How to Clear HSTS and Website Cache for Specific Domains in Apple Safari on Mac

HTTP Strict Transport Security (HSTS) is an essential web security mechanism that instructs browsers to establish connections exclusively over encrypted HTTPS, preventing protocol downgrade attacks and cookie hijacking. When a web server emits an HSTS header, modern browsers record this directive in a local policy database and refuse any unencrypted HTTP fallback for a designated duration (often up to one or two years).

While invaluable for web security, cached HSTS records frequently cause persistent connection failures for local developers, staging server administrators, or users accessing domains that recently shifted SSL configurations or expired certificates. Safari blocks access without offering a manual bypass button. Fortunately, macOS allows you to clear cached HSTS records and stored website data for isolated domains without erasing your entire browsing history.

Clearing Stored Website Cache and Cookies for a Single Domain in Safari

Before purging system-level HSTS policies, remove domain-specific cache and cookie records through Safari’s Privacy settings.

1. Launch Safari on your Mac.
2. Click Safari in the macOS menu bar at the top-left and select Settings (or press Cmd+,).
3. Click the Privacy tab in the settings window.
4. Click the Manage Website Data button.
5. In the search box located at the top-right of the sheet, type the target domain name (for instance, example.com or localhost).
6. Select the matching entry from the filtered list.
7. Click Remove at the bottom of the dialogue, then click Done.

Deleting Cached HSTS Policies via macOS Terminal

Safari on macOS stores HSTS state records in a dedicated property list (.plist) file located inside your user library. Deleting this cache forces Safari to re-evaluate the target server’s certificate handshake.

1. Completely quit Safari by pressing Cmd+Q. (HSTS policies cannot be cleared while Safari processes are actively running in memory).
2. Open Terminal on your Mac (press Cmd+Space, type Terminal, and press Enter).
3. Navigate to the Safari HTTP security database directory:

   cd ~/Library/Cookies/

4. Safari maintains HSTS and certificate pinning records inside HSTS.plist. To delete the cached database so Safari recreates a clean policy store on next launch, run:

   rm -f ~/Library/Cookies/HSTS.plist

5. If you are using modern macOS versions (Sonoma or Sequoia) with sandboxed WebKit containers, remove the containerised policy cache as well:

   rm -rf ~/Library/Containers/com.apple.Safari/Data/Library/Cookies/HSTS.plist

6. Flush the macOS local DNS resolver cache to clear lingering record states:

   sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

7. Enter your administrator password when prompted.

Bypassing Certificate Validation Errors in Safari for Local Development

If you are developing applications on local environments (such as .test or .local domains) with self-signed SSL certificates:

• Enable the Develop menu: Open Safari Settings (Cmd+,), click Advanced, and tick the box for Show features for web developers.
• Disable local caches: Click the Develop menu in the menu bar and select Empty Caches (Cmd+Option+E).
• Disable cross-origin and SSL restrictions temporarily: Under the Develop menu, navigate to Developer Flags and ensure certificate validation matches your local testing requirements.

Verifying Domain Connection Recovery

Relaunch Safari and navigate to the problematic URL. With the HSTS policy reset, Safari negotiates the HTTPS handshake from scratch, bypassing outdated certificate locks and allowing you to load updated web applications seamlessly.