Configuring or customizing the HSTS of a website/hosting

This guide explains how to disable or set HSTS for a website. When HSTS is enabled for a website, the server tells site visitors (if their web browser is compatible) to replace all non-secure links with secure links. For example, http://www.example.com/a/page/ is automatically replaced by https://www.example.com/a/page/

After a SSL certificate has been enabled on a website, HSTS is configured as follows:

max-age=16000000

Disabling HSTS

1. with a CMS (WordPress, Joomla, etc.)

The following line must be included in all the pages generated by the CMS:

header( 'Strict-Transport-Security: max-age=0;' );

For WordPress, this command can, for example, be added in the functions.php file of your theme:

add_action ('send_headers', 'add_header_xua' );
function add_header_xua() {
header( 'Strict-Transport-Security: max-age=0;' );
}

For more details on WordPress: https://codex.wordpress.org/Plugin_API/Action_Reference/send_headers

2. with a PHP site

The following line must be included on all php pages:

header( 'Strict-Transport-Security: max-age=0;' );

To do this without having to change every php page on a site, the command auto_prepend_file can be used in the .user.ini file of the site concerned:

auto_prepend_file=/home/clients/xxxx/web/hsts_disable.php

... with the following hsts_disable.php file:

header( 'Strict-Transport-Security: max-age=0;' );

3. with a site with static content (non PHP)

It is necessary to include this header in the .htaccess file:

# BEGIN DISABLE HSTS
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=0; includeSubDomains;"
</IfModule>
# END DISABLE HSTS

Customizing the HSTS

Enabling HSTS for all the sub-domains hosted

includeSubDomains; is enabled by default and, as its name suggests, will include the subdomains in the "Strict Transport Security".

When visitors go to a non-secure subdomain, the browser will automatically redirect to the HTTPS and trigger a security error.

If this behaviour is not wanted, this header must be removed.

Deleting the HSTS cache from your browser

1. In Chrome, type chrome://net-internals/#hsts
2. Enter the domain name in the text field in the "Delete domain security policies" section
3. Click on Delete
4. Enter the domain name in the text field for the "Query HSTS" section
5. Click on Query
6. The response must be "Not found"

1. With Safari, start by closing the browser
2. Delete the ~/Library/Cookies/HSTS.plist file 
3. Reopen Safari

1. With Firefox, close all tabs
2. Open the Firefox menu and click on History / Show history.
3. Look for the page for which you want to delete the HSTS options
4. Right-click on one of the corresponding entries
5. Choose Forget this site