I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def.example.com is also included?
In the RFC:
The OPTIONAL "includeSubDomains" directive is a valueless directive which, if present (i.e., it is "asserted"), signals the UA that the HSTS Policy applies to this HSTS Host as well as any subdomains of the host's domain name.
This states "any", can I take that to mean every subdomain, no matter what level, e.g. sub1.sub2.sub3.example.com and not just sub3.example.com?