Hacker News Reader

>whether to go back to HTTP

If you do this, be careful of the HSTS header. You'll want to remove this from responses for a while before you flip everyone back to HTTP because their browsers will refuse to send HTTP requests during the specified period or until the next time they clear their browsing data.

If you don't have a lot of returning visitors, it matters less, but still something to be aware of.

View on HN

Removing the HSTS header won't help, as your browser will store this data, and IIRC it's not stored in cache, so clearing won't help.

You can however send the HSTS header with max-age=0 which will start clearing it for existing users

Good tip about max-age=0! I didn't realize you could do that.

Thanks for the reminder, I know I'll need to keep this in mind if I make the switch back. I'm fairly certain I'll stay with HTTPS though, since the situation will only improve. It also helps to encourage the ad networks to make the change, and encourages other developers to use HTTPS on their projects as well.

Reply on news.ycombinator.com