> HSTS won't protect the initial connection, but will protect from future downgrade attacks by telling the browser to not accept insecure connections from the d

> HSTS won't protect the initial connection, but will protect from future downgrade attacks by telling the browser to not accept insecure connections from the domain. But HSTS preload [1] is meant to protect even the initial connection, right? If a site serves HSTS headers, it could (potentially) choose to be added to the preload list that’s used by many browsers. [1]: https://hstspreload.org https://hstspreload.org