Plan Cloudflare HSTS rollback before removing HTTPS or changing proxy routing

A browser can retain the HTTPS requirement after a dashboard setting changes.

Source facts

Cloudflare warns that removing HTTPS before disabling HSTS and waiting out the original max-age can leave the website inaccessible to affected browsers. Its disable procedure sends a zero max-age. includeSubDomains extends the requirement to child names, which become inaccessible if they lack working HTTPS. Preload introduces an additional browser-list process beyond merely enabling the setting.

Source: Cloudflare — HTTP Strict Transport Security (HSTS).

Applicability

This concerns Cloudflare HSTS configuration and browser-retained policy.

DSE recommendation

DSE recommends inventorying all affected hostnames and their certificate coverage before choosing includeSubDomains or preload. Keep valid HTTPS available throughout migrations, emergency routing changes, and policy retirement. Record max-age and any preload submission in the recovery plan so a future administrator does not assume switching the dashboard off immediately reverses prior browser policy. Prefer a staged rollout with a verified certificate-renewal process. Ask the recovery owner to review the longest retained policy interval and every child name before approving proxy removal or HTTPS retirement. Keep the zero-age delivery plan and any preload-removal work as separate checkpoints. A dashboard toggle alone should not close the recovery exercise.

Verification

Use controlled browser profiles to inspect the HTTPS header on the exact hostname and confirm valid TLS throughout the proposed recovery route. Rehearse zero max-age delivery where appropriate and account for clients that have not revisited. Verify child hostnames independently rather than assuming the parent site’s successful test covers them.

Official reference

Cloudflare — HTTP Strict Transport Security (HSTS). Reviewed October 20, 2026.