Last year I was contracting at an NGO where somebody decided to add our domain to an HSTS preload list. This worked great for the public facing site, which was

Last year I was contracting at an NGO where somebody decided to add our domain to an HSTS preload list. This worked great for the public facing site, which was already served over HTTPS, but we also had a load of internal apps on the same domain. They were only accessible from our network (ethernet or VPN), so we hadn’t bothered with HTTPS before. Oh and we only found out about the issue when Chrome updated and everything broke - it was a fun few days!