HSTS promises HTTPS everywhere, the site does not deliver it

Checks

• Subdomain lacks valid certificate despite HSTS include_subdomains_but_subdomain_has_no_valid_certificate
• Preload requested but requirements not met preload_requested_but_requirements_not_met
• HSTS on some hosts only hsts_on_some_hosts_only
• HTTP links and files despite HSTS http_links_and_resources_despite_hsts
• HSTS sent over unsecured HTTP hsts_sent_over_http

Findings

• HSTS covers subdomains, but one subdomain has no valid certificate
• The HSTS policy says one thing and the hosts, links or headers say another

What this relies on

The policy states the intent; a forgotten subdomain breaks it.

How to verify by hand

Browser errors reported by users; the preload list status.