How HSTS Prevents SSL Stripping
Without HSTS, when a user types "example.com", the browser makes an initial plaintext HTTP request before being redirected to HTTPS. An attacker on the local network can intercept this initial request and strip the redirect. HSTS instructs browsers to automatically convert all future HTTP requests to HTTPS before sending them over the wire.
Key HSTS Directives
max-age defines how long (in seconds) the browser should remember the policy. includeSubDomains extends the rule to all subdomains, protecting against session hijacking on subsidiary hosts. preload signals readiness for inclusion in browser hardcoded HSTS lists.
Operational Risks and Precautions
Never enable includeSubDomains or submit to the HSTS Preload list until you have verified that every current and future subdomain has a valid TLS certificate and does not serve plain HTTP content.