HSTS Rollout SOP

HSTS Rollout SOP
Plain HSTS header vs full preload-list submission. Stage it, don't rush.

— Start with a short max-age (300s), no includeSubDomains, no preload. Confirm nothing breaks over HTTP-to-HTTPS.
— Raise to max-age 31536000 (1 year) once every subdomain serves valid TLS.
— Add includeSubDomains only after auditing every subdomain: a forgotten HTTP-only subdomain becomes unreachable.
— Add 'preload' and submit to hstspreload.org only when you're certain: removal from the list takes months and is hard to reverse.
— Verify: scan with an SSL checker that every host under the apex has a cert before includeSubDomains goes live.

Run this on every new HTTPS domain.