<filter-name>httpHeaderSecurity</filter-name> .
    <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class> .
    <async-supported>true</async-supported> .

    <init-param> .
        <param-name>hstsMaxAgeSeconds</param-name> .
        <param-value>31536000</param-value> .
    </init-param> .
    <init-param> .
        **<param-name>hstsIncludeSubDomains</param-name>** .
        <param-value>true</param-value> .
    </init-param> .
</filter> .