Decide whether to add includeSubDomains on Apache

Why it matters

Without includeSubDomains, subdomains are not forced onto HTTPS by the main domain's policy. Adding it is a choice because it also locks every subdomain, including old or internal ones, to HTTPS.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Edit the existing Header line as in the generic steps, run apachectl configtest and reload.
2. Stage the change. Start with includeSubDomains at max-age=300, test several subdomains in a browser, and only then raise max-age as in the generic steps.

Header always set Strict-Transport-Security "max-age=300; includeSubDomains"

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list