A site sends the Strict-Transport-Security header over HTTPS with a max-age in seconds. From then on, for that long, the browser rewrites any http:// link to the site into https:// before sending anything and refuses to let the user click through certificate errors. includeSubDomains extends the rule to every subdomain.
The first visit is still unprotected, because the browser has not seen the header yet. The preload list closes that gap: domains that send the header with a long max-age, includeSubDomains and the preload token can be submitted to a list that is built into browsers. Some whole TLDs, such as .app and .dev, are on that list.
HSTS is easy to turn on and slow to turn off. Once browsers have cached a long max-age, or the domain is preloaded, every subdomain must work over HTTPS with a valid certificate, including internal or legacy hosts. Start with a short max-age, check all subdomains, and raise it afterwards. The header is ignored when it is sent over plain HTTP.
Example
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload