HSTS

`max-age` is the number of seconds the browser should remember the policy. Every visit refreshes it, so an active site keeps extending the window.

`includeSubDomains` applies the policy to every subdomain. It is required for preload and is the directive that causes accidents, because it covers subdomains you may have forgotten are served over plain HTTP.

`preload` signals consent to inclusion in the browser preload list. The directive by itself does nothing; submission to the list is a separate step.

A short `max-age` — hours rather than months — is the sensible way to start, precisely because the policy cannot be recalled from browsers that already have it.

A visitor typing a bare domain sends plain HTTP. The redirect to HTTPS arrives in the response, which means the request already travelled unprotected.

Anything on the network path saw it, and could have answered instead of the real server.

With an HSTS policy already stored, the browser rewrites the request to HTTPS before sending anything. There is no plain request to intercept.

The remaining gap is the very first visit ever, before any policy has been received — which is what the preload list exists to close.

The policy lives in the browser, not on the server. Removing the header does not remove the stored policy; it only stops refreshing it.

A browser holding a policy with a one-year `max-age` will refuse plain HTTP for that domain for up to a year, whatever the server now says.

The documented way to retract is to serve `max-age=0` over HTTPS and wait for visitors to receive it, which requires HTTPS to still be working.

So a site that enables HSTS with a long `max-age` and `includeSubDomains`, and then finds a subdomain that cannot do HTTPS, has a real problem and no quick fix.

Confirm every hostname under the domain serves HTTPS correctly with a valid certificate first, including ones you do not think of as websites.

Start with a short `max-age`, without `includeSubDomains`, and verify nothing breaks.

Raise the duration gradually, then add `includeSubDomains` once the subdomains are confirmed.

Check the header with `curl -I https://example.com | grep -i strict`. Note that browsers ignore the header when it arrives over plain HTTP, so it must be set on the HTTPS response.