Been looking at implementing HSTS in to one of our sites, hoping to validate it on the preload list. But I can't get my head around how it works with the www. Subdomain.

Our site forces secure www.domain.com using this code in the htaccess.

  <ifModule mod_headers.c>
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" env=HTTPS

<IfModule mod_rewrite.c> 
RewriteEngine on
RewriteCond %{HTTPS} !=on [NC]
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [R=301,L]

This seems to only send headers when calling the www version.

But when validating, obviously you can't validate a subdomain and it needs to be root TLD. So you get this notice:

www.domain.com is a subdomain. Please preload domain.com instead. (Due to the size of the preload list and the behaviour of cookies across subdomains, we only accept automated preload list submissions of whole registered domains.)

If I remove the "env=https" and add "always" to the htaccess such as :

<ifModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

I then get it being used across both www and non www but it still doesnt validate as i get this warning:

Warning: Unnecessary HSTS header over HTTP, The HTTP page at domain.com sends an HSTS header. This has no effect over HTTP, and should be removed.

So im stuck as to what I've done wrong, or what i need to do next to make it validate.

Any help appreciated.

Please note. This is a standard Apache server, using htaccess ( because its a shared environment. Using Cpanel.

  • Why not keep the second case but put your Header set... only in the HTTPS VirtualHost for the "top" site, so that it will not apply to the HTTP ones nor the subdomains? – Patrick Mevzek May 15 '18 at 17:36

HSTS Preload Rules (simplified)

The following redirects should exist for a site that uses www as the canonical URL.

  • http://example.com -> https://example.com [No header]
  • https://example.com -> https://www.example.com [With header]
  • http://www.example.com -> https://www.example.com [No header]

enter image description here

The rules are:

  • HTTP should always redirect to HTTPS on the same URL Source
  • HTTPS should serve the HSTS header Source
  • HTTP should not serve the HSTS header Source

Why didn't your attempts work

The first attempt only serves headers on the www subdomain, breaking the second rule.

The second attempt breaks the third rule, HTTP shouldn't send the HSTS header.

| improve this answer | |
  • 1
    Those requirements are awful. http://example.com would be better to redirect to https://www.example.com to avoid double redirects. – Stephen Ostermiller May 26 '18 at 10:07
  • But then https://example.com wouldn't be visited, so includesubdomains wouldn't apply to the whole domain – jrtapsell May 26 '18 at 14:01
  • The first redirect only happens once per expiry window, after that the http->https is done inside the browser automatically – jrtapsell May 26 '18 at 14:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.