Yeah, it's very easy to degrade to HTTP accidentally. I recently set up HSTS for my personal domain, and I was quite surprised at where I was relying on HTTP. For example, to open Gmail I go to http://mail.jrock.us. If someone was MITM-ing me and that led to a fake version of Gmail, I would surely have been phished. (Though perhaps WebAuthn would have saved me.) The fact that that was HTTP and not HTTPS was obvious in retrospect, but not until I turned on HSTS. So overall, I thought it was a good experience that improved my personal security. And, since jrock.us is now preload-eligible, it should help protect my readers in the future. (Though I admit that I have approximately 0 readers!)

I wrote up the details if you want a little more info: https://jrock.us/posts/gmail-and-hsts/