includeSubDomains

includeSubDomains is a directive used in the HTTP Strict Transport Security (HSTS) policy. It signals that the HSTS rule applied to a domain should also apply to all current and future subdomains. When a user agent receives an HSTS header that includes includeSubDomains, it will only access the host and its subdomains over HTTPS for the duration specified by max-age.

Typical syntax appears in the Strict-Transport-Security header, for example: Strict-Transport-Security: max-age=31536000; includeSubDomains. The optional preload directive may also be included to request inclusion in browsers’ preloaded HSTS lists.

Impact and behavior: With includeSubDomains enabled, any subdomain added later must serve content exclusively over HTTPS. If a subdomain does not support HTTPS or has misconfigurations, users may be unable to reach that subdomain while the policy is in effect, potentially causing service disruption for all users who have visited the parent domain.

Deployment considerations: Before enabling includeSubDomains, ensure that all subdomains support HTTPS and present valid certificates. This is a strong commitment, as misconfigurations can lock users out of subdomains until the policy expires. It is common to set a long max-age for production sites, often followed by careful testing and, if desired, gradual rollout or use of the preload option.

Disabling: To revoke the policy, set max-age to 0 and remove includeSubDomains, then update all subdomains to support HTTPS. If the domain is on a preload list, removal requires submitting to the preload program and waiting for updates. IncludeSubDomains is defined in the context of HSTS (RFC 6797) and is widely supported by modern browsers.