You Cannot Visit This Site Right Now Because the Website Uses HSTS

HSTS: what the message means

HSTS (HTTP Strict Transport Security) is an instruction a site sends to the browser: "from now on, only connect to me securely and never accept a faulty certificate". It is like a building telling the doorman "nobody comes in through the side door; if the main door's lock breaks, nobody comes in at all". The HSTS standard explicitly forbids the browser from letting the user bypass the warning.

The browser learns that a site uses HSTS in two ways:

• From an earlier visit. The site sent the Strict-Transport-Security header and the browser remembers it for as long as max-age says (often a year or more).
• From a built-in list (preload). Chrome and most other browsers ship with a list of domains that are always HSTS, even on the very first visit. The list also contains entire endings such as .app, .dev and .page: every site under those endings must use HTTPS.

The HSTS message always appears together with a certificate error code. That code tells you what actually broke:

• NET::ERR_CERT_DATE_INVALID: the certificate has expired or your clock is wrong. See ERR_CERT_DATE_INVALID.
• NET::ERR_CERT_COMMON_NAME_INVALID: the certificate is for a different name. See ERR_CERT_COMMON_NAME_INVALID.
• NET::ERR_CERT_AUTHORITY_INVALID: the browser does not trust the issuer. See ERR_CERT_AUTHORITY_INVALID.

How it looks in Chrome, Edge, Firefox and Safari

If you are a visitor

1. Don't look for a way around it. The block exists to protect you. If someone is intercepting the connection, bypassing it would hand them your passwords.
2. Check the date, time and time zone. With a wrong clock every certificate looks invalid. Turn on automatic time.
3. Switch networks. Wi-Fi in hotels, airports and cafés often "catches" connections until you sign in on its login page. Finish the Wi-Fi sign-in first and try again, or use mobile data.
4. Check antivirus, VPN or a company network. Software that inspects HTTPS traffic with its own certificate often causes this error. Temporarily turn off "HTTPS scanning" or the VPN.
5. Try another device. If the site does not open from anywhere, the problem is the site. Tell its owner.
6. Clearing the browser's HSTS "memory": only in a special case. It helps only when you know the site deliberately stopped using HTTPS (e.g. your own test site), not when its certificate is simply broken. In Chrome: type chrome://net-internals/#hsts and enter the domain under "Delete domain security policies". This does not work for domains on the built-in list, and if the site still sends the HSTS header it comes back on the next visit. In Firefox: open History, right-click a page of the site and choose "Forget About This Site…". That also deletes the site's history and cookies, so you will be signed out.

If you own the website: the usual causes

1. A problem with the certificate itself. Expired, for the wrong name or with an incomplete chain. HSTS just makes the error impossible to click through. Fix the certificate using the guide for the code you see, and the message goes away on its own.
2. A subdomain without a valid certificate while you use includeSubDomains. With this option HSTS applies to EVERY subdomain. An old subdomain that only worked over http (e.g. an old panel or test site) suddenly becomes unreachable. Put a valid certificate on every subdomain you use.
3. The domain is on the preload list. Getting off it is not easy: according to hstspreload.org, removal takes months to reach users through Chrome updates. To be accepted on the list a domain needs a max-age of at least one year, includeSubDomains and preload, so every subdomain must have HTTPS.
4. You want to switch HSTS off. If you simply remove the header, browsers that have seen it remember it until its max-age runs out. The right way is to keep serving valid HTTPS with Strict-Transport-Security: max-age=0 long enough for your visitors to see it. If the domain is also preloaded, request its removal too.
5. HSTS is added somewhere else. If a CDN or proxy (e.g. Cloudflare) sits in front of the site, the header may be added there rather than by your server. Check its settings as well.

Check which HSTS policy your site sends

More: security headers and HSTS, ERR_CERT_DATE_INVALID, ERR_CERT_COMMON_NAME_INVALID and "Not Secure" in Chrome.

Common mistakes

• Turning on includeSubDomains or preload without checking that ALL subdomains have a valid certificate.
• Starting straight away with a one-year max-age. hstspreload.org recommends ramping up: 5 minutes, then one week, then one month.
• Removing the header and believing HSTS is switched off immediately.
• Hunting for bypass tricks instead of fixing the certificate.