{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
        "slug": "plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing",
        "url": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/"
        },
        "title": "Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing",
        "summary": "A browser can retain the HTTPS requirement after a dashboard setting changes.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:17:05+00:00",
        "modified_at": "2026-10-20T18:34:37+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 254,
        "potentially_affected": "This concerns Cloudflare HSTS configuration and browser-retained policy.",
        "dse_recommendation": "DSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload.",
        "primary_source": {
            "name": "Cloudflare — HTTP Strict Transport Security (HSTS)",
            "url": "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/",
            "published_on": null,
            "authority": "developers.cloudflare.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A browser can retain the HTTPS requirement after a dashboard setting changes.</p>\n<h2>Source facts</h2>\n<p>Cloudflare warns that removing HTTPS before disabling HSTS and waiting out the original max-age can leave the website inaccessible to affected browsers. Its disable procedure sends a zero max-age. includeSubDomains extends the requirement to child names, which become inaccessible if they lack working HTTPS. Preload introduces an additional browser-list process beyond merely enabling the setting.</p>\n<p>Source: <a href=\"https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/\">Cloudflare — HTTP Strict Transport Security (HSTS)</a>.</p>\n<h2>Applicability</h2>\n<p>This concerns Cloudflare HSTS configuration and browser-retained policy.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload. Keep valid HTTPS available throughout migrations, emergency routing changes, and policy retirement. Record max-age and any preload submission in the recovery plan so a future administrator does not assume switching the dashboard off immediately reverses prior browser policy. Prefer a staged rollout with a verified certificate-renewal process. Ask the recovery owner to review the longest retained policy interval and every child name before approving proxy removal or HTTPS retirement. Keep the zero-age delivery plan and any preload-removal work as separate checkpoints. A dashboard toggle alone should not close the recovery exercise.</p>\n<h2>Verification</h2>\n<p>Use controlled browser profiles to inspect the HTTPS header on the exact hostname and confirm valid TLS throughout the proposed recovery route. Rehearse zero max-age delivery where appropriate and account for clients that have not revisited. Verify child hostnames independently rather than assuming the parent site&#8217;s successful test covers them.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/\">Cloudflare — HTTP Strict Transport Security (HSTS)</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A browser can retain the HTTPS requirement after a dashboard setting changes.\nSource facts\nCloudflare warns that removing HTTPS before disabling HSTS and waiting out the original max-age can leave the website inaccessible to affected browsers. Its disable procedure sends a zero max-age. includeSubDomains extends the requirement to child names, which become inaccessible if they lack working HTTPS. Preload introduces an additional browser-list process beyond merely enabling the setting.\nSource: Cloudflare — HTTP Strict Transport Security (HSTS).\nApplicability\nThis concerns Cloudflare HSTS configuration and browser-retained policy.\nDSE recommendation\nDSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload. Keep valid HTTPS available throughout migrations, emergency routing changes, and policy retirement. Record max-age and any preload submission in the recovery plan so a future administrator does not assume switching the dashboard off immediately reverses prior browser policy. Prefer a staged rollout with a verified certificate-renewal process. Ask the recovery owner to review the longest retained policy interval and every child name before approving proxy removal or HTTPS retirement. Keep the zero-age delivery plan and any preload-removal work as separate checkpoints. A dashboard toggle alone should not close the recovery exercise.\nVerification\nUse controlled browser profiles to inspect the HTTPS header on the exact hostname and confirm valid TLS throughout the proposed recovery route. Rehearse zero max-age delivery where appropriate and account for clients that have not revisited. Verify child hostnames independently rather than assuming the parent site’s successful test covers them.\nOfficial reference\nCloudflare — HTTP Strict Transport Security (HSTS). Reviewed October 20, 2026.",
        "content_markdown": "A browser can retain the HTTPS requirement after a dashboard setting changes.\n\n## Source facts\n\nCloudflare warns that removing HTTPS before disabling HSTS and waiting out the original max-age can leave the website inaccessible to affected browsers. Its disable procedure sends a zero max-age. includeSubDomains extends the requirement to child names, which become inaccessible if they lack working HTTPS. Preload introduces an additional browser-list process beyond merely enabling the setting.\n\nSource: [Cloudflare — HTTP Strict Transport Security (HSTS)](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/).\n\n## Applicability\n\nThis concerns Cloudflare HSTS configuration and browser-retained policy.\n\n## DSE recommendation\n\nDSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload. Keep valid HTTPS available throughout migrations, emergency routing changes, and policy retirement. Record max-age and any preload submission in the recovery plan so a future administrator does not assume switching the dashboard off immediately reverses prior browser policy. Prefer a staged rollout with a verified certificate-renewal process. Ask the recovery owner to review the longest retained policy interval and every child name before approving proxy removal or HTTPS retirement. Keep the zero-age delivery plan and any preload-removal work as separate checkpoints. A dashboard toggle alone should not close the recovery exercise.\n\n## Verification\n\nUse controlled browser profiles to inspect the HTTPS header on the exact hostname and confirm valid TLS throughout the proposed recovery route. Rehearse zero max-age delivery where appropriate and account for clients that have not revisited. Verify child hostnames independently rather than assuming the parent site’s successful test covers them.\n\n## Official reference\n\n[Cloudflare — HTTP Strict Transport Security (HSTS)](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
                "url": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Cybersecurity",
                        "item": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing",
                        "item": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/#article",
                "identifier": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
                "url": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/",
                "headline": "Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing",
                "description": "A browser can retain the HTTPS requirement after a dashboard setting changes.",
                "abstract": "A browser can retain the HTTPS requirement after a dashboard setting changes.",
                "articleBody": "A browser can retain the HTTPS requirement after a dashboard setting changes.\nSource facts\nCloudflare warns that removing HTTPS before disabling HSTS and waiting out the original max-age can leave the website inaccessible to affected browsers. Its disable procedure sends a zero max-age. includeSubDomains extends the requirement to child names, which become inaccessible if they lack working HTTPS. Preload introduces an additional browser-list process beyond merely enabling the setting.\nSource: Cloudflare — HTTP Strict Transport Security (HSTS).\nApplicability\nThis concerns Cloudflare HSTS configuration and browser-retained policy.\nDSE recommendation\nDSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload. Keep valid HTTPS available throughout migrations, emergency routing changes, and policy retirement. Record max-age and any preload submission in the recovery plan so a future administrator does not assume switching the dashboard off immediately reverses prior browser policy. Prefer a staged rollout with a verified certificate-renewal process. Ask the recovery owner to review the longest retained policy interval and every child name before approving proxy removal or HTTPS retirement. Keep the zero-age delivery plan and any preload-removal work as separate checkpoints. A dashboard toggle alone should not close the recovery exercise.\nVerification\nUse controlled browser profiles to inspect the HTTPS header on the exact hostname and confirm valid TLS throughout the proposed recovery route. Rehearse zero max-age delivery where appropriate and account for clients that have not revisited. Verify child hostnames independently rather than assuming the parent site’s successful test covers them.\nOfficial reference\nCloudflare — HTTP Strict Transport Security (HSTS). Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:17:05+00:00",
                "dateModified": "2026-10-20T18:34:37+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 254,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Cloudflare — HTTP Strict Transport Security (HSTS)",
                    "url": "https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/"
                }
            }
        ]
    }
}