The HSTS policy does not cover subdomains.

HSTS_NO_INCLUDE_SUBDOMAINS · Severity: Info

• InfoHSTS_NO_INCLUDE_SUBDOMAINS

  The HSTS policy does not cover subdomains.

  Without includeSubDomains, only the host that sent the header is HTTPS-only. Subdomains can still be reached over plain HTTP, and preloading needs the directive.

Reported by

• HSTS header parser

Available through the API

• HSTS header parser API

Related findings

• Info HSTS_NOT_PRELOAD_READY The domain does not meet the HSTS preload requirements.
• Error HSTS_INVALID Browsers ignore this Strict-Transport-Security value.
• Warning HSTS_MAX_AGE_ZERO max-age=0 tells browsers to forget the HSTS policy.
• Warning HSTS_MISSING The HTTPS site sends no valid Strict-Transport-Security header.
• Warning HSTS_PRELOAD_NOT_ELIGIBLE The value asks for preloading but does not meet the preload list's rules.
• Info HSTS_SHORT_MAX_AGE The HSTS max-age is shorter than one year.

All findings