HSTS

A header telling the browser to use HTTPS for this host for a given duration, removing the initial insecure request that a redirect still allows. It closes the window where a downgrade attack can happen on the first connection. It is genuinely hard to undo: a long max-age, and especially preload list inclusion, commits every subdomain to HTTPS for as long as browsers remember it.