HTTP Strict Transport Security (HSTS) is a critical web security mechanism. When you visit a secure website (like your bank or an email provider), the server sends a special HTTP header telling Google Chrome: “For the next year, only ever connect to me using secure HTTPS. Never use standard HTTP, even if the user manually types it.”
Chrome saves this instruction in its internal HSTS cache. This is fantastic for security, as it prevents man-in-the-middle attacks.
However, if you are a web developer or server administrator, this cache can become a nightmare. If you are testing a local development server or if you have temporarily disabled SSL/TLS on a staging domain, Chrome will completely refuse to load the site, throwing a “Your connection is not private” (NET::ERR_CERT_AUTHORITY_INVALID) error. Because of the HSTS policy, Chrome will stubbornly block you from bypassing the warning.
To fix this, you must clear the HSTS state for that specific domain directly within Chrome’s hidden networking tools.
How to Delete the HSTS Domain Policy
You do not need to clear your entire browsing history or reset your browser to fix this. Chrome has a dedicated internal page specifically for managing HSTS policies.
- Open Google Chrome.
- Click on the address bar at the top of the window, type the following internal URL exactly as shown, and press Enter:
chrome://net-internals/#hstsYou will be presented with a plain-text debugging page with several distinct sections. Ignore the “Add HSTS domain” and “Query HSTS/PKP domain” sections at the top.
- Scroll down to the very bottom of the page to find the section labelled Delete domain security policies.
- In the Domain text box, type the exact domain name that is causing you trouble (e.g.,
example.comorstaging.mywebsite.net). Do not include the “http://” or “www” prefixes. - Click the Delete button.
Chrome will not provide a visual confirmation popup or success message, but the policy will instantly be wiped from the database.
Verify the Deletion
To ensure the HSTS state was successfully removed, you can query the browser’s database on the exact same page.
- Scroll up slightly to the Query HSTS/PKP domain section.
- Type the same domain name into the text box and click the Query button.
If the deletion was successful, the query result will display “Not found”.
You can now open a new tab and successfully navigate to your development or staging domain using standard HTTP without Chrome aggressively forcing an HTTPS redirect.