HSTS Include Sub Domains Flag Tool

Use HSTS Include Sub Domains Flag when you need a narrowly scoped header component check or formatter before assembling and testing a complete response policy.

1. Enter headerValue. Use the units and conventions below.
2. Run the tool. Correct any format, range, or cross-field input error before interpreting the output.
3. Read includeSubDomains. Inspect includeSubDomains before interpreting the associated values.

Reject CR/LF and split headerValue at semicolons outside quoted strings, respecting backslash escapes inside quotes. Require closed quoting, trim spaces and tabs around directives, and detect an exact case-insensitive includeSubDomains token.^[1]

includeSubDomains extends a valid HSTS policy to subdomains. Its presence alone does not establish an effective policy: max-age=0 removes the cached policy, including its subdomain setting.^[2]

• This does not validate max-age, duplicate directives, TLS delivery, or the complete HSTS policy; a value-bearing includeSubDomains spelling does not match.
• Inputs must satisfy both the field types and the cross-field conditions above. Invalid input causes an error; a successful false flag or documented placeholder is a different result.

Parse the complete header and test its behavior in the intended browser when policy effectiveness matters.

• Csp Nonce Source Token

  Wrap it as a quoted nonce sourceToken.

• Content Type Charset Single Parameter

  Require charset to be a nonempty HTTP token, lowercase it, and prepend charset= for parameter.