probeo

How to roll out HSTS without breaking subdomains?

hsts_includesubdomains_unsafe_rollout global

The issue

includeSubDomains makes browsers refuse plain HTTP on every subdomain. Added before every subdomain serves valid HTTPS, it makes those subdomains unreachable for anyone whose browser has the policy, until max-age runs out. Visitors can’t click past the error.

The cause is that browsers cache the policy and the server can’t recall it early. Probeo records a missing includeSubDomains because subdomains are otherwise unprotected, so this page is about adding it safely.

Scope

The directive covers the host that sends it and every subdomain below it, at every level. Probeo checks the Strict-Transport-Security header on each response it fetches.

How to check you have it

  • In probeo: a policy without the directive is recorded as hsts:no-include-subdomains.
  • By hand: run curl -sI https://example.com/ and read strict-transport-security. Then list every subdomain in DNS and confirm each loads over HTTPS with a valid certificate.

The fix

Add includeSubDomains only after every subdomain serves valid HTTPS.

Start with HSTS on the main host alone and a short max-age. Test each subdomain, including staging, API and old ones. Then add includeSubDomains, and raise max-age in steps as confidence builds.

Done when: every subdomain loads over HTTPS, the header carries includeSubDomains, and the check above comes back clean.

Do not

  • Do not add includeSubDomains before testing every subdomain.
  • Do not start with a long max-age.
  • Do not add preload until the policy has been stable for some time.
  • Do not assume unused subdomains are safe to ignore.

FAQ

What happens if a subdomain does not support HTTPS when includeSubDomains is set?

The browser refuses to connect. The subdomain becomes unreachable until the HSTS max-age expires or the browser’s security state is manually cleared.

Can the policy be revoked after it is delivered?

No. The browser caches the policy for the duration of max-age. The server cannot instruct the browser to forget the policy.

Should staging and development subdomains support HTTPS before enabling includeSubDomains?

Yes. If they are accessible via browser, they must support HTTPS or they will be blocked once the policy is cached.

What is the correct initial max-age when rolling out HSTS?

Start with a short duration, such as 300 seconds or 3600 seconds. This allows rapid iteration and reduces the impact of misconfigurations.

What does the preload directive do?

It signals that the domain should be added to the browser’s HSTS preload list. Once preloaded, HTTPS is enforced before any connection is made. This cannot be undone quickly.

How can a team verify that all subdomains are ready for includeSubDomains?

Enumerate all subdomains in DNS and configuration. Test each subdomain’s HTTPS endpoint. Confirm that a valid certificate is presented and the connection succeeds.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.