I asked this question on Stack Overflow, but thought its more relevant here. Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def.example.com is also included?

In the RFC:

The OPTIONAL "includeSubDomains" directive is a valueless directive
which, if present (i.e., it is "asserted"), signals the UA that the
HSTS Policy applies to this HSTS Host as well as any subdomains of
the host's domain name.

This states "any", can I take that to mean every subdomain, no matter what level, e.g. sub1.sub2.sub3.example.com and not just sub3.example.com?


Yes, this should apply to all subdomains (see Steffen Ullrich's comment for caveat).

In foo.bar.foobar, foo is a subdomain of bar.foobar, and bar is a subdomain of foobar, so therefore foo.bar.foobar is an indirect subdomain of foobar.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.