The combination of recommending to use modern cipher modes with no known vulnerabilities and HSTS can be lethal. Older clients won't even know you're there. No

The combination of recommending to use modern cipher modes with no known vulnerabilities and HSTS can be lethal. Older clients won't even know you're there. No first page, no contact info, nothing. Just hang on page load. It might not always be desirable. It might be a good idea to have two security levels if you're doing HSTS. One to accept every cipher under the sun to use for public pages and data, and a secure one to use to protect session cookies for logged in users.