HSTS preload

A list maintained by the Chromium project and consumed, with local modifications, by the other major browsers.

It ships inside the browser binary, so a domain on it is enforced from installation, with no prior visit required.

Submission is through a public form at hstspreload.org, and the conditions are checked automatically at submission.

Because it is compiled into releases, both additions and removals travel at the speed of browser release cycles — measured in weeks to months, not hours.

A valid certificate, and a redirect from HTTP to HTTPS on the same host if the site serves HTTP at all.

An HSTS header on the HTTPS response with `max-age` of at least one year, plus `includeSubDomains` and `preload`.

Every subdomain must serve HTTPS, because `includeSubDomains` is mandatory and there is no way to exempt one afterwards.

The domain must be a registrable domain — the apex — not a subdomain, for generic top-level domains.

The submission form checks all of this live before accepting, so a domain that does not yet meet the conditions is refused rather than added and later broken.

Removal is requested through the same site, and the domain is taken off the list in a subsequent browser release.

Users receive that release when they update, which for a long tail of installations is months later.

Until then, the browser continues to refuse plain HTTP for the domain regardless of what the site serves.

This is the reason the conditions are strict: a domain added carelessly cannot be rescued quickly, and a subdomain that must serve plain HTTP has no exemption available.

For a site whose entire estate is HTTPS and expected to stay that way, it is a genuine improvement with no ongoing cost.

For an organisation with legacy internal subdomains, devices on the same domain, or systems it does not fully control, it is a trap that will be discovered later.

The intermediate position is a long `max-age` with `includeSubDomains` and no preload submission: almost all the benefit for returning visitors, and reversible within the `max-age` window.

Check current status with `curl -I https://example.com | grep -i strict` for the header, and the preload site's own query form for list membership.

Worth knowing before deciding: the list has grown to include a large share of prominent domains, and it is also used by some non-browser software, so the policy reaches further than browser releases alone.