We're calling on all EU-based Mozillians with iOS or iPadOS devices to help us monitor Apple’s new browser choice screens. Join the effort to hold Big Tech to account!

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

How to "forget" a HSTS setting.

  • 8 replies
  • 3 have this problem
  • 1 view
  • Last reply by cor-el

more options

I am a web developer. I tried HSTS (HTTP Strict Transport Security) in my developing website.

Now I want to cancel (forget) the HSTS setting for this site, but I cannot. Cannot I access my developing website with HTTP anymore?

I am a web developer. I tried HSTS (HTTP Strict Transport Security) in my developing website. Now I want to cancel (forget) the HSTS setting for this site, but I cannot. Cannot I access my developing website with HTTP anymore?

Chosen solution

Thanks! Finally I resolved this problem!

Your first reply: "Forget About This Site" (via the right-click context menu of a history item) is the solution, but I guess that once I access the site with HSTS in a browser tab, the tab remembers the HSTS setting after "Forget About This Site".

I tried to reload with F5 key in the same tab, so I cannot access even after "Forget About This Site".

I can access with a new tab now.

Thank you very much, cor-el.

Read this answer in context 👍 0

All Replies (8)

more options

Maybe "Forget About This Site" (via the right-click context menu of a history item) will help, but that will remove everything from that domain like bookmarks, cookies, passwords, cache, history, and exceptions, so be cautious if you decide to give that a try.

more options

I tried "Forget About This Site" but still cannot access the developing site with HTTP. I guess the HSTS setting is saved in a different place from the history items.

more options

Maybe rename secmod.db and if that still doesn't work cert8.db as well to see if that catches it.

more options

I renamed secmod.db and cert8.db, but still cannot access.

more options

Remove all files in my profiles folder => Cannot access. Private browsing mode => Can access! But I don't know why it works.

I want to access the site without private browsing mode.

more options

Private Browsing bypasses the cache (disk cache is disabled) and gives you a new set of cookies.
So Firefox may be using the cache or data stored in the disk cache.

Did you already try to clear the cache?

  • Tools > Options > Advanced > Network > Offline Storage (Cache): "Clear Now"

You may need to use Clear Recent History with the time range set to everything to clear the cache.

more options

Chosen Solution

Thanks! Finally I resolved this problem!

Your first reply: "Forget About This Site" (via the right-click context menu of a history item) is the solution, but I guess that once I access the site with HSTS in a browser tab, the tab remembers the HSTS setting after "Forget About This Site".

I tried to reload with F5 key in the same tab, so I cannot access even after "Forget About This Site".

I can access with a new tab now.

Thank you very much, cor-el.