HSTS is sent as an HTTP response header. Once received, the browser refuses HTTP for the lifetime of the max-age directive. Preload registration takes it a step further: the browser ships with the host in its built-in HTTPS-only list.
HSTS
Strict-Transport-Security — tells browsers to only ever talk to this host over HTTPS.