After the first visit, the browser rewrites every http:// URL for the domain to https:// internally, before any request leaves the machine. That protects against SSL stripping on public Wi-Fi. It also means certificate errors can no longer be clicked away.
max-age sets the duration in seconds, includeSubDomains extends the rule to every subdomain, and preload allows inclusion in the list built into browsers. Nextcloud recommends at least 15552000 seconds (180 days).
Be careful with includeSubDomains and preload: an internal service on a subdomain that only speaks HTTP becomes unreachable in browsers. Undoing it is slow, because browsers keep the policy until max-age expires.
Example
Strict-Transport-Security: max-age=15552000; includeSubDomains