This guide explains how to disable or configure HSTS for a website.

Preface

• when HSTS is enabled for a website, the server tells the visitor of the site (if their web browser is compatible) to replace all insecure links with secure links
• example: http://www.example.com/a/page/ is automatically replaced with https://www.example.com/a/page/
• after enabling an SSL certificate on a website, HSTS is configured as follows: max-age=16000000

Disable HSTS

1. with a CMS (WordPress, Joomla, etc.)

Include the following line in all pages generated by the CMS:

header( 'Strict-Transport-Security: max-age=0;' );

For WordPress, it is possible to add this directive in the functions.php file of your theme:

add_action( 'send_headers', 'add_header_xua' );
function add_header_xua() {
    header( 'Strict-Transport-Security: max-age=0;' );
}

More details on WordPress 

2. with a PHP site

Include the following line in all PHP pages:

header( 'Strict-Transport-Security: max-age=0;' );

To do this without having to modify each PHP page of a site, you can use the auto_prepend_file directive in the .user.ini file of the concerned site:

auto_prepend_file=/home/clients/xxxx/web/hsts_disable.php

... with the following hsts_disable.php file:

header( 'Strict-Transport-Security: max-age=0;' );

3. with a static content site (non-PHP)

Include this header in a .htaccess file:

# BEGIN DISABLE HSTS
<IfModule mod_headers.c>
Header always set Strict-Transport-Security "max-age=0; includeSubDomains;"
</IfModule>
# END DISABLE HSTS

Customize HSTS

header( 'Strict-Transport-Security: max-age=X; includeSubdomains; preload' );

includeSubDomains; is enabled by default and, as its name indicates, it will include subdomains in the "Strict Transport Security".

When the visitor goes to an insecure subdomain, the browser will redirect to HTTPS automatically and cause a security error.

If this behavior is not desired, this header should be removed.

Clear the browser's HSTS cache

To do this:

1. in Chrome, type chrome://net-internals/#hsts
2. enter the domain name in the text field of the "Delete domain security policies" section
3. click on the Delete button
4. enter the domain name in the text field of the "Query HSTS" section
5. click on the Query button
6. the response should be "Not found"
7. with Safari, start by closing the browser
8. delete the file ~/Library/Cookies/HSTS.plist
9. reopen Safari
10. with Firefox, close all tabs
11. open the Firefox menu and click on History / Show History.
12. search for the page for which you want to remove HSTS preferences
13. right-click on one of the entries corresponding to it
14. choose Forget this site