Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I host two domains on my webserver. One uses HSTS (HTTP Strict Transport Security), the other does not. My webserver was misconfigured for a short period, thereby accidentally setting HSTS on the wrong website.

This has caused my Firefox to get all confused, and it insists on accessing the site using HTTPS, which is no good.

In chrome I can inspect the HSTS status for any given domain by going to chrome://net-internals/#hsts

Is there something equivalent in Firefox? I just need to delete on entry from the list...

share|improve this question
Try clearing all browsing data. – Wk_of_Angmar Jan 22 '13 at 2:12
That worked, thanks! – Jxtps Jan 23 '13 at 17:31
Accept that as the answer then. :) In the future if nobody makes it a proper answer, just feel free to make an answer for your own question and then accept that. – Wk_of_Angmar Jan 23 '13 at 17:45
up vote 9 down vote accepted

Clear all browsing data from Firefox.

Ctrl+Shift+Del shortcut for Windows, or Firefox button -> History -> Clear recent history.

share|improve this answer
Thank you. "Forget About This Site" wasn't working for me. This did. – Ctrl-C May 21 '15 at 12:36

I found additional HSTS data that was not deleted via "Forget About This Site" or clearing the browser cache in a file SiteSecurityServiceState.txt in my profile directory.

It is a text file you can open with any text editor and remove lines of HSTS data about a speficic host. Or clear the whole file.

share|improve this answer
Thank you, this was driving me mad and I was on the verge of breaking something. – Rob Jun 24 '15 at 22:03
Clear recent history won’t work when the visit to the site was not recent. Editing SiteSecurityServiceState.txt works, – MPi Jul 10 '15 at 14:29
Thanks alot, that was exactly what I needed. Clearing the history isn't an option for me. Let me add that the file should be edited while the browser is not running, otherwise it may be overwritten with cached data by the running process. – didi_X8 Nov 17 '15 at 10:28
I lost 2 days because of this. – Nemke Dec 22 '15 at 11:20
Thank you. This should be the accepted answer since it shows the source of the actual problem and how to fix is rather than just using a big hammer that blows away other state you may want to preserve. – R.. Jan 22 at 18:03

For the sole reason that I just had the same issue (and not because I really like resurrecting old questions!), you can also open the History browser, find an entry for the site in question, right-click the and select Forget About This Site.

This will remove your history entries for that site only (including the HSTS setting), without affecting your other history settings.

You need to close all tabs for the site that you wish to forget first, otherwise the tab itself seems to remember.

(At least, it did for me, on FF26/Win32...)

share|improve this answer
I really wanted this to work. I had to do History->Clear Recent History->Time Range: Everything, select Site Preferences->Clear Now. Using FF 37.0.2 Mac OSX Yosemite 10.10.3 – Frank Henard Apr 21 '15 at 17:07

If you want to forget HSTS for a Web site in Firefox without loosing all browsing data you can edit permissions.sqlite with e.g., filter permissions.sqlite for "sts/subd".

share|improve this answer

I just ran into this problem. Clearing the browser cache and "forgetting" the site did not work for me.

@Spike's answer did work for me with Firefox (I up-voted it). Watching the SiteSecurityServiceState.txt file helped me test this solution.

Changing end-users browsers is not really a good option if you mistakenly applied the "Strict-Transport-Security" HTTP Response Header to your web site/server.

If you have access to the web server set the max-age to zero, it will clear the HSTS cache for the site(s) for Firefox/Chrome. In my case, I had to open the site, close the browser and then reopen the site after this web server setting was enabled.


max-age=0; includeSubDomains;

share|improve this answer
How do you transmit this HTTP header when the browser will not even initiate the connection because it does not trust the certificate? – MPi Jul 10 '15 at 14:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .