Thanks for answering so quickly!
The plugin headers were absent from .htaccess both before and after deactivation. But deactivating the plugin makes the entire site go down, so I was restoring the site from a backup each time.
It turns out, deactivating another security plugin, HideMyWP Ghost, and reactivating (which reset all of my settings for that plugin) fixed it. I then reactivated Headers Security Advanced & HSTS WP and everything seems to be working fine now.
Sorry about that! Thanks anyway!
