Hacker News Reader

Yeah. I noticed that paypal.com has a max-age of 4 hours.

Maybe the first step to avoid issues is to enforce SSL which is easy on any webserver before going HSTS.

Is there any downside, when using SSL, in enabling perfect forward secrecy?

Make sure you're using an SSL library that support ECDHE cipher suites... the non EC suites are very slow.