Why does my .dev site require HTTPS, and can I turn it off?
Because Google, which runs the .dev registry, added the whole .dev TLD to the HSTS preload list in September 2017, and Chrome, Firefox, Safari and Edge all ship that list. Browsers force every .dev address onto HTTPS and refuse plain HTTP. You cannot turn it off; install a free TLS certificate from Let's Encrypt or your host.
Updated October 19, 2026 · 4 primary sources, listed below
How .dev became HTTPS-only
HSTS (HTTP Strict Transport Security) tells a browser to only ever connect to a site over HTTPS. Normally a site opts in with a response header. The preload list goes further: it is a list of domains compiled into the browser itself, so even the very first visit is forced to HTTPS.
On September 16, 2017 Chromium landed a change titled “Preload HSTS for the .dev gTLD”, putting the entire TLD, not individual sites, on the list. Domain Name Wire reported at the time that .google, .dev and .foo were preloaded. Firefox, Safari and Edge build from the same list. Google Registry’s .dev registration policy makes registrars tell every buyer that .dev is “an encrypted by default namespace” and that HTTPS is required “in order for domains to work in web browsers.”
Can you turn it off?
No. There is no registrar setting, DNS record or header that removes a single .dev site from a TLD-wide preload entry. Sending Strict-Transport-Security: max-age=0 only clears HSTS a browser learned from your own headers, not preloaded entries.
What to do instead
| Situation | Fix |
|---|---|
| Public .dev site shows a security error | Install a TLS certificate. Let’s Encrypt is free; Vercel, Netlify, Cloudflare and GitHub Pages issue one automatically. |
| Old local setup used myapp.dev and broke | Switch to .test or .localhost, reserved by RFC 6761 and never public, so not preloaded. |
| Need plain HTTP for an old device or API | Serve it from a non-preloaded domain (for example a .com subdomain); .dev cannot do it. |
| Same problem on .app or .page | Same cause: Google preloads its other TLDs too. Same fix. |
HTTPS-only is mostly a feature: no downgrade attacks and no mixed-content surprises. Compare .dev vs .app or read the full .dev review.
Common questions
Can I send an HSTS header with max-age=0 to disable it?
No. A max-age=0 header only clears HSTS a browser learned from your site's own headers. Preload entries ship inside the browser binary, and .dev is preloaded as a whole TLD, so there is no per-site removal.
My local dev setup used .dev and broke. What should I use?
Use a name that can never be a public domain: .test or .localhost, both reserved by RFC 6761. They are not on the preload list, so plain HTTP works locally.
Do other TLDs force HTTPS too?
Yes. Google preloads its other TLDs as well, including .app and .page. Any site on them needs a valid certificate before it will load.
Is HTTPS-only a downside?
Rarely. Most hosts (Vercel, Netlify, Cloudflare, GitHub Pages) issue certificates automatically. It only bites when you point a .dev at a server with no TLS, which simply won't load.
Sources
- Google Registry, “.dev registration policy (encrypted by default namespace)” (retrieved October 19, 2026).
- Chromium source, “Preload HSTS for the .dev gTLD (commit by Lucas Garron)” (September 16, 2017).
- Domain Name Wire, “Google adds its top level domains to HSTS preload list” (September 28, 2017).
- IETF RFC 6761, “Special-Use Domain Names (.test, .localhost reserved)” (February 1, 2013).
Extensions on this page
More straight answers
- Will using a non-.com domain hurt my Google rankings?
- Starting an app in Brazil: should you use .com.br or .com?
- Can I register a .de or .ca domain if I don't live in that country?
- Should I buy the .net and .co versions of my domain to protect my brand?
- Will emails from a .xyz or .io address go to spam?
- Is it risky to build my company on a .io domain because of the Chagos Islands deal?
- How much will a .ai domain cost over 5 years, including renewals?