Based on some information on the internet (e.g. here), Firefox deletes HSTS information after a private browsing session.

My understanding is that this would mean that the "SiteSecurityServiceState.txt" file located in the Firefox profile directory (under \AppData\Roaming\Mozilla\Firefox\Profiles) is cleared.

I am running FF 42.0 and have configured it (under Options > Privacy) to "Always use private browsing mode".

Now however for some reason this file is not getting cleared. In fact it looks like it is getting populated by Firefox with specific entries.

I am saying this because I cleared the file manually a couple of hours ago and since then I have run a few test sessions (browsing the web for some time, with that "Always use private browsing mode" enabled) and closed the browser after each test session. Now when I checked the "SiteSecurityServiceState.txt" file, it looks like it has the same entries as before.

Here's an extract of some of the entries in it:


  1. Is it correct that the entries in "SiteSecurityServiceState.txt" should be deleted after a private session?
  2. Is there some system property that would need to be enabled to clear the entries at the end of a session?
  • 3
    Shouldn't this subject be discussed on bugzilla.mozilla.org? – harrymc Nov 30 '15 at 20:27
  • Not sure if this will help but there is some preferences you can play with in Firefox. Type about:config in your browser bar and have a look at these preferences -- Tracking Protection – tyelford Dec 17 '15 at 22:30

HSTS cookies are special. They tell your browser that that site should always be connected with https. They do have an expiry date and they will expire on that date, if you visit that site before expiry then the site could update the cookie expiry date.

This what should happen, it is not a fault.

The reason is that this is protecting you against a man in the middle attack, that could be intercepting all of your traffic. They could change the code in the pages sent from the site to change all the https:// into http:// and you browser would just accept that. So when you are entering your password that traffic will be sent in the clear.

The rush to move to using https:// by sites left this hole, and HSTS was the solution. So if you ever connected to that site securely then it would set the HSTS cookie, and your browser would insist on using https:// for every connection even if the html said http://


This should resolve your issue. https://support.mozilla.org/en-US/questions/1097368

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.