If I had a site only available in HTTPS should I still enable HSTS and Secure Flag?
site is only available in HTTPS
HSTS in this case at least notifies that browser that the site will not be available in HTTP for the foreseeable future. Once the browser knows this (i.e. after the first visit) a downgrade attack like sslstrip will fail, because the browser will not connect with insecure HTTP to the site.
The secure flag for cookies will probably not provide any security benefit because it was already enforced that the site is available through HTTPS only. But it does not harm either and is a cheap feature so in the spirit of multilayered security (i.e. add another layer in case one gets broken) you better add it.