HSTS preload is set
The HSTS header includes the preload directive. That is a request to be hardcoded as HTTPS-only in browsers.
Why it matters
Preload is hard to undo. Browsers will refuse HTTP for the name, including subdomains, after the list updates.
What to do
Submit the domain at hstspreload.org only after max-age is one year, includeSubDomains is set, and every subdomain is HTTPS.
Reference
The Chromium HSTS preload list makes HTTPS the default before the first visit.