# Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing

> A browser can retain the HTTPS requirement after a dashboard setting changes.

- Canonical URL: https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:17:05+00:00
- Modified: 2026-10-20T18:34:37+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A browser can retain the HTTPS requirement after a dashboard setting changes.

## Potentially affected

This concerns Cloudflare HSTS configuration and browser-retained policy.

## DSE recommendation

DSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload.

## Article

A browser can retain the HTTPS requirement after a dashboard setting changes.

## Source facts

Cloudflare warns that removing HTTPS before disabling HSTS and waiting out the original max-age can leave the website inaccessible to affected browsers. Its disable procedure sends a zero max-age. includeSubDomains extends the requirement to child names, which become inaccessible if they lack working HTTPS. Preload introduces an additional browser-list process beyond merely enabling the setting.

Source: [Cloudflare — HTTP Strict Transport Security (HSTS)](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/).

## Applicability

This concerns Cloudflare HSTS configuration and browser-retained policy.

## DSE recommendation

DSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload. Keep valid HTTPS available throughout migrations, emergency routing changes, and policy retirement. Record max-age and any preload submission in the recovery plan so a future administrator does not assume switching the dashboard off immediately reverses prior browser policy. Prefer a staged rollout with a verified certificate-renewal process. Ask the recovery owner to review the longest retained policy interval and every child name before approving proxy removal or HTTPS retirement. Keep the zero-age delivery plan and any preload-removal work as separate checkpoints. A dashboard toggle alone should not close the recovery exercise.

## Verification

Use controlled browser profiles to inspect the HTTPS header on the exact hostname and confirm valid TLS throughout the proposed recovery route. Rehearse zero max-age delivery where appropriate and account for clients that have not revisited. Verify child hostnames independently rather than assuming the parent site’s successful test covers them.

## Official reference

[Cloudflare — HTTP Strict Transport Security (HSTS)](https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — HTTP Strict Transport Security (HSTS)
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/ssl/edge-certificates/additional-options/http-strict-transport-security/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing,” DSE Security, https://update.dsesecurity.com/updates/plan-cloudflare-hsts-rollback-before-removing-https-or-changing-proxy-routing/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.