0

Lets say I have a site that accepts example.com and www.example.com I want to enable HSTS and use preloaded on this site.

I've read that I need to be very careful because all the sub domains need to support https etc.

My question is if my entire domain (example.com) including all subdomains gets added to the HSTS preloaded list?

Lets say I have internal.example.com on another server completely running a totally different site without HSTS enabled, not even using https at all. Would this site also get checked for the preloaded HSTS list if the main domain is listed?

0

Yes. Every subdomain will get forced to HTTPS. If you preload HSTS on example.com, internal.example.com also gets HSTS. If it does not support HTTPS it will break.

  • Lets say I have HSTS enabled on internal.example.com but not on example.com. How will this work then? Will it only be for the subdomains for internal.example.com that are on the list? – PatricF Feb 18 at 8:52
1

To get your site preloaded by the browsers you must submit it to https://hstspreload.org/. The site there clearly states:

Submission Requirements
...
3.Serve all subdomains over HTTPS.
In particular, you must support HTTPS for the www subdomain if a DNS record for that subdomain exists.

  • Yes but I thought it was still a little unclear if it meant that its for subdomains accepted by the site enabling HSTS or all subdomains for the domain in general. – PatricF Feb 18 at 9:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.