如何阻止HTTP自动跳转至HTTPS？图书馆OPAC网站跳转问题求助

Got it, let’s fix this super annoying issue where both Chrome and Firefox keep forcing HTTPS on your library’s OPAC—even though the site doesn’t support it. The problem is that both browsers stored security policies (like HSTS) or redirect preferences after your accidental HTTPS visit, and they’re stuck on that setting. Here’s how to clear those for each browser:

Fix for Chrome #

• Open Chrome and paste this into the address bar: chrome://net-internals/#hsts
• Scroll down to the Delete domain security policies section. Type your library’s full OPAC domain (e.g., library.yourschool.edu) and hit the Delete button. This wipes the HSTS rule that’s forcing HTTPS.
• Next, clear the site’s stored data: go to chrome://settings/siteData, search for the domain, click the trash icon next to it to delete all cookies, cache, and redirect preferences.
• Restart Chrome, then make sure to type the full http:// URL (not just the domain) when accessing the OPAC. Don’t let auto-complete trick you into HTTPS!

Fix for Firefox #

• Open Firefox and type about:config in the address bar. Click “Accept the Risk and Continue” when the warning pops up.
• Search for network.stricttransportsecurity.preloadlist and double-click it to set it to false temporarily (we can switch it back later if you want).
• Now clear the site’s data: go to about:preferences#privacy, scroll to Cookies and Site Data, click Manage Data. Search for your library’s domain, select it, click Remove Selected, then hit Save Changes.
• Next, disable HSTS for the domain specifically: go to about:permissions, find the OPAC domain, under the Security section, set Enable HSTS to Never.
• Restart Firefox, then type the full http:// version of the OPAC URL. It should load without redirecting to HTTPS now.

Quick Checks to Prevent This from Coming Back #

• Always manually type http:// before the domain when visiting the site—browser auto-complete might still suggest the HTTPS version, so avoid clicking that.
• If the redirect returns later, double-check that you didn’t accidentally visit the HTTPS version again. Browsers will re-save the policy if you do.
• For a quick test, try accessing the site in incognito/private mode first—if it works there, that confirms the issue is with your main profile’s stored data, not a global setting.

内容的提问来源于stack exchange，提问作者aslum