This guide explains how to disable or configure HSTS for a website.

Introduction

• When HSTS is enabled for a website, the server instructs the website visitor (if their web browser is compatible) to replace all insecure links with secure links.
• Example: http://www.domain.xyz.com/one/page/ is automatically replaced with https://www.domain.xyz/one/page/.
• After enabling an SSL certificate on a website, HSTS is configured as follows: max-age=16000000.

Disable HSTS…

… with a CMS (WordPress, Joomla, etc.)

Include the following line in all pages generated by the CMS:

header( 'Strict-Transport-Security: max-age=0;' );

For WordPress, you can, for example, add this directive to the functions.php file of your theme:

add_action( 'send_headers', 'add_header_xua' );
function add_header_xua() {
header( 'Strict-Transport-Security: max-age=0;' );
}

More details on WordPress

… with a PHP site

Include the following line in all PHP pages:

header( 'Strict-Transport-Security: max-age=0;' );

To do this without having to modify each PHP page of a website, you can use the auto_prepend_file directive in the .user.ini file of the website in question:

auto_prepend_file=/home/clients/xxxx/web/hsts_disable.php

... with the following hsts_disable.php file:

header( 'Strict-Transport-Security: max-age=0;' );
… with a website containing static content (not PHP)

… avec un site au contenu statique (non PHP)

Include this header in a .htaccess file:

# BEGIN DISABLE HSTS
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=0; includeSubDomains;"
</IfModule>
# END DISABLE HSTS

Customize HSTS

header( 'Strict-Transport-Security: max-age=X; includeSubdomains; preload' );

includeSubDomains; is enabled by default, and as its name suggests, it includes subdomains in "Strict Transport Security".

When a visitor accesses an unsecure subdomain, the browser will automatically redirect to HTTPS and trigger a security error.

If this behavior is not desired, this header must be removed.

Clear the browser's HSTS cache…

… on Chrome

1. In Chrome, type chrome://net-internals/#hsts.
2. Enter the domain name in the text field in the "Delete domain security policies" section.
3. Click the Delete button.
4. Enter the domain name in the text field in the "Query HSTS" section.
5. Click on the Query button.
6. The response should be "Not found".

… on Safari

1. With Safari, start by closing the browser.
2. Delete the ~/Library/Cookies/HSTS.plist file.
3. Reopen Safari.

… on Firefox

1. With Firefox, close all tabs.
2. Open the Firefox menu and click on History / Show History.
3. Find the page for which you want to delete the HSTS preferences.
4. Right-click on one of the corresponding entries.
5. Choose Forget this site.