Enable HSTS Preload in electrum.org domain to avoid MITM attacks

At present, the electrum.org domain sends this header
Strict-Transport-Security: max-age=31536000

This header is also known as HSTS, it tells the browser to only connect using HTTPS for the next 365 days.

The problem appears when the client is visiting electrum.org for the first time (or in incognito mode, or has deleted cache, etc.) The browser does not know that has to use HTTPS to browse to electrum.org so when the user types the domain in his browser he will be connecting to http:// electrum.org instead of https:// electrum.org. If the network is being attacked they could be phised.

How to fix it:
Add the includeSubDomains and preload directive to the header sent.
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Then just submit electrum.org domain to the HSTS Preload list in Chrome, Firefox and IE. This can be done easily.

Once submitted the next releases of the browsers will include circle.com in the HSTS Preload list and no one could load electrum.org via HTTP again.

As an example, bitcoin-related websites already using HSTS preloading include Coinbase, Coinapult, Bitgo, Localbitcoins, bitcoin.de, blockchain.info, GDAX and Multibit.

Start by locating the server configuration for electrum.org and verify the current Strict-Transport-Security response over HTTPS. Update the response to include includeSubDomains and preload, then check the HSTS preload submission requirements and verify that HTTP access is covered. Done means the header is correct and electrum.org is accepted for preloading.