Browser errors
"You cannot visit this site right now" (HSTS): how to fix
You cannot visit example.com right now because the website uses HSTSThis message means the site has told your browser to always require a valid HTTPS certificate (HSTS), and the certificate it presented failed a check. Because of HSTS, Chrome and Firefox remove the "Proceed anyway" option. The certificate problem underneath, not HSTS itself, is what needs fixing.
Is it the site or your device?
Usually the site's certificate is broken; HSTS only removes the bypass. Test the site independently with the SSL checker:
curl ssl.sh/example.com
- The checker shows a certificate problem: the site must fix it; as a visitor, wait.
- The checker shows a valid certificate: the cause is on your side. The usual suspects are a wrong system date, antivirus HTTPS scanning, a company proxy and public Wi-Fi portals. Click the error code on Chrome's page (for example
NET::ERR_CERT_DATE_INVALID) to see which check failed, then follow that error's page.
Causes
1. The site's certificate is broken
The certificate is expired, lacks a hostname or lacks an intermediate. HSTS turns what would be a click-through warning into a hard block. See NET::ERR_CERT_DATE_INVALID and NET::ERR_CERT_COMMON_NAME_INVALID.
2. Interception on your device or network
Antivirus HTTPS scanning, corporate SSL inspection and captive portals present their own certificates. On HSTS sites, any untrusted interception is blocked outright. See captive portal errors and corporate SSL inspection.
3. Wrong system clock
A date far in the past or future makes valid certificates look invalid. Fix the time.
4. Development host on a preloaded TLD or domain
Developers using *.dev, *.app or a subdomain of a preloaded company domain with a self-signed certificate hit this immediately, because those names are HSTS-preloaded in every browser.
5. HSTS set for a host that later lost HTTPS
If a domain once sent Strict-Transport-Security and later dropped HTTPS (or moved to a host without a certificate), returning visitors are blocked until max-age expires.
What it looks like in each browser
| Browser | What you see |
|---|---|
| Chrome / Edge | "Your connection is not private" with "You cannot visit example.com right now because the website uses HSTS" and no Proceed link |
| Firefox | "Did Not Connect: Potential Security Issue", saying the site uses HSTS and an exception cannot be added |
| Safari | "This Connection Is Not Private" without the option to visit anyway |
How site owners fix it
Fixing the certificate removes the block; HSTS itself needs no change.
1. Fix the certificate. Run curl ssl.sh/example.com, then renew, add missing names or serve the full chain.
2. Set HSTS deliberately. Only send it once HTTPS works on every subdomain you include:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Check your header with the HSTS checker.
3. For your own development domains, delete dynamic HSTS entries: in Chrome open chrome://net-internals/#hsts, enter the domain under "Delete domain security policies"; in Firefox, use History > right-click the site > "Forget About This Site". Preloaded entries cannot be removed this way.
4. Preload removal takes months. Removing a domain via hstspreload.org only takes effect after browsers ship updated lists, so only preload when you are sure every subdomain will keep HTTPS. Background: how HSTS works.
FAQ
Is there a way to bypass the HSTS error?
Browsers deliberately remove the bypass, and you should not look for one. HSTS exists so that an attacker presenting a fake certificate cannot trick you into continuing. Fix the cause (clock, interception software, or the site's certificate) instead.
Why do I get HSTS errors on my local .dev domain?
The entire .dev and .app top-level domains are on the HSTS preload list, so browsers always require valid HTTPS there. Use .test or .localhost for local development, or issue a locally trusted certificate.
How long does HSTS last?
As long as the max-age value in the header, counted from the last visit that received it. A common value is 31536000 seconds (one year). Preloaded entries last until the domain is removed from the list and browsers ship the update.