HSTS preload is a step beyond a normal HSTS header — it gets your domain baked directly into Chrome, Firefox, and Safari's source code as "always HTTPS," so even a user's very first visit is protected, before any header could even be read.
A regular HSTS header still has a gap: the very first visit before the browser has seen it. The HSTS preload list closes that gap completely by baking your domain into the browser itself — Chrome, Firefox, and Safari all ship with it built in.
HSTS preload list submission extends the protection your HSTS header already provides to address its one genuine remaining gap — the very first connection a visitor's browser makes to your domain, before that browser has ever received and remembered your HSTS header, still occurs without the guaranteed HTTPS-only enforcement HSTS is meant to provide for all subsequent visits.
The preload list, maintained and distributed by major browser vendors, closes this gap by baking HTTPS-only enforcement directly into the browser itself for listed domains — browsers with your domain in their preload list will refuse any HTTP connection to your domain from the very first visit, with no dependency on having previously received your HSTS header.
Submission to this list carries genuine, real technical commitment worth understanding clearly — inclusion is difficult to reverse quickly, since it requires your domain's removal to propagate through browser update cycles, meaning this step deserves confidence that your HTTPS configuration is genuinely solid and will remain reliably functional before pursuing preload inclusion.
This represents the logical extension of your broader HTTPS and HSTS work discussed elsewhere in this security strategy — once your foundational HTTPS enforcement and HSTS header are genuinely solid and tested, preload submission closes the one remaining gap in comprehensive, browser-enforced HTTPS protection for your domain.
Your domain is accepted at hstspreload.org and appears in the Chromium preload list source.
Fix it, then re-scan — the check confirms itself. No manual checkbox, the scan is the truth.
Run this check in H.I.V.E. →