Removing HSTS in IE to test redirecting to https if supported by browser and is ok for subdomains

Question

Situation

Is need for transferring site to https but not so important subdomains does not support https. To add this header on supported domains when opening main page already has been made functionality and it has been tested and worked in Opera, Chrome and FireFox. But as usually - need to test also on IE.

Problem

I haven't found solution to remove Secure-Transport-Security header for this site on browser to be able to test it.

Question

How to delete saved Strict-Transport-Security header in IE like in Chrome is 'chrome:net-intenrals/#hsts' to test this auto redirecting?

Solution 1

Internet Explorer doesn't provide a way to remove this.

Easiest way to remove this is to temporarily change the max-age to 0 on your server and then visit the site. This will reset it and then you can set it again properly.

Also note only IE11 and Edge support this: http://caniuse.com/#search=Hsts

It should be noted that HSTS should be used as an extra security on top of the standard redirect for the first visits and those browsers that do not support it. I don't understand from your wording whether you realise this or if you think this is an alternative to redirects.

Solution 2

For testing purposes you could disable the HSTS-Feature for the whole IE (i.e. IE11) or only for a specific user. Here is a Microsoft KB how to do that: Internet Explorer 11 adds support for HTTP Strict Transport Security standard

Comments

[Jeffrey]

...By design, disabling HSTS in Windows 10 is no longer possible. So, the below instructions will only work in Windows 7 or Windows 8.1...