title: why google.com not set includeSubDomains directive on HSTS response header?
body: <p>why google.com not set includeSubDomains directive on http strict transport security response header ?</p>
  
  <p>google.com HSTS resonse header is something like:</p>
  
  <pre><code>Strict-Transport-Security:max-age=86400
  </code></pre>
  
  <p>Why not </p>
  
  <pre><code>Strict-Transport-Security: max-age=86400; includeSubDomains
  </code></pre>
  
  <p>The second one should be more secure from my side, is that  right ??</p>