How to disable HSTS or turn it off safely

What turning off HSTS actually involves

HTTP Strict Transport Security is a response header that tells browsers to use HTTPS for your domain, and only HTTPS, for a set length of time:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Once a browser has seen that header over a valid HTTPS connection, it stores the rule. For the next max-age seconds, here one year, it rewrites every http:// request for the domain to https:// before sending anything, and it refuses to let visitors click past certificate errors.

That stored rule is why HSTS is hard to switch off. Deleting the header from your server does nothing for browsers that already have the rule; they simply keep following it until it expires. To disable HSTS properly you have to deal with three separate places it can live:

Before going further, be clear why you want it off. If a subdomain or test site shows an HSTS error, the better fix is usually a valid certificate on that host, which the HSTS error guide covers. Turning HSTS off is the right call mainly when includeSubDomains or preload was added too early and is catching hosts that genuinely cannot run HTTPS yet.

Find where your HSTS header comes from

HSTS can be added by the web server, the control panel, the CDN, the application or a CMS plugin, and more than one of them can be doing it. Check what is actually sent:

curl -sI https://example.com/ | grep -i strict-transport
curl -sI https://www.example.com/ | grep -i strict-transport
curl -sI https://shop.example.com/ | grep -i strict-transport

If you use a CDN, also request the origin server directly so you can tell whether the CDN or the server adds the header. Then search the server configuration:

sudo grep -ril "strict-transport-security" /etc/nginx /etc/apache2 /etc/httpd /var/www/vhosts/*/conf 2>/dev/null
grep -i "strict-transport" /var/www/example.com/.htaccess

Common places it hides:

• Cloudflare: SSL/TLS, then Edge Certificates, then HTTP Strict Transport Security.
• Plesk: the SSL/TLS Certificates screen for the domain, through the SSL It! extension's HSTS option, or custom directives in Apache and nginx Settings.
• WordPress: security, SSL or header plugins, as well as the theme's functions.php.
• Applications: Spring Security sends HSTS by default over HTTPS, and middleware such as Express helmet does too.

Check whether the domain is on the preload list as well, using the status check at hstspreload.org. If it is, header changes alone will not turn HSTS off in Chrome, Firefox, Safari or Edge.

How to disable HSTS with max-age=0

The correct way to turn HSTS off is to keep sending the header for a while, but with a lifetime of zero. When a browser receives max-age=0 over HTTPS, it deletes its stored rule for that host straight away.

Strict-Transport-Security: max-age=0

Note what is missing: no includeSubDomains and no preload. Leave HTTPS itself running with a valid certificate, because browsers only accept the header over a trusted HTTPS connection. A header sent over plain HTTP is ignored.

nginx

add_header Strict-Transport-Security "max-age=0" always;

Apache or .htaccess

Header always set Strict-Transport-Security "max-age=0"

Cloudflare

In the HSTS settings, set Max Age to 0 and switch off include subdomains and preload, rather than disabling the feature outright. Disabling stops the header, which leaves stored rules in place until they expire.

How long to keep sending it

Only browsers that come back to the site receive the zero value. Keep sending max-age=0 for at least as long as your old max-age, or as long as you reasonably can. A visitor who last came eight months ago with a one-year rule still has four months to run, and only a visit after the change clears it early.

How to remove a domain from the HSTS preload list

A preloaded domain is built into the browser itself. No header can override it, because the browser applies the rule before it has ever contacted your server. Removal is a slow, deliberate process:

1. Stop sending the preload token. Change your header to drop it, or go straight to max-age=0.
2. Submit the domain on the removal form at hstspreload.org. The form checks that the preload token is no longer present.
3. Wait. The removal is made in Chromium's list, which is shipped with a later Chrome release, and other browsers that use the same list pick it up on their own schedules.
4. Wait again for visitors to update their browsers. Anyone on an old version still has the rule built in.

In practice, expect removal to take months, not days. That is why preload is meant for domains that are certain to stay on HTTPS for good.

How to clear HSTS from your own browser for testing

While you test, your own browser will keep enforcing the old rule. You can clear dynamically stored rules on your machine, but not preloaded ones.

This only affects your own browser. Clearing it does not help your visitors, whose rules are cleared only by receiving max-age=0 or by expiring. Visiting the site over HTTPS again after clearing will store the rule again if the server still sends a positive max-age.

The risks of turning HSTS off

HSTS exists because the first plain HTTP request is easy to intercept on public Wi-Fi. Without it, an attacker on the same network can keep a visitor on an http:// version of your site and read or alter what they send, even if you redirect HTTP to HTTPS. Turning HSTS off brings that risk back.

• Security scanners and audits will flag the missing header, and some compliance checks require it.
• Your HTTP to HTTPS redirects become the only protection, and they cannot stop that first request being intercepted.
• Switching HTTPS off entirely is a much bigger step and is rarely the right answer. Browsers mark HTTP pages as not secure.

The usual safer path is to turn HSTS off only temporarily, fix whatever made it a problem, and then bring it back gradually, starting with a short max-age such as 300 seconds and raising it once every host works.

The fix, step by step

Edge cases worth knowing

• Redirects before the header. If the apex redirects to www without sending a header itself, browsers never receive the zero value for the apex. Add the header to the redirect response too, with the always flag in nginx or Apache.
• Two sources. If Cloudflare sends one value and your server another, the browser may see either. Make sure every layer sends max-age=0, or only one sends a header.
• Expired certificate. A browser cannot receive the zero header from a site with an invalid certificate, because it will not connect. Fix the certificate first; the SSL errors guide covers the common causes.
• Apps and other clients. Mobile apps, scripts and command-line tools generally do not store HSTS, so they are not affected either way.

Bringing HSTS back safely

Once the hosts that caused trouble have working certificates, re-enable HSTS in stages so a mistake costs minutes rather than a year.

Strict-Transport-Security: max-age=300
Strict-Transport-Security: max-age=86400; includeSubDomains
Strict-Transport-Security: max-age=31536000; includeSubDomains

Spend a few days at each stage, checking every subdomain with curl and in a browser. Only add preload when you are sure that every current and future subdomain will run HTTPS. The guide to adding HSTS walks through the full setup on each server.