How to Clear HSTS Settings in Chrome, Edge, and Firefox

HSTS (HTTP Strict Transport Security) is a security protocol that forces your web browser to communicate with a website only over a secure HTTPS connection. If a website changes its security certificate or reverts to HTTP, your browser will remember the old HSTS rule and block you from visiting, often throwing a “Connection Not Private” or “Certificate Error.”

To fix this, you need to clear the HSTS settings for that specific domain in your browser.

Note: Before doing this, ensure your computer’s date and time are set correctly, as an incorrect system clock is the most common cause of fake HSTS errors.

How to Clear HSTS in Google Chrome and Microsoft Edge

Chrome and Edge are built on the same engine and use the exact same method to manage HSTS policies.

1. Open the internal settings page:
   • In Chrome, type chrome://net-internals/#hsts into the address bar and press Enter.
   • In Edge, type edge://net-internals/#hsts into the address bar and press Enter.
2. Find the Delete section: Scroll down the page until you find the section titled Delete domain security policies.
3. Enter the Domain: Type the root domain name of the website that is blocked (e.g., type example.com, without the “http://” or “www.”).
4. Delete: Click the Delete button next to the text box.

To verify it worked, scroll to the bottom of that same page to the Query HSTS/PKP domain section. Type the domain in again and click Query. It should return “Not found.” Restart your browser and try visiting the site again.

How to Clear HSTS in Mozilla Firefox

Firefox handles HSTS differently and requires you to remove the site completely from your browser’s history.

1. Open your complete Firefox History menu by pressing Ctrl + Shift + H (or Cmd + Shift + H on Mac). You can also access this via the top menu: History > Manage History.
2. In the Library window that appears, use the search bar in the top right to search for the website domain causing the issue.
3. In the search results, right-click on any entry for that specific website.
4. Select Forget About This Site from the context menu.

Important: Using “Forget About This Site” will delete the HSTS data, but it will also delete all cookies, saved passwords, and history associated with that specific domain.