17

I'm building a site to replace an older site. The newer site currently is NOT HTTPS. However, the old site is HTTPS. I'm switching between the two sites by toggling an entry in my 'hosts' file.

I occasionally need to access the old site. When I do, it forcibly redirects to https://, but when I switch back to the new site, Chrome is then broken and will not let me get to http:// to the site but forcibly redirects to https:// which gives me the obvious "Privacy Error" warning and screws up a number of other things (it's WordPress, so it asks me to re-login, but I can't).

How the heck can I force Chrome to stop redirecting to https://? I tried chrome://net-internals/#hsts and I deleted the domain security policies for the site, but it seems to do absolutely nothing. Chrome still redirects. I also tried refreshing clearing cache - this doesn't work either.

Improve this question
9
  • Is your site HSTS preloaded? hstspreload.org
    – Ultrasonic54321
    Jan 30, 2019 at 18:12
  • No, it's not preloaded. Sorry, I updated the question. Check it again for more clarity.
    – Codesmith
    Jan 30, 2019 at 18:18
  • Have you considered the possibility of using another browser?
    – Ultrasonic54321
    Jan 30, 2019 at 18:31
  • Well, I would have figure Firefox wouldn't be as frustrating, but it seems to do the same thing. Maybe there's an extension or a flag or something for Firefox to get around this?
    – Codesmith
    Jan 30, 2019 at 18:42
  • 1
    See this.
    – Ultrasonic54321
    Jan 30, 2019 at 19:02

6 Answers 6

Reset to default
5

I found it !! I found it !!

For me, I had to perform this extra step :

  • Click on the icon of HTTPS on the left of the URL bar, and choose "Settings for this site".
  • Scroll and find "Secured content" (with the /!\ icon), and choose "Allow".

Thats all !

All the steps combined, give this :

  1. In chrome://net-internals/#hsts, in the "Delete domain security policies", enter the domain of the page, and click "Delete".
  2. Push CTRL+H, and delete all history/cache/cookies.
  3. On the page causing problem, click on the HTTPS icon on the top left of the URL bar, and choose "Settings for this website" (I'm French, I don't know the exact label in english versions).
  4. Scroll and find "Secured content", and choose "Allow".
  5. Go back to your page, remove the "s" of the https:// in the URL (it has been added again automatically since the last time it failed).
  6. Press enter to apply the URL. It should work :)
  7. If not, relaunch the browser.
Improve this answer
2
  • 1
    Thanks @Héraès! This actually seems to work! p.s. The option name is "Insecure Content" in English. Also, for step 2, clearing just "Cached images and files" seems to do the trick. Not sure why..
    – Codesmith
    Aug 25, 2022 at 18:26
  • In fact, maybe it's just my test case right now, but it appears that all I have to do is clear "Cached images and files" and it works.. ?
    – Codesmith
    Aug 25, 2022 at 18:35
9

I have been able to get around this by deleting the domain security policy for the domain:

Go to chrome://net-internals/#hsts
Go towards the end and enter your domain in this textbox and hit delete.

Delete domain security policies Input a domain name to delete its dynamic domain security policies (HSTS and Expect-CT). (You cannot delete preloaded entries.):

Domain: example.com

Improve this answer
1
  • Also note the "Query" section in that page can help you identify problem policies before just blanket deleting them.
    – Bill Gribble
    Dec 17, 2020 at 14:47
3

Just deleting the domain security policies using chrome://net-internals/#hsts will not make this work. You have to delete your browsing history and make sure the cache is cleared. Should work after that.

Improve this answer
2
  • Had the same issue. This solution worked for me!
    – tzelleke
    Sep 23, 2020 at 16:25
  • FTR: to test if it would work for you without having to reset your browsing history, run a browser like HOME=/tmp/ google-chrome. So it will temporarily use /tmp dir as HOME, and of course it has no configs or history.
    – Hi-Angel
    Jul 26, 2022 at 21:37
1

In my case, this was because a superdomain of my domain had HSTS enabled. You can check this by going to chrome://net-internals/#hsts and entering your domain under "Query HSTS/PKP domain". If this is the case, you'll see something like

dynamic_sts_domain: example.com
dynamic_upgrade_mode: FORCE_HTTPS
dynamic_sts_include_subdomains: true
Improve this answer
0
1

Starting a new incognito window will give an immediate workaround of the problem. Also handy if You do not want to clear Your history.

Improve this answer
0

If you're a developer, go to chrome://net-internals/#hsts Then, at the bottom of the page "Delete domain security policies", simply type in "localhost" into the box and click [Delete]

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.