CodeParkAfter one HTTPS visit, the browser uses only HTTPS for this domain and all its subdomains for a year, even if a link says
http://HSTS (HTTP Strict Transport Security) is a promise the browser remembers. For max-age seconds, it changes every http:// request for the domain to https:// before sending it. It also won't let users click through certificate errors. Browsers ignore the header when it arrives over plain HTTP.
"It also protects the very first visit" is the tempting wrong answer. The first visit is open until the browser has seen the header. The fix is the preload directive plus submitting the domain to the browsers' preload list. "It makes the server redirect" is wrong. You still need a normal redirect from port 80 to HTTPS. Be careful with includeSubDomains: any subdomain that only works over HTTP will break.