Heartbleed Bug: Which Websites Recommend Changing Passwords?

Most of the major sites affected have patched their servers. Even before the vulnerability was released to the media. The Mashable.com list updates their status. You should change passwords for those now.

For other websites, the server status link above was designed to check if an affected site has been patched. Which is the reason it was provided. Note that a "broken pipe" alert can be caused by a Microsoft IIS web server, which uses its own SSL implementation and not affected by Heartbleed.