Decide whether to add includeSubDomains on Cloudflare

Why it matters

Without includeSubDomains, subdomains are not forced onto HTTPS by the main domain's policy. Adding it is a choice because it also locks every subdomain, including old or internal ones, to HTTPS.

Risky change. A wrong setting here can take your site or your mail offline. Follow the stages in order, test each one, and keep a way back.

The fix

1. Do the subdomain audit from the generic steps first.
2. Open SSL/TLS then Edge Certificates then HSTS and switch on Apply HSTS policy to subdomains (includeSubDomains), then choose the Max Age. Cloudflare's documentation lists max-age options starting at one month, which is a long commitment. For a shorter test, leave the built-in HSTS setting off and set the header with a Response Header Transform Rule instead (Rules then Overview then Create rule), with value max-age=300; includeSubDomains. Delete the rule and use the dashboard setting only once you are sure, and never run both at once.
3. Keep every subdomain on HTTPS afterwards. Cloudflare warns that turning off HTTPS while HSTS is active can make the site unreachable.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the HSTS check
• Add the Strict-Transport-Security (HSTS) header
• Fix the malformed Strict-Transport-Security header
• Re-enable HSTS (max-age is zero)
• Raise the HSTS max-age
• Meet the HSTS preload requirements or remove preload
• Consider submitting the domain to the HSTS preload list