How to Clear HSTS Settings in Chrome, Firefox, and Microsoft Edge

What Is HSTS?

HSTS is a web security policy that forces browsers to connect to a website over HTTPS for a specified period.

A website enables HSTS by sending the Strict-Transport-Security response header over HTTPS:

Strict-Transport-Security: max-age=31536000; includeSubDomains

Here, max-age specifies how long the browser remembers the policy. The example above sets it to one year.

HSTS helps prevent:

• SSL stripping: Downgrading HTTPS connections to HTTP.
• Protocol downgrade attacks: Forcing browsers to use insecure connections.
• Cookie interception: Exposing session cookies over unencrypted HTTP.

HSTS works alongside an SSL/TLS certificate: the certificate helps authenticate the website, while HSTS ensures browsers continue using HTTPS.

How to Clear HSTS Settings

Before clearing HSTS, check whether the problem is actually related to the stored policy. Errors such as NET::ERR_CERT_AUTHORITY_INVALID usually indicate a certificate trust or configuration issue. Clearing HSTS will not fix an expired certificate, hostname mismatch, or missing intermediate certificate.

Google Chrome

1. Open Chrome and enter chrome://net-internals/#hsts in the address bar.
2. Under Query HSTS/PKP domain, enter the domain and click Query.
3. Under Delete domain security policies, enter the same domain.
4. Click Delete.

This removes the stored dynamic HSTS policy. It does not remove a domain from Chrome's built-in HSTS preload list.

Mozilla Firefox

Firefox does not provide the same dedicated HSTS management page. You can remove the website's stored data instead.

1. Open Firefox and press Ctrl + Shift + H.
2. Find the website in your browsing history.
3. Right-click it and select Forget About This Site.

Alternatively, go to Settings → Privacy & Security → Cookies and Site Data → Manage Data, find the domain, and remove its data.

Note: Both methods remove more than HSTS information, including cookies and other website data.

Microsoft Edge

1. Open Edge and enter edge://net-internals/#hsts.
2. Under Query HSTS/PKP domain, enter the domain and click Query.
3. Find Delete domain security policies.
4. Enter the domain and click Delete.

As in Chrome, this removes the stored dynamic policy but cannot remove a domain from the browser's preload list.

How to Disable HSTS on Your Website

If you manage the website and want browsers to remove its stored HSTS policy, send this header over HTTPS:

Strict-Transport-Security: max-age=0

The browser removes the dynamic policy after receiving the header.

Keep in mind that:

• The header must be sent over a valid HTTPS connection.
• Simply removing the HSTS header does not clear a policy already stored by the browser.
• Domains on the HSTS preload list require a separate removal process.
• If includeSubDomains was previously enabled, check the affected subdomains as well.

Should You Enable HSTS?

HSTS is recommended for websites that are fully configured to use HTTPS. Before enabling it:

• Install a valid SSL/TLS certificate.
• Make sure all affected subdomains support HTTPS before using includeSubDomains.
• Redirect HTTP traffic to HTTPS.
• Start with a shorter max-age during testing, then increase it when the configuration is stable.
• Enable preload only after reviewing the requirements and confirming that all affected domains are ready.

Adding the preload directive does not automatically place a domain on the browser preload list. You must submit it separately through hstspreload.org. Removal from the list can take time.

What About Internet Explorer?

Internet Explorer 11 is retired on most supported Windows configurations. Microsoft Edge is the recommended browser. Organizations that need legacy compatibility can use IE mode in Edge where supported.

The old registry-based instructions for disabling HSTS in Internet Explorer are therefore omitted from this guide.

Conclusion

Clearing HSTS can help resolve access problems caused by an outdated browser policy. Chrome and Edge provide internal pages for deleting stored policies, while Firefox allows users to remove website data.

However, clearing HSTS will not fix an invalid or incorrectly installed SSL/TLS certificate. If the browser reports a certificate error, check the certificate's validity, hostname, and certificate chain first.