Strict-Transport-Security: the HSTS response header

The header only takes effect on a response that already arrived over a valid HTTPS connection. The browser then records the host for max-age seconds and rewrites every http:// URL for that host to https:// before a single byte leaves the machine. That is the real gain over a plain redirect: the plaintext request that a redirect still has to receive never happens at all.

max-age is a sliding window refreshed by every response carrying the header, so a site that sends it on every page keeps a memory that never quite expires. Setting max-age=0 is the documented way to withdraw the policy, and you have to keep serving that zero long enough for existing visitors to come back and see it. Simply deleting the header leaves old browsers pinned until their own timer runs out.

includeSubDomains applies the same rule to every name under the host, including the ones nobody remembers. If an internal hostname on the same domain still serves plain HTTP or a self-signed certificate, adding this token makes it unreachable rather than merely insecure, and the interstitial has no click-through option. Take an inventory of subdomains, including staging and mail hostnames, before you add it.

preload is not part of RFC 6797. It is a consent token for a hardcoded list compiled into browsers, which applies before the very first request to your domain is ever made. Getting listed requires a max-age of at least one year plus includeSubDomains, and removal takes months to reach real users, so treat inclusion as close to irreversible.