HTTP Security Headers – A Complete Guide
It's definitely worth repeating the warning that, while very useful, Strict-Transport-Security should be deployed with special care!<p>While the author's example of `max-age=3600` means there's only an hour of potential problems, enabling Strict-Transport-Security has the potential to prevent people from accessing your site if for whatever reason you are no longer able to serve HTTPS traffic.<p>Considering another common setting is to enable HSTS for a year, its worth enabling only deliberately and with some thought.