Settings

How to clear HSTS from your browser

If you enabled HSTS on your site, you’ll have to clear it from your browser after you disabled it again. Otherwise, your site willl keep loading over SSL. There are two ways to do this. The first sets the .htaccess header, which resets it for all users:

Resetting the HSTS header using the .htaccess

If you set the expiration time on your HSTS header in the .htaccess to zero, the HSTS header should expire immediately.

<IfModule mod_headers.c>
Header set Strict-Transport-Security "max-age=0; includeSubDomains;" env=HTTPS
</IfModule>

Clearing from the browser

Just clearing it from your browser is also possible:

In Chrome:

  1. In the address bar, type “chrome://net-internals/#hsts”.
  2. Type the domain name in the text field below “Delete domain”.
  3. Click the “Delete” button.
  4. Type the domain name in the text field below “Query domain”.
  5. Click the “Query” button.
  6. Your response should be “Not found”.

Safari:

  1. Close Safari.
  2. Delete the ~/Library/Cookies/HSTS.plist file.
  3. Reopen Safari.
Removing from the preload list… Don’t go there. Only submit your site if you are sure you want to stay.

Related Articles

  • Can I deactivate Really Simple SSL after activating SSL?

    Really Simple SSL is built to be very lightweight: the majority of the files are not even loaded when a visitor requests the frontpage. But if you want to remove...
  • Inserting HSTS header using PHP

    HSTS Header insertion Really Simple SSL pro has the ability to set HSTS header for your website. In most cases this is done by inserting the HSTS header in the .htaccess...
  • What is HSTS?

    HSTS means HTTP Strict Transport Security, and makes browsers force your visitors over https. Why do you need this when you already have redirected your site to SSL? HSTS is...
  • Recommended .htaccess redirect option

    If you didn’t enable the .htaccess redirect in your site, you may see a new plus one, with a notice in your dashboard (since version 3.2) WordPress 301 redirect enabled....

Leave a Comment