The HSTS response header was delivered without the includeSubdomains flag.