HSTS should not include preload directive

[ruffy91]

Is it possible to disable the including of the preload and includeSubDomains directives when enabling HSTS?

A default HSTS policy should never include the preload directive, as this will allow anyone to submit a donmain to https://hstspreload.org/ which will include the domain in future browser versions as a hardcoded list.
It is very cumbersome and can take months to get a domain off this list.

Because of this https://hstspreload.org/ recommends to not include preload in any default HSTS setting.

[mdecimus]

Thanks, fixed.

[ruffy91]

Thank you. I really appreciate this project. it allows me to host my and my family email myself

[TommyTran732]

Is there a way to include this directive without needing a reverse proxy? I will never run anything without HTTPS so it would be nice to have an option to add this back