title: HSTS and subdomain levels
body: <p>Regarding the HSTS includeSubDomains directive. Does this include every subdomain underneath e.g. example.com. So abc.def.example.com is also included? </p>
  
  <p>In the RFC: </p>
  
  <pre><code>The OPTIONAL "includeSubDomains" directive is a valueless directive
  which, if present (i.e., it is "asserted"), signals the UA that the
  HSTS Policy applies to this HSTS Host as well as any subdomains of
  the host's domain name.
  </code></pre>
  
  <p>This states "any", can I take that to mean every subdomain, no matter what level. i.e. sub1.sub2.sub3.example.com not just sub3.example.com</p>