Index: .env.example
===================================================================
--- .env.example	(revision 5f483e38e1f3f8ccca8ba962aaacb14f4d06f7a3)
+++ .env.example	(revision 81bb9c588cda25bc4e200a46e001bf780d57c10f)
@@ -20,4 +20,10 @@
 # set it for production so email/login links point at the right place.
 PUBLIC_BASE_URL=
+
+# Strict HSTS. By default Klonkt sends a plain long max-age (safe on any domain).
+# Set HSTS_STRICT=1 ONLY if Klonkt owns the whole domain incl. all its subdomains:
+# it adds `includeSubDomains; preload`, which forces every subdomain to HTTPS and can
+# get your domain baked into browsers near-permanently. Leave unset if unsure.
+# HSTS_STRICT=1
 
 # ── Administrator ───────────────────────────────────────────────────