5% of top website still vulnerable to Heartbleed bug