HTTP Load Balancer: HSTS response header is missing includeSubdomains
Best practices are to include the includeSubdomains directive in HSTS header. When HSTS is enabled on an HTTP load balancers, includeSubDomains is missing from Strict-Transport-Security response header.
Reference links:
https://datatracker.ietf.org/doc/html/rfc6797
https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.html
-
Joseph Cunningham
- Jun 24 2025
Related ideas
