I configured my apache webserver to use HSTS Strict Transport Security.

If my domain is example.com, most people visit my website over the subdomain www.example.com. Hence, Strict Transport Security is only required for www.example.com and its subdomains. It is unfortunately not required for example.com itself and subdomains different from www.

Is there a way to configure that Strict Transport Security is also required for the (higher level) base domain example.com, if a user visits the subdomain www.example.com?

The only (ugly) workaround I found so far is to load some content (e.g., a picture) from example.com by embedding an absolute link https://example.com/content into the website.

1 Answer 1


Its not an ugly way. But a better way will be to use the preload system : https://hstspreload.appspot.com/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.