Fix ERR_TOO_MANY_REDIRECTS: find and break a redirect loop

What the error means

Each redirect tells the browser to request a different URL. When URL A sends it to B and B sends it back to A, the browser follows the circle until it reaches its limit, about 20 hops in most browsers. Then it stops and shows one of these:

• Chrome and Edge: "This page isn't working. example.com redirected you too many times." ERR_TOO_MANY_REDIRECTS
• Firefox: "The page isn't redirecting properly."
• Safari: "Too many redirects occurred trying to open the page."

Two quick checks first

Before you edit any config, rule out a stale cookie and look at the actual loop.

1. Open the page in a private window. If it loads there, an old cookie or cached redirect is the problem. Clear cookies for the site and try again.
2. Run the URL through the Redirect Checker. It lists every hop. Find the point where a URL repeats. The pattern tells you which cause below applies.

Cause 1: CDN set to Flexible SSL

In Flexible mode, Cloudflare and similar services talk to visitors over HTTPS but to your server over plain HTTP. Your server sees an HTTP request and redirects it to HTTPS. The CDN fetches that over HTTP again, and the circle repeats.

Fix

1. Make sure your server has a valid certificate. A free Let's Encrypt certificate is fine, and CloudPanel can issue one from the site's SSL/TLS page.
2. In Cloudflare, open SSL/TLS and change the encryption mode from Flexible to Full (strict).
3. Wait a minute, then check the URL again.

Cause 2: Wrong site address in your CMS

Apps like WordPress store their own address and redirect any request that does not match it. If the stored address is http://example.com while the server forces https://www.example.com, each side keeps sending the visitor to its own version.

Fix for WordPress

Set both addresses under Settings, General to the exact final URL. If you cannot reach the admin area, add these lines to wp-config.php, above the line that says to stop editing:

define( 'WP_HOME', 'https://www.example.com' );
define( 'WP_SITEURL', 'https://www.example.com' );

With shell access, you can change the stored values with WP-CLI instead:

wp option update home 'https://www.example.com'
wp option update siteurl 'https://www.example.com'

Cause 3: Server and app disagree about www

One rule adds www. and another removes it. This often happens after a move to a new host, when the new server config forces one version and an old .htaccess file or app setting forces the other.

Fix

Pick one version and enforce it in one place only, ideally the web server. Remove the opposite rule from the app or .htaccess. A single Nginx block that handles both HTTPS and www looks like this:

server {
    listen 80;
    listen 443 ssl;
    server_name example.com;
    # ssl_certificate lines go here
    return 301 https://www.example.com$request_uri;
}

For Apache, or for page-level rules, the .htaccess Redirect Generator writes the rules for you.

Cause 4: HTTPS not detected behind a proxy

When a load balancer, reverse proxy or Cloudflare Tunnel handles HTTPS, your app receives plain HTTP from it. If the app asks "is this request HTTPS?" the answer is always no, so it redirects again.

Fix

Have the proxy pass on the original scheme in a header, and tell the app to trust that header from the proxy.

proxy_set_header X-Forwarded-Proto $scheme;

if ( ( $_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '' ) === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

Confirm the fix

1. Run the Redirect Checker again. You want one redirect at most, ending on a page that returns 200.
2. Test all four versions: http://example.com, http://www.example.com, https://example.com and https://www.example.com. Each should reach the same final URL.
3. Open the site in a private window to make sure a cached redirect is not hiding a problem.

Questions