Safety
HSTS Preload vs includeSubDomains for Public Sites
March 20, 2024
HSTS preload vs includeSubDomains for public sites is a first-visit commitment versus a header bit on later visits. includeSubDomains tells a browser that already learned HSTS from this host to apply it to subdomains too — including www if the apex sent the header. Preload is a public list (hstspreload.org / browser source) that can skip the first HTTP hop for listed domains. Preload requires includeSubDomains and a long max-age among other rules. Removal is slow. Most brochure sites want HSTS plus a redirect, not preload. RoastMyOpsec reads Strict-Transport-Security on the landing HTTPS response. It does not score missing preload, does not submit domains to the list, and does not test every subdomain.
The practical difference
Without includeSubDomains, HSTS on example.com does not teach the browser about shop.example.com. With it, a leftover HTTP-only tool subdomain becomes a lockout. Preload applies before the first byte to your server for browsers that ship the list — there is no 'try HTTP once' for listed names.
upgrade-insecure-requests rewrites subresources on this page. It is not preload. See UIR vs HSTS.
How to choose a commitment
All public hostnames on the domain are HTTPS with working certs: includeSubDomains is reasonable. You still have mail.example or a vendor CNAME on HTTP: do not set includeSubDomains and do not preload. Preload only after a staging period with the preload token in the header and an inventory of every DNS name. Canonical www vs apex first so you do not preload the wrong hostname.
| Control | When it applies | Rollback | Takeaway |
|---|---|---|---|
| HSTS max-age only | After this host was seen on HTTPS | Wait out max-age | Default for most sites |
| includeSubDomains | After parent HSTS is cached | Same, plus every subdomain | Only if every name is ready |
| HSTS preload list | First visit in supporting browsers | Slow list removal | Optional; not a roast F |
| HTTPS redirect | This request | Change the redirect | Still required without preload |
What the roast can prove
HSTS present or absent on the landing response is graded as a header. Missing preload is not a finding. Missing includeSubDomains is not automatically an F — it is a product choice. Pair with certificate expiry if max-age is heroic.
Common mistakes
The first mistake is preloading while a blog subdomain still serves HTTP.
The second mistake is includeSubDomains because a checklist said so, with an HTTP-only staging name on the same domain.
The third mistake is treating preload as required to 'pass' a roast.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does includeSubDomains require preload?
- No. Preload requires includeSubDomains. You can ship the flag without ever submitting to the list.
- Should brochure sites preload HSTS?
- Usually no until every subdomain is HTTPS-ready and you accept slow removal. Missing preload is not a roast F.
- Does RoastMyOpsec check the preload list?
- No. It reads the HSTS header on the response you get. It does not submit domains or crawl subdomains.