Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.
I would like to enforce HSTS for only 1 subdomain, but not the whole domain, is this possible ?
xxx.yyy.com -> HSTS on
zzz.yyy.com -> HSTS off
yyy.com -> HSTS off
Send the Strict-Transport-Security header only for xxx.yyy.com, and do not specify includeSubDomains.
Browsers that properly handle HSTS will only set the requirement for the specified subdomain (xxx.yyy.com) in this case.
Required, but never shown