There are two ways in which HSTS is deployed. First, it is activated when the HSTS response header is sent by the site. Normally, the browser will remember the

There are two ways in which HSTS is deployed. First, it is activated when the HSTS response header is sent by the site. Normally, the browser will remember the HSTS response for a period of time. Clearly, a correctly implemented private mode breaks this, and thus breaks HSTS. However, Google and Mozilla are also pre-loading HSTS information. There was a blog post from Mozilla some months ago, describing how they have a crawler that detects long-term HSTS configuration in popular sites and then ships that information with browser releases. In this case, HSTS will work as intended even in private mode.