Disabling HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone is a two-step process. You first let shoppers access your site over an insecure connection by setting the max age to 0, and then you stop your site from sending the HSTS header.
Which Salesforce Commerce Product Do I Have?
If you simply disable the HSTS headers on your site, your site stops sending the HSTS requirement to browsers, but many browsers have likely already received a max age from your site. A browser doesn't check your site's header again until the max age expires, and the only time a browser checks your header is when you change the max age. So before you disable your site's HSTS headers, set the max age to 0, which lets customers access your site over an insecure connection. For background on the max-age mechanic, see HTTP Strict Transport Security (HSTS) for eCDN.
The second step is to disable the HSTS headers. Before disabling, wait the longest period of time that you've ever set your max age. For example, on April 1 you set the max age to one month. On April 5 you changed it to one week. Wait until May 1, one month after April 1, before disabling the headers.
-
In Business Manager, click App Launcher
, and then select .
- Locate your zone and select Configure Zone from the dropdown menu.
-
On the Crypto tab, set Max Age to 0.
When the max age is 0, browsers drop the requirement that a connection is made over a secure connection.
- Wait the longest period that you've set your max age before you disable the HSTS headers.
- To disable the HSTS headers, click Enabled to turn it off.
- Click Confirm.