This is pretty reasonable provided that you&#x27;re not in danger of having to stop using HTTPS. For our personal blogs, that&#x27;s probably fine (and hey, I should kick up the timeout on my HSTS header, thanks for the reminder). For a site that you&#x27;re making for an employer or a customer, you should be certain that they&#x27;re not going to want to move it over to a non-HTTPS-compatible web host for whatever reason. Most of the time you can be confident about this; sometimes you can&#x27;t. Strict-Transport-Security is a promise to your viewers that for the next whatever time period you say, you&#x27;re not going to change your mind about HTTPS.