Even if your site supports HTTPS, a first visit over plain HTTP can be intercepted on public Wi-Fi and redirected somewhere hostile. HSTS closes that gap: once a browser has seen the header, it refuses to talk to your domain over HTTP until the timer runs out.
Hosting platforms often give you HTTPS but not this header, and AI-generated projects rarely set it. The header only works over HTTPS, and it is a commitment. If you enable it for subdomains or preload before every subdomain supports HTTPS, visitors can be locked out of those pages.
Begin with a short max-age, confirm everything works, then raise it to a year. Add includeSubDomains only when all subdomains are HTTPS, and add preload only when you are certain, because removal from preload lists is slow.
Strict-Transport-Security: max-age=31536000; includeSubDomains