The article mentions preloading but doesn't go into detail. You can apply for Chrome preload via https://hstspreload.org/ https://hstspreload.org/ which I ends

The article mentions preloading but doesn't go into detail. You can apply for Chrome preload via https://hstspreload.org/ https://hstspreload.org/ which I ends up in Chrome source, the list is then replicated to other browsers by their maintaniers. HSTS Preload will prevent initial-access downgrade attacks for clients using versions of browsers with your domain as a HSTS preload. The downside is preload removal is difficult and would take a fair while to propogate. Also another common misconception is disabling port 80 will remediate the issue - if an attacker can intercept and modify traffic they are able to open and redirect the port to a node under their control. https://letsencrypt.org/docs/allow-port-80/ https://letsencrypt.org/docs/allow-port-80/