- Using a Short `max-age` Duration
- Not Using `includeSubDomains`       ---> Does not include subdomains
- Not Using the `preload` Directive
- Forgetting to Redirect HTTP to HTTPS