2

I've switched my website www.intelli.bet back from https to http and now I can't get on it using Chrome (my default browser).

I was previously hosting with Firebase which is a great platform, but I don't really need their data storage and my web design skills are poor so I am now using a Go Daddy hosted WordPress site. Firebase provided free HTTPS certificates, whereas Go Daddy don't. I don't really see that as being an issue for my website at this time and would rather save money as I try to grow it.

However, when I type the address into the bar of Chrome it always redirects to the (now defunct) HTTPS address and gives an error message: This site can’t provide a secure connection.

Using the browser on my phone works fine, my wife's phone works fine and Firefox is able to load the page on my machine.

I have tried clearing the DNS cache in chrome but that's had no effect. I'm worried that people using my site will run into the same issue. How can I fix this?

3

You probably either had permanent redirect from HTTP to HTTPS, or you had HTTP strict transport security (HSTS) enabled which are still in your cache.

As far as I know clearing your cache should work to delete a redirect, to clear the HSTS settings in Chrome: chrome://net-internals/#hsts and "Delete" your domain.

  • Thanks, that worked. Are all of my users who already use Chrome and accessed the HTTPS site going to have to do that same thing? That could be a problem. Would paying for an SSL certificate and returning to HTTPS help, or would that cause issues? – James Oct 26 '16 at 9:37
  • 1
    Yes, other returning visitors probably experience the same. As Tero already explained, re-establishing HTTPS would resolve the issue. – HBruijn Oct 26 '16 at 10:29
2

Your site most probably issues HSTS headers to visitors, which tell the browser that the site should always be loaded with https. The browsers remember these header settings for each site, and refuse to load it without https.

So, every visitor who visited your site when it had been set up with https, has received these HSTS settings. Every one of those visitors cannot visit your site until the max-age setting of HSTS is reached.

You can view your domain HSTS status with instructions from this post: https://security.stackexchange.com/questions/68883/checking-domains-hsts-status

Now, you have two options:

  1. Wait until the max-age of HSTS expires. However, max-age is usually really long, so that is not a realistic option.

  2. Get a new certificate for the site, and this will fix the issue. You might also be able to use the previous private key / certificate, if you still have access to them and they are still valid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.