1. What does
The preload flag indicates consent for the domain to be allowed onto the HSTS preload list (used by Chrome, Firefox, IE 11, Edge, and other browsers).
The Chrome security team allows any domain to submit their domain to the list, provided it meets the following requirements:
- HTTPS is enabled on the root domain (e.g.
https://donotcall.gov), and all subdomains (e.g.
https://www.donotcall.gov) – especially the
www subdomain, if a DNS record for it exists.
- The HSTS policy includes all subdomains, with a long
max-age, and a
preload flag to indicate that the domain owner consents to preloading.
- The website redirects from HTTP to HTTPS, at least on the root domain.
You can see more information on the HSTS Preload Submission page.
2. What does
This is an argument of the Apache
Header directive (part of the mod_headers module):
The directive is applied if and only if the environment variable
varname exists. A
! in front of
varname reverses the test, so the directive applies only if
varname is unset.
In this case, the HTTP header is only sent when the
HTTPS environment variable is set. This environment variable is only set when pages/resources are accessed via HTTPS. The reasoning behind this is in section 7.2 of the HSTS specification:
An HSTS Host MUST NOT include the STS header field in HTTP responses conveyed over non-secure transport.
As to why, see this question.