Syntax: Strict-Transport-Security: max-age=63072000; includeSubDomains; preload, sent over HTTPS (browsers ignore it over HTTP). Until max-age expires the browser rewrites http:// URLs to https:// before any request leaves, which defeats SSL-stripping attacks after the first visit.
The first visit is still exposed, which the preload list fixes: domains submitted at hstspreload.org are compiled into Chrome, Firefox, Safari and Edge. Requirements include a valid certificate, an HTTP-to-HTTPS redirect on the same host, HTTPS on all subdomains and a header with max-age of at least 31,536,000 seconds, includeSubDomains and preload. Removal takes months to reach users, so test with short max-age values first. Whole top-level domains such as .dev and .app are preloaded.