I had something set up wacky in our DNS setup which is now resolved.

The remaining problem is that chrome has cached the incorrect setup.

Specifically, when using Chrome http://3rdrevolution.com is now redirecting to https://3rdrevolution.com (naked domain), which is not valid/supported. http://3rdrevolution.com SHOULD redirect to http://www.3rdrevolution.com and then force https://www.3rdrevolution.com.

But on a handful of browsers (including mine) this doesn't happen because of some funky Chrome caching. I tried going to “Privacy -> Clear Cache” but it had no effect.

10 Answers 10

Anon is right about STS, but there is a way to specifically delete your domain from the set. Go to chrome://net-internals/#hsts. Enter 3rdrevolution.com under Delete domain security policies and press the Delete button.

Now go to chrome://settings/clearBrowserData, tick the box Cached images and files and press click the button Clear data.

  • 6
    Thank you, I tried everything else and this finally worked =) – Tyrsius Mar 19 '15 at 16:24
  • 1
    This helped me as well!!! While developing internally and having the same problem of the redirect! – Marcello de Sales Jul 12 '15 at 3:11
  • 2
    Man, this had been bugging me for ages, finally got it, thanks! A potential gotcha of note: If the domain you're having trouble with is a subdomain you may need to delete the primary domain from the HSTS set if "include subdomains for STS is set to true". If you run a query on the parent domain you should see if that's set or not for the domain in question. – Pooch Jan 6 '16 at 17:40
  • 11
    This only worked for me after I also cleared my browser cache. In chrome: Settings > Show advanced settings… > Privacy > Clear browsing data... Source – nittyjee Jul 21 '17 at 6:30
  • 5
    Since 63.0.3239.132 this does nothing. The rule seems to be disregarded and even custom domains that link to localhost is now redirected to https. Annoying factor to have to use self-signed certificates for everything... – Daniel Jan 5 at 8:59

My problem came from having a .dev domain, which was apparently recently registered as a gTLD and put in a commit to Chrome Canary. I found this out from a recent post I came across as I searched for my problem.

If you have the same problem I do, it appears that the best solution is to change your domain to be something other than .dev. The article suggested .test with a potential solution of .localhost later down the road (via this proposal).

  • 31
    This was the issue for me as well. On my local development machine I utilized .dev for almost 10 years now. I did a recent Google Chrome update and it started redirecting all of my sites to https for no reason I could understand. Would have never thought it had to do with the .dev, then I came across this answer and changed it to .development and all works well again ... For now :-) . Thanks again! – conrad10781 Dec 8 '17 at 20:04
  • 15
    Perfect! I don't understand why Chrome will do something like that, it's very annoying as I have nearly 30 .dev domains in my local. Hope it's a very, very good reason. – Pablo Ezequiel Leone Dec 11 '17 at 9:00
  • 3
    I have wordpress installed, changing its domain might be a real headache. same for the main directory name ect. is there any other way around? – Rick Sanchez Dec 11 '17 at 16:26
  • 7
    It's because Google bought .dev and presumably will start making public sites using it. – Hilton Shumway Dec 11 '17 at 18:41
  • 10
    FML… I almost gave up on my 10+ year web dev career because of this. #starbucksbarista – elbowlobstercowstand Dec 13 '17 at 22:34

https://www.3rdrevolution.com sends the Strict-Transport-Security header so accessing it over https once will make browsers like Chrome/Firefox redirect http requests to https until some specified point in the future.

As the other answer said, the only way to stop this once it starts is to clear the browser cache (or wait for the browser to expire the order).

To delete domain under "HSTS" menu in chrome://net-internals is a temporary solution. After visiting this domain over HTTPS it will be included in HSTS list again.

Basicaly, to solve this issue it is necessary to disable HTTP Strict Transport Security on the web-server 3rdrevolution.com (IIS, Apache, nginx,...). For nginx edit its HTTPS section in nginx.conf and set 'max-age=0' for Strict-transport-Security:

server {
#...
        ssl on;
#...
        add_header Strict-Transport-Security "max-age=0;";
#...
}

More info:HTTP Strict Transport Security (HSTS)

  • I wasn't able to get the add_header method to work. – Alex Barker Jan 26 '16 at 6:49
  • for me the server did not issue a HSTS header so this is not a solution. From what I can tell, chrome recorded when I accidentally visited it with https and created an internal HSTS record that then mysteriously redirected me to https everytime. Fix was to use the delete HSTS record in chrome:net-internals. Had a handy checker in there as well. – rob May 15 '17 at 13:53
  • 1
    To delete HSTS record is a temporary solution. You will get this record in chrome again and again after visit https untill server send "max-age=0". – user2285323 May 16 '17 at 17:46

There could be a couple of reasons for this, including plugins but assuming that you do not have any plugins installed you can do the following:

Goto Settings/Privacy/Clear Browsing Data...

Select The Beginning of Time in the pull down.

Select:

  • Clear saved Autofill form data
  • Delete cookies and other site and plug-in data
  • Empty the cache

Select Clear Browsing Data

This should take care of it doing any Auto-fill based on your previous browsing. Also, it will remove any of the cookies that could also be causing problems.

  • The problem for me was the cache. I was able to go to my http site fine in firefox and a chrome incognito window. There were no cookies for the site. – ton.yeung Aug 29 '16 at 14:40
  • 1
    This also worked for me where the HSTS did not. I only had to check the "Images and Files" checkbox. – dgig Mar 1 '17 at 16:16
  • This worked for me, while HSTS and other solutions did not. – AllisonC Apr 7 '17 at 13:54
  • This worked for me as well. – jcubic Oct 24 at 15:17

A less drastic alternative than clearing all cookies ever is Settings>Show advanced settings>Content Settings>All Cookies and site data then search for the sites in question and clear cookies for only those.

  • Thanks this works perfectly. I don't know why Chrome makes this such a hidden feature.....well actually, I can guess why... – ktec Dec 6 '16 at 10:05
  • this doesn't seem to work with current Chrome version. – Vylix Jul 17 at 3:01

Before few days I accidentally turned on Chrome options named:

  • Automatically send some system information and page content to Google to help detect dangerous apps and sites
  • Protect you and your device from dangerous sites

And now the main problem was that our website on subdomain always redirect from http:// to https:// and browser gave me an error:

"Your connection is not private. Attackers might be trying to steal your information from censored.censored.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID"

Open chrome://settings/privacy and turn previously named chrome options that automatically protect your devices. Hope this will help someone.

  • Didn't seem to work for me. – Dave Burton Oct 11 '17 at 9:43

If you are facing the problem on a subdomain then this line in Nginx might cause a problem even if the subdomain is in another server, as the browser will cache this information.

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

so remove the includeSubdomains; of it to make it work.

in Chrome 66, lots have changed in the Settings tab

you can just go to chrome://settings/resetProfileSettings?origin=userclick then hit reset.

this worked for me.

From https://galaxyinternet.us/google-chrome-redirects-localhost-to-https-fix/

None of the option fixes worked for me, for fixing https://localhost:3000, this did.

Click and hold reload button and select “Empty Cache and Hard Reload,” this seems to only be an option on localhost.

Screenshot of the “Empty Cache and Hard Reload” option.

protected by Community Jun 29 at 16:59

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.