Merge pull request #1433 from hackmdio/feature/disable-include-subdomain-hsts

Disable HSTS IncludeSubdomain, to prevent unexpected behavior

Author: jackycute

lib/config/default.js

@@ -14,7 +14,7 @@ module.exports = {
   hsts: {
     enable: true,
     maxAgeSeconds: 60 * 60 * 24 * 365,
-    includeSubdomains: true,
+    includeSubdomains: false,
     preload: true
   },
   csp: {