Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I host two domains on my webserver. One uses HSTS (HTTP Strict Transport Security), the other does not. My webserver was misconfigured for a short period, thereby accidentally setting HSTS on the wrong website.

This has caused my Firefox to get all confused, and it insists on accessing the site using HTTPS, which is no good.

In chrome I can inspect the HSTS status for any given domain by going to chrome://net-internals/#hsts

Is there something equivalent in Firefox? I just need to delete on entry from the list...

share|improve this question
    
Try clearing all browsing data. –  Wk_of_Angmar Jan 22 '13 at 2:12
    
That worked, thanks! –  Jxtps Jan 23 '13 at 17:31
    
Accept that as the answer then. :) In the future if nobody makes it a proper answer, just feel free to make an answer for your own question and then accept that. –  Wk_of_Angmar Jan 23 '13 at 17:45

5 Answers 5

up vote 6 down vote accepted

Clear all browsing data from Firefox.

Ctrl+Shift+Del shortcut for Windows, or Firefox button -> History -> Clear recent history.

share|improve this answer
1  
Thank you. "Forget About This Site" wasn't working for me. This did. –  Ctrl-C May 21 at 12:36

For the sole reason that I just had the same issue (and not because I really like resurrecting old questions!), you can also open the History browser, find an entry for the site in question, right-click the and select Forget About This Site.

This will remove your history entries for that site only (including the HSTS setting), without affecting your other history settings.

You need to close all tabs for the site that you wish to forget first, otherwise the tab itself seems to remember.

(At least, it did for me, on FF26/Win32...)

share|improve this answer
    
I really wanted this to work. I had to do History->Clear Recent History->Time Range: Everything, select Site Preferences->Clear Now. Using FF 37.0.2 Mac OSX Yosemite 10.10.3 –  Ballpark Apr 21 at 17:07

I found additional HSTS data that was not deleted via "Forget About This Site" or clearing the browser cache in a file SiteSecurityServiceState.txt in my profile directory.

It is a text file you can open with any text editor and remove lines of HSTS data about a speficic host. Or clear the whole file.

share|improve this answer
    
Thank you, this was driving me mad and I was on the verge of breaking something. –  Rob Jun 24 at 22:03

If you want to forget HSTS for a Web site in Firefox without loosing all browsing data you can edit permissions.sqlite with e.g. https://github.com/sqlitebrowser/sqlitebrowser/releases, filter permissions.sqlite for "sts/subd".

share|improve this answer

I just ran into this problem. Clearing the browser cache and "forgetting" the site did not work for me.

@Spike's answer did work for me with Firefox (I up-voted it). Watching the SiteSecurityServiceState.txt file helped me test this solution.

Changing end-users browsers is not really a good option if you mistakenly applied the "Strict-Transport-Security" HTTP Response Header to your web site/server.

If you have access to the web server set the max-age to zero, it will clear the HSTS cache for the site(s) for Firefox/Chrome. In my case, I had to open the site, close the browser and then reopen the site after this web server setting was enabled.

Strict-Transport-Security

max-age=0; includeSubDomains;

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.