Security
HSTS header setup: when to enable it and when to wait
HTTP Strict Transport Security is a browser policy that can protect users from being downgraded to HTTP after they have received the header over HTTPS. It is powerful precisely because the browser remembers it, which makes premature configuration risky.
Make HTTPS boring before adding HSTS
Every intended hostname should have valid certificates, reliable renewal, and correct HTTP-to-HTTPS redirects. Fix mixed content and redirect loops before asking browsers to refuse HTTP fallback.
Start with a cautious max-age
A shorter initial policy can reduce the blast radius while you verify production behaviour. Increase duration deliberately after the HTTPS path has proven stable.
Understand includeSubDomains before using it
That directive applies the policy to subdomains too. An old service, third-party hostname, or forgotten subdomain without working HTTPS can become inaccessible to browsers that inherit the policy.
Preload is a separate long-lived decision
Browser preload programs have additional requirements and removal is not immediate. Do not treat preload as a default checkbox; evaluate the entire domain namespace and operational maturity first.