HSTS preload is easy to submit and hard to undo

HSTS preload writes a domain into browser-built lists so the first visit is HTTPS before any header is seen. Strong, and very slow to reverse.

To submit you need a valid certificate, HTTPS on every subdomain, includeSubDomains and preload in the header, and max-age of at least a year. After approval, it takes effect when Chrome, Firefox and Safari ship releases — months.

Removal is the same process in reverse, with no emergency path. If you have many subdomains or internal systems on self-signed certificates, decide before submitting.

For small sites the normal HSTS header is enough; preload adds little and cannot be undone quickly.