How to stop an automatic redirect from “http://” to “https://” in Chrome (2024)

896

In addition to cached redirects, HTTP Strict Transport Security (aka HSTS) may be at play. HSTS is a security feature that forces the browser to use HTTPS even when accessing an HTTP URL.

The browser will start using HSTS for a domain after receiving a Strict-Transport-Security header from the server. The browser also ships with a list of domains for which HSTS is enabled by default.

In Chrome, there is a way to delete your domain from HSTS after it was added by the server. Though, you can’t exclude domains that are baked in the browser (this includes popular websites and notably everything under the new .dev TLD)

1. Go to chrome://net-internals/#hsts. Enter example.com under Delete domain security policies and press the Delete button.

2. Now go to chrome://settings/clearBrowserData, tick the box Cached images and files and press click the button Clear data.

• 3

  This helped me as well!!! While developing internally and having the same problem of the redirect!

  –Marcello de Sales

  Jul 12, 2015 at 3:11

• 5

  Man, this had been bugging me for ages, finally got it, thanks! A potential gotcha of note: If the domain you're having trouble with is a subdomain you may need to delete the primary domain from the HSTS set if "include subdomains for STS is set to true". If you run a query on the parent domain you should see if that's set or not for the domain in question.

  –Pooch

  Jan 6, 2016 at 17:40

• 24

  This only worked for me after I also cleared my browser cache. In chrome: Settings > Show advanced settings… > Privacy > Clear browsing data... Source

  –nittyjee

  Jul 21, 2017 at 6:30

• 2

  This is now found under the Domain Security Policy menu item on the left of the page

  –Brice

  Nov 6, 2017 at 17:14

• 20

  Since 63.0.3239.132 this does nothing. The rule seems to be disregarded and even custom domains that link to localhost is now redirected to https. Annoying factor to have to use self-signed certificates for everything...

  –Daniel

  Jan 5, 2018 at 8:59

| Show 14 more comments

257

My problem came from having a .dev domain, which was apparently recently registered as a gTLD and put in a commit to Chrome Canary. I found this out from a recent post I came across as I searched for my problem.

If you have the same problem I do, it appears that the best solution is to change your domain to be something other than .dev. The article suggested .test with a potential solution of .localhost later down the road (via this proposal).

• 50

  This was the issue for me as well. On my local development machine I utilized .dev for almost 10 years now. I did a recent Google Chrome update and it started redirecting all of my sites to https for no reason I could understand. Would have never thought it had to do with the .dev, then I came across this answer and changed it to .development and all works well again ... For now :-) . Thanks again!

  –conrad10781

  Dec 8, 2017 at 20:04

• 22

  Perfect! I don't understand why Chrome will do something like that, it's very annoying as I have nearly 30 .dev domains in my local. Hope it's a very, very good reason.

  –Pablo Ezequiel Leone

  Dec 11, 2017 at 9:00

• 4

  I have wordpress installed, changing its domain might be a real headache. same for the main directory name ect. is there any other way around?

  –Rick Sanchez

  Dec 11, 2017 at 16:26

• 9

  It's because Google bought .dev and presumably will start making public sites using it.

  –Hilton Shumway

  Dec 11, 2017 at 18:41

• 22

  FML… I almost gave up on my 10+ year web dev career because of this. #starbucksbarista

  –elbowlobstercowstand

  Dec 13, 2017 at 22:34

| Show 14 more comments

32

To delete domain under "HSTS" menu in chrome://net-internals is a temporary solution.After visiting this domain over HTTPS it will be included in HSTS list again.

Basicaly, to solve this issue it is necessary to disable HTTP Strict Transport Security on the web-server 3rdrevolution.com (IIS, Apache, nginx,...).For nginx edit its HTTPS section in nginx.conf and set 'max-age=0' for Strict-transport-Security:

server {#... ssl on;#... add_header Strict-Transport-Security "max-age=0;";#...}

More info: HTTP Strict Transport Security (HSTS)

• I wasn't able to get the add_header method to work.

  –Alex Barker

  Jan 26, 2016 at 6:49

• for me the server did not issue a HSTS header so this is not a solution. From what I can tell, chrome recorded when I accidentally visited it with https and created an internal HSTS record that then mysteriously redirected me to https everytime. Fix was to use the delete HSTS record in chrome:net-internals. Had a handy checker in there as well.

  –rob

  May 15, 2017 at 13:53

• 2

  To delete HSTS record is a temporary solution. You will get this record in chrome again and again after visit https untill server send "max-age=0".

  –user2285323

  May 16, 2017 at 17:46

Add a comment |

22

https://www.3rdrevolution.com sends the Strict-Transport-Security header so accessing it over https once will make browsers like Chrome/Firefox redirect http requests to https until some specified point in the future.

As the other answer said, the only way to stop this once it starts is to clear the browser cache (or wait for the browser to expire the order).

Add a comment |

14

There could be a couple of reasons for this, including plugins but assuming that you do not have any plugins installed you can do the following:

Goto Settings/Privacy/Clear Browsing Data...

Select The Beginning of Time in the pull down.

Select:

• Clear saved Autofill form data
• Delete cookies and other site and plug-in data
• Empty the cache

Select Clear Browsing Data

This should take care of it doing any Auto-fill based on your previous browsing. Also, it will remove any of the cookies that could also be causing problems.

• The problem for me was the cache. I was able to go to my http site fine in firefox and a chrome incognito window. There were no cookies for the site.

  –ton.yeung

  Aug 29, 2016 at 14:40

• 1

  This also worked for me where the HSTS did not. I only had to check the "Images and Files" checkbox.

  –dmgig

  Mar 1, 2017 at 16:16

• This worked for me, while HSTS and other solutions did not.

  –AllisonC

  Apr 7, 2017 at 13:54

• This worked for me as well.

  –jcubic

  Oct 24, 2018 at 15:17

Add a comment |

10

From https://galaxyinternet.us/google-chrome-redirects-localhost-to-https-fix/

None of the option fixes worked for me, for fixing https://localhost:3000, this did.

Click and hold reload button and select “Empty Cache and Hard Reload,” this seems to only be an option on localhost.

• 4

  To make this work on Chrome Version 77.0.3865.90 (Official Build) (64-bit) (MacOS), I had to do this [1] (after opening problematic page) Right click anywhere and click on Inspect [2] After the inspect frame appears, click and hold on reload button [3] in the drop-down that appears, click on Empty Cache and Hard reload

  –y2k-shubham

  Sep 27, 2019 at 7:55

Add a comment |

7

If you are facing the problem on a subdomain then this line in Nginx might cause a problem even if the subdomain is in another server, as the browser will cache this information.

add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";

so remove the includeSubdomains; of it to make it work.

• yes, thanks for pointing this important point.

  –Himalaya Garg

  Jan 22, 2021 at 11:57

Add a comment |

5

• Thanks this works perfectly. I don't know why Chrome makes this such a hidden feature.....well actually, I can guess why...

  –ktec

  Dec 6, 2016 at 10:05

• 1

  this doesn't seem to work with current Chrome version.

  –Vylix

  Jul 17, 2018 at 3:01

Add a comment |

4

Before few days I accidentally turned on Chrome options named:

• Automatically send some system information and page content to Google to help detect dangerous apps and sites
• Protect you and your device from dangerous sites

And now the main problem was that our website on subdomain always redirect from http:// to https:// and browser gave me an error:

"Your connection is not private. Attackers might be trying to steal your information from censored.censored.com (for example, passwords, messages, or credit cards). NET::ERR_CERT_COMMON_NAME_INVALID"

Open chrome://settings/privacy and turn previously named chrome options that automatically protect your devices. Hope this will help someone.

• Didn't seem to work for me.

  –Dave Burton

  Oct 11, 2017 at 9:43

Add a comment |

2

in Chrome 66, lots have changed in the Settings tab

you can just go to chrome://settings/resetProfileSettings?origin=userclick then hit reset.

this worked for me.

• 5

  This will reset ALL your settings.

  –Rafal Enden

  Feb 27, 2020 at 15:05

Add a comment |