What is HSTS and should I enable it?

HSTS (HTTP Strict Transport Security) is a response header that tells browsers to always use HTTPS for your domain, even if someone types http://. It blocks downgrade attacks and is required for an A+ SSL Labs grade. It’s safe once your HTTPS is fully working, but you should only enable HSTS preload after you’re confident every subdomain has a valid cert, because it’s hard to reverse quickly. We enable it as the final hardening step, in the right order.