HSTS tells browsers to only ever use HTTPS for your domain. Send max-age with includeSubDomains — but skip the preload list, which its own operator now discourages.
RFC 6797 — HTTP Strict Transport Security (HSTS)
OWASP — HTTP Strict Transport Security Cheat Sheet