Inventory the main domain and all subdomains before considering includeSubDomains. Confirm certificate renewal, HTTPS redirects and a recovery plan. Treat preload as a separate long-term commitment.

1. Verify valid HTTPS across every hostname you intend the policy to cover. Correct mixed content and redirect loops first.
2. Open SSL/TLS > Edge Certificates and the HSTS configuration. Read and acknowledge the consequences.
3. Start with a considered max-age and leave includeSubDomains disabled unless all affected names are ready. Do not enable preload as a routine checkbox.
4. Save and inspect the HTTPS response’s Strict-Transport-Security header. Test the site from a fresh browser and the ordinary application paths.
5. Monitor certificates and retain HTTPS throughout the policy lifetime. If disabling HSTS, serve max-age=0 over valid HTTPS and account for clients that have not revisited.

The intended HTTPS responses should carry one coherent HSTS policy. The application should remain usable with no certificate exceptions or insecure dependencies.

An existing browser policy persists until it expires or receives a valid clearing response. Preload removal involves browser-list propagation and is not an instant reversal. Avoid moving an HSTS-covered site to an HTTP-only destination.

Yes, it can require HTTPS there too. Inventory old, delegated and externally hosted subdomains before enabling a parent policy that covers them.

• Finding mixed content when HTTPS works through Cloudflare
• Moving a Cloudflare site to Full strict TLS safely
• Fixing a Cloudflare HTTPS redirect loop
• Diagnosing Cloudflare error 525 during the origin TLS handshake

• Cloudflare: HTTP Strict Transport Security
• hstspreload.org documentation