HSTS includes includeSubDomains

HSTS without includeSubDomains protects only the apex domain — api.yourdomain.com, cdn.yourdomain.com, and auth.yourdomain.com remain vulnerable to SSL stripping attacks even when the main domain enforces HTTPS. An attacker on the same network can intercept unencrypted traffic to any unprotected subdomain and inject content or credentials. CWE-311 and CWE-319 both apply — data transmitted to subdomains over HTTP is exposed in cleartext. OWASP A02 (Cryptographic Failures) identifies incomplete HSTS configuration as a transport security gap that leaves backend APIs and CDN endpoints unprotected.

Add includeSubDomains to your HSTS header configuration. Before doing so, verify that every subdomain your application uses has a valid TLS certificate — a subdomain without HTTPS becomes unreachable once HSTS covers it.

// next.config.js
headers: [{
  source: '/(.*)',
  headers: [{
    key: 'Strict-Transport-Security',
    value: 'max-age=31536000; includeSubDomains'
  }]
}]

Audit your DNS for all active subdomains before adding includeSubDomains: dig +short yourdomain.com and check your DNS provider's zone file. Any subdomain serving HTTP-only content will break.