HSTS preload is not recommended

[nfriedli]

On the HSTS preload page (https://hstspreload.org/):

Many browsers (Chrome, Safari) will automatically upgrade all HTTP navigations to HTTPS, regardless of the domain's HSTS policy. HSTS preloading only provides value when these upgrades fail in the presence of an active attacker. The benefits provided by HSTS preloading are minimal compared to the benefits provided by HSTS. While HSTS is recommended, HSTS preloading is not recommended.

It might be worth modifying the proposed guideline on the HSTS page:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

by:

Strict-Transport-Security: max-age=63072000; includeSubDomains

[jdevalk]

Thanks @nfriedli — you're right, and the source is about as authoritative as it gets (the preload list's own operator). Fixed.

The HSTS page now recommends max-age=63072000; includeSubDomains — no preload — and carries a short section on why preloading is no longer recommended: modern browsers auto-upgrade HTTP navigations to HTTPS regardless of any HSTS policy, so the marginal benefit is minimal, while removal from the list takes months. This site's own header dropped preload to match.

Logged in the changelog too: HSTS preloading is no longer recommended. (Both links go live once the deploy finishes, in a few minutes.)

Does that cover it efficiently? I'll close this out — if I've missed anything, please follow up and reopen.