Support

The preload flag does nothing. For the past several years (at this point I've lost count) you need to submit your site to https://hstspreload.org/ and it will be included in the HSTS preload list in the next version of each browser.

The includeSubDomains flag is not needed. Both your bare domain name (e.g. example.com) and your www subdomain (e.g. www.example.com) will be loaded with the same .htaccess file, therefore they will both get HSTS applied. In fact, HSTS and the redirection to HTTPS will precede any non-www to www (or vice-versa) redirection which is why both the bare domain and the www subdomain need to have a valid TLS certificate when you enable the HSTS option.

Therefore the includeSubDomains flag would only tell the browser that any other subdomain — even if it's a CNAME — will also have HSTS applied. This is problematic if you ever need a subdomain which is not HTTPS-only. There are some cases where you actually need that. Therefore it's prudent to have each subdomain decide whether to send an HSTS header or not.

Some very, very old tools to check HSTS would recommend these two flags without putting much thought into it. They are NOT necessary for HSTS to apply to your Joomla site and that's the objective we are fulfilling with the HSTS feature in Admin Tools' .htaccess Maker. The way it's implemented now is sensible for that context. If you have a legitimate use case for the includeSubDomains flag it means you understand enough about your server to know what you need to do. If you have to ask me how to do it, it means you don't actually need it. Hint: every instance of “Header set” supersedes any previous ones; you can include code at the bottom of the generated .htaccess therefore running it last.