Working way to clear HSTS flag in Firefox and Chrome set with PRELOAD – Firefox

The Problem:

I developed a webpage with HSTS turned on, and now I want to remove it. I have tried various methods, including forgetting the site in Firefox, creating a new profile in Chrome, and using chrome://net-internals/#hsts, but nothing seems to work. Additionally, I checked that my site is not sending any HSTS headers, but the issue persists. I suspect that my site’s HSTS status may have been injected by a Cloudflare proxy, and I am unable to access it without using the thisisinsecure flag in Chrome. I have also tried importing a self-signed certificate, but Firefox does not trust it. Setting max-age=0 did not resolve the issue. How can I remove the HSTS flag and regain normal access to my website?

The Solutions:

Solution 1: Changing the HSTS header to expire immediately

– For Google Chrome, you can modify the site you are developing and add a max-age directive of 0 to your HSTS header. This will make the browser cache remove the header and effectively disable HSTS. Once the header is removed, you can permanently disable it by removing it from your solution.

– For Mozilla Firefox, you can navigate to the History view, right-click the site from the list of items, and click Forget About This Site to clear HSTS settings for that domain. Restart Firefox and visit the site to verify the changes.

– Alternatively, you can manually remove the HSTS keyfile from your Firefox profile folder. Locate the SiteSecurityServiceState.txt file, search for the domain you want to clear the HSTS settings for, and delete the corresponding entry in the file or rename the file to save a backup and allow Firefox to create a new file.