HTTP Strict Transport Security

A header that tells the browser: this host is HTTPS only, for a while. Preload is a one-way door.

HSTS is an HTTP response header. After a browser sees it on a valid HTTPS response, it refuses plain HTTP to that host for max-age seconds. includeSubDomains extends the rule to every name under it.

It does not encrypt anything by itself. TLS still does the wire. HSTS only stops the browser going back to http:// once it has already had a good HTTPS hit. The first visit can still be HTTP unless you already 308 to HTTPS.

preload puts the host in a list shipped with browsers. Getting on that list is easy. Getting off it is slow. Treat it as a one-way door. Do not send the header, and do not submit preload, until HTTPS on every name is solid and the HTTP to HTTPS redirect has stuck.