A quick note to myself – in Chrome you can check your HSTS headers for a site using:

chrome://net-internals/#hsts

This was a problem for me yesterday, and the UAT system I was configuring wasn’t visible to sites like https://securityheaders.io/ that I’d normally use.