[abarth]

I'd recommend starting out with a small max-age value so that any mistaken records will expire quickly. (Disclosure: I'm a co-editor of the HSTS RFC.)

[gellerb]

Yeah. I noticed that paypal.com has a max-age of 4 hours.

[rhoml]

Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.

[d0ugie]

Is there any downside, when using SSL, in enabling perfect forward secrecy?

[JshWright]

Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.