HSTS preload flag configured

HSTS preload eliminates the first-visit vulnerability — the one TCP request a browser makes over HTTP before it receives the HSTS header and commits to HTTPS. Without preload, a user who has never visited your site before (or who cleared browser storage) is vulnerable to SSL stripping on that first connection. CWE-311 and CWE-319 apply — the initial plaintext request exposes cookies, tokens, and session data to network-level interception before HSTS takes effect. OWASP A02 (Cryptographic Failures) identifies first-visit HTTP exposure as a transport security gap that preloading permanently eliminates.

Add all three required HSTS directives for preload eligibility. Preloading is irreversible on short timescales — only proceed if HTTPS is permanent for your domain and every subdomain.

// next.config.js
headers: [{
  source: '/(.*)',
  headers: [{
    key: 'Strict-Transport-Security',
    value: 'max-age=31536000; includeSubDomains; preload'
  }]
}]

After configuring, submit at hstspreload.org. All three are required: max-age >= 31536000, includeSubDomains, and preload. Removing from the preload list takes months — do not add preload for staging or short-lived domains.