HSTS tells a browser to refuse plain http for your domain for a set period. It closes a real attack - the first request before the redirect - and it is remembered by the browser, which is exactly why it must be introduced carefully.

The header

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

What makes it dangerous

It is remembered, and it cannot be recalled. Send max-age=31536000 and every browser that saw it will refuse http for a year. If your certificate then expires or a subdomain has none, visitors get a warning they cannot click past - and removing the header does nothing, because the instruction is already in their browser.

Introduce it in stages

# week 1 - five minutes
add_header Strict-Transport-Security "max-age=300" always;

# week 2 - a day
add_header Strict-Transport-Security "max-age=86400" always;

# week 3 - a week, then a year once nothing has broken
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

includeSubDomains is the part that catches people

It applies to every subdomain, including ones you forgot: an old staging site, an internal tool, a legacy host with no certificate. All of them become unreachable over http, at once. Confirm every subdomain has a valid certificate before adding it.

for h in www shop staging api mail; do
  printf '%-8s ' "$h"
  curl -sS -o /dev/null -w '%{http_code}\
' "https://$h.example.com/" || echo FAIL
done

Preloading is permanent, practically speaking

The preload list is compiled into browsers, so the rule applies before any visit. Removal takes months to reach everybody. Do not add the preload token until the site has run a year at full max-age without incident.

If you are already locked out

Fix the certificate - that is the only real answer. For your own machine, Chrome can clear one domain at chrome://net-internals/#hsts, which lets you test but does nothing for your visitors.

HSTS is worth having. Automated renewal is what makes it safe - see renewal that silently fails.