HSTS preloading

[JuergenAuer]

@jsha

Any site that sends the preload flag on an HSTS header may be added to the Google or Mozilla preload list at any time by any person.

Really? Try it:

https://hstspreload.org/?domain=community.letsencrypt.org

Error: Subdomain community.letsencrypt.org is a subdomain. Please preload letsencrypt.org instead. (Due to the size of the preload list and the behaviour of cookies across subdomains, we only accept automated preload list submissions of whole registered domains.)