What’s the best approach to enforce HSTS preload for all subdomains?
Asked on Sep 16, 2025
Answer
To enforce HSTS preload for all subdomains, you should include the `preload` directive in your HSTS header and ensure your domain is submitted to the HSTS preload list. This helps browsers automatically enforce HTTPS for your domain and its subdomains.
<!-- BEGIN COPY / PASTE -->
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
<!-- END COPY / PASTE -->Additional Comment:
- Ensure your entire site and all subdomains are served over HTTPS before enabling HSTS with `preload`.
- Once preloaded, your domain will be hardcoded into browsers to enforce HTTPS, which cannot be easily reversed.
- Regularly check your site's eligibility for the preload list at hstspreload.org.
✅ Answered with Security best practices.
Recommended Links: