How to Enable HSTS for subdomains on Webflow?

HSTS with the includeSubDomains directive extends HTTPS enforcement from your main domain to every subdomain. Without it, your main domain might be HTTPS-only while a subdomain like blog.yourdomain.com or app.yourdomain.com could still be accessed over HTTP — creating a potential attack vector.

First: does this apply to you? If your Webflow site has no subdomains and never will, this item is largely informational. Many Webflow sites operate on a single www.yourdomain.com domain. If that's your case, includeSubDomains has no practical effect. If you run a staging environment, app, or marketing subdomain, or plan to add subdomains, it matters.

How it works: your server sends a Strict-Transport-Security header like max-age=31536000; includeSubDomains. Once a browser receives this, it treats all subdomains of your domain as HTTPS-only for the cached lifetime — typically one year. Any HTTP request to any subdomain is automatically upgraded to HTTPS by the browser, without touching your server first.

The risk to understand: includeSubDomains applies to subdomains you haven't set up yet. If you enable this header and then try to launch a new subdomain without HTTPS configured, that subdomain will be inaccessible to browsers that have cached the HSTS header. Make sure every subdomain you run or plan to run has a valid SSL certificate before enabling this directive.

Checking your configuration: visit securityheaders.com and enter your domain. It shows exactly what HSTS header you're sending and whether includeSubDomains is present. For Webflow-hosted sites, the header is controlled by Webflow's infrastructure — check what's actually being sent rather than assuming what's configured.

Monthly check: if you added a new subdomain since last month, verify it's serving HTTPS before the HSTS coverage puts pressure on it. Consistency across subdomains is what makes the header meaningful rather than a gap in your security posture. Use the internal Webflow SEO Checklist monthly review loop to stay on top of these infrastructure checks.