Let's assume that I have correctly configured my server to enforce the HSTS policy, and it works correctly for IE 11 browsers. What happens when a someone using an unsupported browser (e.g., IE 9) tries to access the site? What will the server do, and what will the user see? Is there a process/procedure to "gracefully" handle the condition of an unsupported browser accessing an HSTS site?
The only thing the server does when it comes to HSTS is sending the
Strict-Transport-Security header. Enforcing the policy - keeping track of which domain has HSTS, when it expires, making sure these are only accessed with HTTPS, etc. - is entierly the responsibility of the client (e.g. the browser).
So what happends when a non supporting browser visits a HSTS site? The browser sees a header it doesn't recognise, so it doesn't do anything with it. Then it continues doing what a browser does as if nothing happend. Of course the user of such a browser does not get any protection, but they don't get any compatibility problems either.
So there are no compatibility issues with HSTS, and you don't need to do anything extra for older browsers.