HSTS Preload Rollout Without Locking Out Subdomains

HSTS preloading places a domain on a list built into browsers, so they use HTTPS for it and all its subdomains before any visit, closing the first-request downgrade gap. Without it, a first plain-HTTP request can be intercepted on untrusted networks, such as through SSL-stripping proxies that expose session cookies. A standard HSTS header only protects visits after the first, while preloading covers that initial window as well. The author argues the setup should be enabled only once every subdomain serves valid HTTPS and a long max-age with includeSubDomains has been tested, since removal from the list takes months. Real header and status checks from major sites illustrate the requirements, including sending the header on redirect responses too.