Situation: site, supporting both HTTP and HTTPS. HSTS has been enabled. Powered by Apache 2.2.
Later, the site owner decides to only use HTTPS on certain pages (registration, orders etc.). However, the .htaccess redirection fails, since many site visitors' browsers have received HSTS headers already and won't show HTTP (leading to either redirection loops, or to HTTPS used everywhere).
Is it possible to disable HSTS redirections programmatically? The only working recipe, to clean all browser-kept data associated with the site, is far from perfect.
Attempts were made to send header like
and force redirection to HTTP after the set interval (1 second) has passed, but looks like not all the browsers can be tricked into that (redirection loops still happen).
Is the only solution - to ask users to manually delete mentioned site data?