HSTS (Strict-Transport-Security)

A header that the browser remembers: always connect to this website over HTTPS and never over unencrypted HTTP. The max-age parameter determines how long it remembers this (at least a year is recommended), includeSubDomains also applies to subdomains, and preload allows the site to be entered into the list built into browsers.