I configured HSTS in HttpResponseHeaders giving value as maxtime = 31536000 but still showing insecure popup in URL and using HTTP

given name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains; preload" in HTTP Response Headers.