HSTS missing preload directive

HSTS header lacks preload. Browsers and users expect sites to be secure. Missing protections expose visitors to data theft, phishing, and loss of trust.