How to Manage HSTS Security Settings and Secure HTTPS Connections?
Questions:
- Why does my online shop not open my current HTTP address?
- How do I fix a test address that is stuck on the secure version?
- Where do I find the HSTS policy settings in the TYRIOS dashboard?
Description:
What you notice: your shop refuses to open over the old, unsecured web address (http://) and always switches to the secure one (https://) with the padlock. On a test or staging address, it may feel "stuck" on the secure version.
Why this happens and why it's good: Your shop now insists on a secure, encrypted connection for every visitor. If anyone tries to reach it the old, unsafe way, the browser automatically upgrades them to the secure version. This is deliberate and it's a good thing:
- it protects your customers from snoopers on public WiFi,
- it stops criminals from tricking visitors onto a fake copy of your shop,
- and it's required for the top security grade and the trust the padlock gives your customers.
This is not a fault. A modern shop should always run securely. If a visitor ever sees a security warning, the right answer is to make sure your security certificate is valid — never to switch this protection off.
Solution:
Check if your test address is stuck on the secure version
This can happen because the visitor's own browser remembers the instruction for a while. Two things help:
-
Clear the browser's memory of it for that address.
The simplest way is to clear the browsing history / site data for that address, or use a fresh private/incognito window.
-
Setting up new test address
If you're setting up a brand-new test address that shouldn't commit to "secure forever" yet, ask your web agency to set a short duration in the settings and to leave the Preload option switched off until you go live.
Adjusting the settings (usually leave as-is)
These live under System Configuration → Security Configuration → HSTS policy
-
Configure HSTS Max Age - How long browsers remember the "always secure" rule (in seconds). The default is one year (31536000).
- Include sub domains — apply it to all your sub-addresses too
- Preload — strongest option; appropriate for live shops.
Tips and Tricks:
Pro-Tips:
⚠️ One caution for live shops: the strongest Preload option is hard to undo (it can take weeks and is outside our control). Only your developer should enable it, and only for a real production address that will stay secure.
For production shops you normally don't change anything here — the defaults are correct.
Warnings:
-
Do not enable the Preload option on staging or test environments before going live, as browsers will lock into the secure version for a long duration.
-
Avoid using unsecured web addresses because modern online shops require full encryption to protect customers from public network snooping and fake copies