Yes, the upgrades are included as HTTP requests. You likely are getting non-browser traffic on http
Yes, the upgrades are included as HTTP requests. You likely are getting non-browser traffic on http which is being redirected. HSTS preload should cut down on the amount of browsers which request http, explaining why almost all traffic goes straight to TLS
