HSTS

HSTS (HTTP Strict Transport Security) is an HTTP response header that tells the browser "for the next N seconds, always connect to this domain over HTTPS, even if the user types http://." That single rule eliminates the SSL-stripping attack where an on-path adversary downgrades the connection before TLS can engage. The `includeSubDomains` directive extends protection to every subdomain, and the `preload` directive (combined with submission to the HSTS preload list shipped in major browsers) means the first connection is already HTTPS-only. Removing HSTS is hard by design, so deploy with care.