HSTS Mistakes on Shopify Stores and How to Fix Them
HSTS looks simple: send one header, force HTTPS, move on. In e-commerce, especially on Shopify, that simplicity is deceptive. I’ve seen teams assume HSTS is “handled by the platform,” then get burned by custom domains, broken subdomains, mixed redirect chains, or a preload decision they couldn’t easily undo. Shopify removes a lot of infrastructure pain, but it doesn’t remove responsibility. You still own the domain, the DNS, any subdomains, third-party assets, and the customer experience when HTTPS behavior goes sideways. ...