HSTS is a commitment you cannot withdraw quickly

The header tells browsers to refuse plain HTTP to this host for the given duration, and they honour it from cache — so shortening the max-age only affects visitors who come back and receive the new value.

# start here
add_header Strict-Transport-Security "max-age=300" always;

# then, once you are sure
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

includeSubDomains is the part that causes real damage: it applies to every subdomain including ones that do not have certificates, which is how an internal tool at legacy.example.com becomes unreachable for a year. Ramp the max-age over weeks and only add the subdomain flag after auditing what exists. Preloading is a further step and is genuinely hard to undo — treat it as permanent.