulnerable anymore for those sites, however, if the user uses Safari, it would work.

SOURCE:
https://www.owasp.org/index.php/HTTP_Str...t_Security
And...
https://forums.hak5.org/index.php?/topic...l-twitter/