Confirm all subdomains are secured with HTTPS and valid certs

Confirming every subdomain maintains proper HTTPS security with valid certificates extends your core domain's security posture to encompass your complete domain footprint — a common, genuine gap occurs when primary domains receive careful security attention while subdomains, sometimes serving genuinely important functionality, receive less consistent security configuration.

This gap matters because visitors and search engines generally don't distinguish between your primary domain and its subdomains in terms of trust expectations — a subdomain lacking proper HTTPS undermines overall site security perception and, more concretely, creates genuine security vulnerability for whatever functionality that specific subdomain actually serves.

Comprehensive subdomain auditing requires genuinely identifying your complete subdomain inventory, since forgotten or lesser-used subdomains are precisely the ones most likely to have been overlooked during initial or ongoing security hardening efforts — a genuine audit should include even infrequently accessed or seemingly minor subdomains, not only your most visible, primary subdomains.

Addressing any gaps found requires the same certificate and HTTPS configuration work discussed throughout this broader security strategy, applied specifically to each identified subdomain — this represents extending your established security practices comprehensively across your complete domain footprint rather than allowing security consistency to erode at the subdomain level.