Checks

HSTS includes subdomains

The HSTS header includes includeSubDomains, so the HTTPS-only rule covers hosts under this name.

Why it matters

Subdomains are a common place to serve a forgotten HTTP endpoint that would otherwise bypass HSTS on the parent.

What to do

Keep the directive only if every subdomain can answer on HTTPS.

Reference

HSTS max-age and directive syntax are defined by RFC 6797.

RFC 6797 — HTTP Strict Transport Security (HSTS)