---
schema_version: "1"
id: 603aa99530482ebfd9626cd79cce1a153a7a6533dc951b6003fb7fbcbd49b1f6
title: Disable HSTS for an eCDN Zone
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_disable_hsts.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_disable_hsts.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: c0b9954b2cdf60f7f343678fc6ac26fdfd69c25c03ea889389989333c36093cd
description: Disabling HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone is a two-step process. You first let shoppers access your site over an insecure connection by setting the max age to 0, and then you stop your site from sending the HSTS header.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Disable HSTS for an eCDN Zone

Disabling HTTP Strict Transport Security (HSTS) for a B2C Commerce eCDN zone is a two-step process. You first let shoppers access your site over an insecure connection by setting the max age to 0, and then you stop your site from sending the HSTS header.

[Which Salesforce Commerce Product Do I Have?](https://help.salesforce.com/s/articleView?id=commerce.comm_what_product.htm&language=en_US)

If you simply disable the HSTS headers on your site, your site stops sending the HSTS requirement to browsers, but many browsers have likely already received a max age from your site. A browser doesn't check your site's header again until the max age expires, and the only time a browser checks your header is when you change the max age. So before you disable your site's HSTS headers, set the max age to 0, which lets customers access your site over an insecure connection. For background on the max-age mechanic, see [HTTP Strict Transport Security (HSTS) for eCDN](https://help.salesforce.com/s/articleView?id=cc.b2c_manage_hsts.htm&release=264.0.0&type=5 "HTTP Strict Transport Security (HSTS) secures your B2C Commerce site by instructing web browsers to access your domain using only HTTPS, which prevents downgrade attacks. You enable and disable HSTS per eCDN zone in Business Manager.").

The second step is to disable the HSTS headers. Before disabling, wait the longest period of time that you've ever set your max age. For example, on April 1 you set the max age to one month. On April 5 you changed it to one week. Wait until May 1, one month after April 1, before disabling the headers.

1. In Business Manager, click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Embedded CDN Settings**.
2. Locate your zone and select **Configure Zone** from the dropdown menu.
3. On the Crypto tab, set Max Age to 0.
    
    When the max age is 0, browsers drop the requirement that a connection is made over a secure connection.
4. Wait the longest period that you've set your max age before you disable the HSTS headers.
5. To disable the HSTS headers, click **Enabled** to turn it off.
6. Click **Confirm**.