You enabled HSTS with includeSubDomains, and now some subdomains do not load. Or users cannot access services over HTTP. This is a common and serious issue: HSTS with includeSubDomains forces HTTPS on all subdomains, even those that do not support it. This guide explains why HSTS breaks subdomains and how to fix it.
What includeSubDomains does
HSTS tells browsers to use HTTPS only. includeSubDomains extends this to all subdomains.
Example:
Strict-Transport-Security: max-age=31536000; includeSubDomains
With includeSubDomains, browsers will refuse to connect to any subdomain over HTTP. If a subdomain does not support HTTPS, users cannot access it.
Why HSTS breaks subdomains
If includeSubDomains is set and a subdomain does not support HTTPS:
— browser refuses HTTP connection;
— subdomain does not load;
— users see an error;
— service becomes unavailable.
This can affect API subdomains, legacy services, or third-party integrations.
Reason 1: subdomain does not support HTTPS
The most common cause. A subdomain is served only over HTTP, or its SSL certificate is invalid.
What to check:
— does the subdomain support HTTPS;
— is the certificate valid;
— does it cover the subdomain.
The fix: enable HTTPS on the subdomain before using includeSubDomains.
Use HSTS checker to see the current HSTS header.
Reason 2: subdomain has invalid certificate
If the subdomain has an invalid certificate, HTTPS fails even if HSTS is set.
What to check:
— certificate validity;
— coverage of the subdomain;
— chain completeness.
The fix: install a valid certificate that covers the subdomain.
Reason 3: legacy services on HTTP
Some legacy services or internal tools run only on HTTP. includeSubDomains breaks them.
What to check:
— which subdomains run on HTTP;
— can they be upgraded to HTTPS;
— are they needed.
The fix: upgrade services to HTTPS or avoid includeSubDomains.
Reason 4: third-party integrations
Third-party integrations may use HTTP subdomains. includeSubDomains breaks them.
What to check:
— which integrations use subdomains;
— do they support HTTPS;
— can they be updated.
The fix: update integrations or avoid includeSubDomains.
Reason 5: HSTS preload
If HSTS is preloaded with includeSubDomains, the effect is permanent until the domain is removed from preload lists.
What to check:
— is HSTS preloaded;
— is includeSubDomains set;
— are all subdomains HTTPS-ready.
The fix: ensure all subdomains support HTTPS before preloading. Removing from preload takes time.
How to diagnose HSTS subdomain issues
A practical sequence:
— check HSTS header;
— check includeSubDomains;
— check all subdomains;
— check certificates;
— check legacy services;
— test after changes.
If subdomains break, the issue is likely HTTPS support. For a broader audit, SEO audit can help verify HSTS, SSL and subdomains in one place.
How to fix HSTS subdomain issues
Fix steps:
— enable HTTPS on all subdomains;
— install valid certificates;
— upgrade legacy services;
— update integrations;
— test before preloading;
— monitor after changes.
FAQ
Why does HSTS break subdomains?
Because includeSubDomains forces HTTPS on all subdomains. If a subdomain does not support HTTPS, users cannot access it.
Should I use includeSubDomains?
Only if all subdomains support HTTPS. Otherwise, it can break services.
How do I check if HSTS breaks subdomains?
Test each subdomain over HTTP. If it does not load, HSTS may be the cause.
Can I remove includeSubDomains?
Yes, but browsers that already received the header will remember it until max-age expires.
Does HSTS affect SEO?
Indirectly. If subdomains break, services and pages may become unavailable, affecting rankings.
What if a subdomain has an invalid certificate?
Fix the certificate before enabling includeSubDomains. Otherwise, the subdomain will not load.
Can legacy services be excluded?
Not if includeSubDomains is set. Upgrade them or avoid includeSubDomains.
How long does HSTS last?
Until max-age expires. With preload, it can be permanent until removed from lists.
What if HSTS is preloaded?
Removing from preload takes time. Ensure all subdomains support HTTPS before preloading.
How do I test HSTS safely?
Start with a short max-age and no includeSubDomains. Add includeSubDomains only after testing all subdomains.
