Stricter encryption settings.
HSTS
Tells browsers to use https for your domain for a stated period, without even attempting http.
It prevents a class of attack and it is difficult to reverse.
THE CAUTION
Once a browser has the instruction, it refuses http for that domain for the duration you set, which may be a year.
If your certificate later fails, visitors cannot reach the site at all, and there is no click-through option.
BEFORE ENABLING IT
Be confident your certificate will always be valid, and that every subdomain you intend to include is covered.
Start with a short duration and increase it once you are satisfied.
THE INCLUDE SUBDOMAINS OPTION
Applies to every subdomain. If any subdomain lacks a certificate, it becomes unreachable.
Be careful with this.
MINIMUM TLS VERSION
Sets the oldest protocol version accepted.
Raising it excludes very old devices and browsers. For most audiences that is acceptable and slightly more secure.
Leave it at the default unless you have a compliance reason.
