Clearing HSTS in Your Browser

Sometimes your browser may refuse to access a website via HTTP because it has cached a HSTS (HTTP Strict Transport Security) policy for the domain. This can prevent access to services running on custom ports or plain HTTP. This guide explains how to clear HSTS in different browsers.

Google Chrome (Desktop)

Open Chrome and navigate to:
```
chrome://net-internals/#hsts
```
Scroll down to "Delete domain security policies".
In the Domain field, type your domain (e.g., node-2.vacer.de).
Click Delete.
Restart Chrome and try accessing your site again.

Mozilla Firefox (Desktop)

There are multiple ways to clear HSTS settings in Firefox. Two common methods are shown below.

The first method works in most cases. If it does not, use the manual fallback method.

Close all open tabs in Firefox.
Open the full History window:
- Windows/Linux: Ctrl + Shift + H
- macOS: Cmd + Shift + H
Find the website whose HSTS settings you want to remove (use the search box in the top-right).
Right-click the website entry and select Forget About This Site.
- This removes HSTS settings and other cached data for that domain.
Restart Firefox and visit the site again (HTTP access should now work).

If this does not work, use the manual method:

In the address bar, open about:config.
Search for HSTS-related entries and remove/reset data for the domain if available.
Restart Firefox.

Microsoft Edge (Desktop)

Open Edge and navigate to:
```
edge://net-internals/#hsts
```
Follow the same steps as Chrome: delete the domain security policy for your domain.
Restart Edge.

Apple Safari (Desktop / macOS)

Open Safari → Preferences → Privacy → Manage Website Data…
Search for your domain and remove it.
Close and reopen Safari.

iOS Safari

Go to Settings → Safari → Advanced → Website Data.
Search for your domain and swipe to delete it.
Restart Safari.

Android Chrome / Mobile Browsers

Android Chrome shares the same steps as desktop Chrome:
- Go to chrome://net-internals/#hsts in the mobile browser.
- Delete the domain security policy.
If that’s not accessible, clearing the browser cache and site data will remove HSTS.

Important Notes

HSTS is cached in the browser; removing it only affects that browser/device.
If your site previously sent HSTS headers with includeSubDomains, consider using a separate subdomain for HTTP-only services to avoid future conflicts.
Always use HTTP for ports without SSL and HTTPS for ports with SSL to prevent errors like SSL_ERROR_RX_RECORD_TOO_LONG.

HSTS Fix