When calling a test page without HTTPS on localhost I recently had the following phenomenon: http://localhost was redirected to https://localhost: The test page could no longer be displayed.

The cause is a page previously called with HSTS: The browser remembers the redirect and executes it consistently, even if the current test page does not use HSTS at all.

HSTS, what is it?

HSTS stands for HTTP Strict Transport Security and is a header that is delivered by the web server to tell the browser that from now on the page can only be called via HTTPS. Usually a relatively long time span of several months is given as expiration date. Within the time span, the browser is supposed to redirect HTTP to HTTPS, even if the header is no longer delivered.

(look into the Chrome developer tools key F12)

Delete domain security policies

The following hidden URL can be used to delete the HSTS cache:

chrome://net-internals/#hsts