Security finding
HSTS covers subdomains, but one subdomain has no valid certificate
Security Error Severity: High
Part of the audit HSTS promises HTTPS everywhere, the site does not deliver it. Finding id: security.hstsSubdomainWithoutTls.
What it costs you
Anyone who has visited [policy host] can no longer open [host] at all, and cannot click past the error.
What to do
Give [host] a valid certificate. Until then, stop sending includeSubDomains.
What it checks
- Subdomain lacks valid certificate despite HSTS
How to fix it
Change the HSTS setting at Cloudflare
- If Cloudflare adds the header: on the Edge Certificates page of the Cloudflare dashboard, open HTTP Strict Transport Security (HSTS).
- Set 'Apply HSTS policy to subdomains (includeSubDomains)' to Off and save, or issue a certificate for [host] first.
- If the header still shows includeSubDomains afterwards, your own server adds it; change it there.
How to check: curl -sI https://[policy host] | grep -i strict-transport-security
Fix
Fix the certificate or narrow the policy
- Issue a certificate for [host], or remove its DNS record if the host is no longer used.
- Otherwise remove includeSubDomains from the Strict-Transport-Security header of [policy host]. We could not detect what serves it, so we cannot give the exact setting.
How to check: curl -sI https://[policy host] | grep -i strict-transport-security
How to verify by hand
Open the subdomain in a browser that has visited the main site: it refuses to connect.
What this relies on
The policy states the intent. A subdomain that was forgotten breaks it.