HSTS preload list
The HSTS preload list is a hardcoded list baked directly into Chrome's source code -- and, via lists derived from it, into Firefox, Safari and other major browsers -- that forces every connection to a listed domain onto HTTPS from the very first request a browser ever makes to it, with no prior visit required. It exists to close a gap in RFC 6797's HTTP Strict Transport Security (HSTS) header: HSTS only takes effect after a browser has already seen the header once over a successful HTTPS connection, leaving a domain's very first connection unprotected if it happens to start over plain HTTP. A site submits itself for preloading at hstspreload.org, but every current and future subdomain must support HTTPS indefinitely first, since both addition and removal from the list take months to propagate through browser release cycles.
By AdminKit team, Netbase JSC · Updated