Error REDIR · configuration

ERR_TOO_MANY_REDIRECTS

Ben Johnson · last verified 2026-08-02

Also seen as: redirect loop · The page isn't redirecting properly · too many redirects

What it actually means

Your browser asked for a page, was told to go somewhere else, asked for that, and was told to go back to where it started. After roughly 20 rounds of this it stops and shows you this error.

Almost every redirect loop on shared hosting comes from two systems both trying to enforce HTTPS or a canonical hostname, disagreeing about who won. The classic case: a proxy in front terminates TLS and forwards the request to your server as plain HTTP; your .htaccess sees plain HTTP, redirects to HTTPS; the proxy receives it, terminates TLS again, forwards as HTTP again. Forever.

Why it happens

Cloudflare Flexible SSL plus an HTTPS redirect on the server

This is the number one cause and it is worth checking first. In Cloudflare’s Flexible SSL mode, Cloudflare connects to your origin over plain HTTP no matter what the visitor used. Your server sees HTTP, redirects to HTTPS, and the loop is created.

The fix is to change the SSL mode, not to remove the redirect.

Competing www and non-www rules

One rule sends example.com to www.example.com; another sends www.example.com back. This happens when a redirect is configured in the control panel and separately in .htaccess, or when a WordPress plugin adds one on top of an existing rule.

WordPress site URL mismatch

If WP_HOME and WP_SITEURL disagree with the address you are actually visiting — for instance the database says http:// but you are on https:// — WordPress redirects you to its idea of the canonical URL on every request.

A stale redirect cached by the browser

A 301 is a permanent redirect and browsers cache it aggressively. Once you have fixed the underlying rule, your own browser may keep looping on the cached instruction, making a fixed site look broken.

How to fix it

1. Set Cloudflare SSL to Full (strict)

In the Cloudflare dashboard: SSL/TLS → Overview → Full (strict). This makes Cloudflare connect to your origin over HTTPS, so your server sees HTTPS and stops redirecting.

Full (strict) requires a valid certificate on the origin. If your host issues free certificates — most do — you already have one. Use Full only as a temporary step while a certificate is being issued, and never leave it on Flexible: it means the connection between Cloudflare and your server is unencrypted.

2. Trace the loop before changing anything

Do not guess at which rule is at fault. Watch the chain:

curl -sIL -o /dev/null -w '%{http_code} %{url_effective}\n' https://example.com/

Or see every hop in order:

curl -sI https://example.com/ | grep -i -E '^HTTP|^location'

The pair of URLs that repeat are the two rules fighting. That tells you exactly where to look.

3. Keep exactly one canonical redirect

Pick one host and one scheme, and enforce them in a single place. A correct, non-looping .htaccess rule that respects a proxy:

RewriteEngine On

# Force HTTPS, honouring X-Forwarded-Proto when behind a proxy
RewriteCond %{HTTPS} !=on
RewriteCond %{HTTP:X-Forwarded-Proto} !=https
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Force non-www
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]

The X-Forwarded-Proto condition is what breaks the Cloudflare loop: when a proxy has already handled TLS, the rule stops firing.

Then remove every other HTTPS or www redirect — from your control panel, from plugins, and from any wp-config.php overrides.

4. Fix the WordPress URLs directly

If you cannot log in to fix them through the admin, pin them in wp-config.php, which overrides the database:

define('WP_HOME',    'https://example.com');
define('WP_SITEURL', 'https://example.com');

No trailing slash. Both values must match what you type in the address bar exactly, including www or its absence.

5. Test in a private window

Cached 301s will keep showing you the loop after you have fixed it. Always confirm a fix in a fresh private window, or with curl, which caches nothing.

On CWP specifically

Related errors

• 403 403 Forbidden
  The server found what you asked for and refused to serve it — a permissions, index, or access-rule problem rather than a missing file.
• 500 500 Internal Server Error
  Something in your application or server configuration crashed, and the server is deliberately withholding the detail from visitors — the real message is in your error log.
• DNS DNS_PROBE_FINISHED_NXDOMAIN
  DNS has no record for this hostname at all — the browser never got as far as contacting a web server, so nothing about your hosting is involved yet.
• 404 404 Not Found
  The server is working and answered you — it just has nothing at the address you asked for.
• SSL ERR_SSL_PROTOCOL_ERROR
  The browser and server could not agree on how to encrypt the connection — usually because there is no certificate on that hostname yet.
• MIXED Mixed Content blocked
  Your page loaded over HTTPS but asks for images, scripts or styles over plain HTTP, so the browser blocks them or drops the padlock.
• WP WordPress login redirect loop
  You submit correct credentials, WordPress sends you back to the login page, and nothing tells you why.