Percieved Security on Insta DMs

[Ethsim2 (Ethan)]

this is to show on my root discourse site, that HSTS is enabled

---

ask.discourse.com tells me my site has HSTS but also mentions

Extra Tips

• For maximum security across subdomains, you could set includeSubDomains in your HSTS header, though this is optional and needs to be set in your nginx config.
• Make sure your email templates and shared links use https://—but HSTS gives strong fallback protection.

In Summary

Yes: As long as HSTS is set on your Discourse, browsers that have already visited your site via HTTPS will force all links—including invites—to load securely via https://.

i have my email on discourse.yourdomain.TLD sub-domain, could this be causing problem?