24

I host two domains on my webserver. One uses HSTS (HTTP Strict Transport Security), the other does not. My webserver was misconfigured for a short period, thereby accidentally setting HSTS on the wrong website.

This has caused my Firefox to get all confused, and it insists on accessing the site using HTTPS, which is no good.

In chrome I can inspect the HSTS status for any given domain by going to chrome://net-internals/#hsts

Is there something equivalent in Firefox? I just need to delete on entry from the list...

10

Clear all browsing data from Firefox.

Ctrl+Shift+Del shortcut for Windows, or Firefox button -> History -> Clear recent history.

  • 1
    Thank you. "Forget About This Site" wasn't working for me. This did. – Ctrl-C May 21 '15 at 12:36
30

I found additional HSTS data that was not deleted via "Forget About This Site" or clearing the browser cache in a file SiteSecurityServiceState.txt in my profile directory.

It is a text file you can open with any text editor and remove lines of HSTS data about a speficic host. Or clear the whole file.

  • Thank you, this was driving me mad and I was on the verge of breaking something. – Rob Jun 24 '15 at 22:03
  • 5
    Clear recent history won’t work when the visit to the site was not recent. Editing SiteSecurityServiceState.txt works, – MPi Jul 10 '15 at 14:29
  • 1
    Thanks alot, that was exactly what I needed. Clearing the history isn't an option for me. Let me add that the file should be edited while the browser is not running, otherwise it may be overwritten with cached data by the running process. – didi_X8 Nov 17 '15 at 10:28
  • I lost 2 days because of this. – Nemke Dec 22 '15 at 11:20
  • Thank you. This should be the accepted answer since it shows the source of the actual problem and how to fix is rather than just using a big hammer that blows away other state you may want to preserve. – R.. Jan 22 '16 at 18:03
11

For the sole reason that I just had the same issue (and not because I really like resurrecting old questions!), you can also open the History browser, find an entry for the site in question, right-click the and select Forget About This Site.

This will remove your history entries for that site only (including the HSTS setting), without affecting your other history settings.

You need to close all tabs for the site that you wish to forget first, otherwise the tab itself seems to remember.

(At least, it did for me, on FF26/Win32...)

  • I really wanted this to work. I had to do History->Clear Recent History->Time Range: Everything, select Site Preferences->Clear Now. Using FF 37.0.2 Mac OSX Yosemite 10.10.3 – Frank Henard Apr 21 '15 at 17:07
  • Doesn't work anymore. – nickdnk Mar 26 '18 at 15:18
1

If you want to forget HSTS for a Web site in Firefox without loosing all browsing data you can edit permissions.sqlite with e.g. https://github.com/sqlitebrowser/sqlitebrowser/releases, filter permissions.sqlite for "sts/subd".

1

On Firefox :

  1. Go to about:config
  2. Search for extensions.xpiState and note your profile directory name.
  3. Quit Firefox
  4. Go that directory and look for the file SiteSecurityServiceState.txt
  5. Edit the file and delete the line corresponding to the domain which is making trouble

On Chrome :

  1. Go to chrome://net-internals/#hsts
  2. At Delete domain , insert the domain name and click on Delete
0

As of Firefox 47, I did not find any of the older answers to work.

This is the process that worked for me:

  1. Select History > Show All History
  2. Search for site name
  3. Right-click on the site name in the results list
  4. Choose “forget about this site”
  5. Select History > Clear Recent History
  6. In the detail section, clear all check marks except for “Site Preferences”
  7. Choose Time Range to Clear: “Everything”
  8. Click “Clear now”
  9. Restart Firefox

Hint: If you are looking for a temporary fix, opening a private browsing window will not import Firefox's saved HSTS settings, so at least you can access the site during that private session.

  • Doesn't work anymore. – nickdnk Mar 26 '18 at 15:18
-1

I just ran into this problem. Clearing the browser cache and "forgetting" the site did not work for me.

@Spike's answer did work for me with Firefox (I up-voted it). Watching the SiteSecurityServiceState.txt file helped me test this solution.

Changing end-users browsers is not really a good option if you mistakenly applied the "Strict-Transport-Security" HTTP Response Header to your web site/server.

If you have access to the web server set the max-age to zero, it will clear the HSTS cache for the site(s) for Firefox/Chrome. In my case, I had to open the site, close the browser and then reopen the site after this web server setting was enabled.

Strict-Transport-Security

max-age=0; includeSubDomains;

  • 2
    How do you transmit this HTTP header when the browser will not even initiate the connection because it does not trust the certificate? – MPi Jul 10 '15 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.