HSTS preload is not recommended

[nfriedli]

On the HSTS preload page (https://hstspreload.org/):

Many browsers (Chrome, Safari) will automatically upgrade all HTTP navigations to HTTPS, regardless of the domain's HSTS policy. HSTS preloading only provides value when these upgrades fail in the presence of an active attacker. The benefits provided by HSTS preloading are minimal compared to the benefits provided by HSTS. While HSTS is recommended, HSTS preloading is not recommended.

It might be worth modifying the proposed guideline on the HSTS page:

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

by:

Strict-Transport-Security: max-age=63072000; includeSubDomains