6

I configured my apache webserver to use HSTS Strict Transport Security.

If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security is only required for www.example.com and its subdomains. It is unfortunately not required for example.com itself and subdomains different from www.

Is there a way to configure that Strict Transport Security is also required for the (higher level) base domain example.com, if a user visits the subdomain www.example.com?

The only (ugly) workaround I found so far is to load some content (e.g., a picture) from example.com by embedding an absolute link https://example.com/content into the website.

Improve this question

1 Answer 1

Reset to default
3

Its not an ugly way. But a better way will be to use the preload system : https://hstspreload.appspot.com/

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .