Fix ERR_TOO_MANY_REDIRECTS in WordPress (Cloudflare, HTTPS & www Loops)

Chrome says "This page isn't working. example.com redirected you too many times." with the code ERR_TOO_MANY_REDIRECTS. Firefox calls it "The page isn't redirecting properly." Either way, your site is stuck in a loop, usually HTTP to HTTPS and back, or www to non-www and back. Here's how to see the loop and break it.

Step 1: See the loop for yourself

Don't guess. Look at the redirects with curl, which is built into Windows 10+, macOS and Linux:

curl -sIL --max-redirs 8 https://example.com/ | grep -iE "^(HTTP|location|server)"

You'll see each step of the chain:

HTTP/2 301
location: http://example.com/
server: cloudflare
HTTP/1.1 301 Moved Permanently
location: https://example.com/
server: cloudflare
...

The pattern tells you the cause:

• https → http → https: an SSL setting mismatch, usually Cloudflare's Flexible SSL (cause 1) or a proxy (cause 3).
• www → non-www → www: WordPress and the server or CDN disagree on the canonical domain (cause 2).
• Same URL redirecting to itself: a redirect plugin rule or an .htaccess rule (cause 4).

Also clear your browser's cookies for the site, or test in a private window. A stale cookie can cause a loop by itself, especially on login pages.

Cause 1: Cloudflare SSL set to "Flexible"

This is the most common cause. With Flexible SSL, Cloudflare talks to visitors over HTTPS but to your server over plain HTTP. Your server, or WordPress, sees an HTTP request and redirects to HTTPS. Cloudflare passes that redirect to the visitor, who requests HTTPS again, Cloudflare fetches over HTTP again, and the loop repeats.

Fix: in Cloudflare, go to SSL/TLS → Overview and set the mode to Full (strict). This requires a valid SSL certificate on your server. Most hosts offer free Let's Encrypt certificates, or you can install a free Cloudflare Origin Certificate. If you can't install a certificate yet, Full also stops the loop, but it doesn't validate the certificate, so treat it as temporary.

Cause 2: WordPress Address and Site Address mismatch

WordPress redirects every request to the URL stored in its settings. If those settings say http://www.example.com but your server or CDN forces https://example.com, they'll redirect each other forever.

Check the stored values with WP-CLI:

wp option get home
wp option get siteurl

Both should match exactly the URL you actually want, protocol and www included. Fix them with:

wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'

Without WP-CLI or admin access, you can force the values in wp-config.php, above the "stop editing" line:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Values in wp-config.php override the database. It's a reliable way to get back into the dashboard, but remember they're there: they'll override any later change made under Settings → General.

Cause 3: WordPress behind a proxy or load balancer doesn't know it's on HTTPS

Behind Cloudflare, a load balancer, Nginx in front of Apache, or a Docker setup, HTTPS often ends at the proxy. PHP then sees a plain HTTP request, is_ssl() returns false, and WordPress keeps redirecting to HTTPS.

The proxy normally passes the original protocol in the X-Forwarded-Proto header. Tell WordPress to trust it by adding this to wp-config.php, above the require_once ABSPATH . 'wp-settings.php'; line:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
    && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
    $_SERVER['HTTPS'] = 'on';
}

Only add this when your server actually sits behind a proxy that sets the header. On a normal setup it isn't needed.

Cause 4: Duplicate redirect rules in .htaccess or plugins

HTTPS or www redirects are often set up in three places at once: the host's control panel, .htaccess, and a plugin like Really Simple SSL or a redirect manager. If any two disagree, you get a loop.

1. Rename .htaccess to .htaccess-old and reload the site. If the loop stops, a rule in that file is the problem. Go to Settings → Permalinks and click Save to generate a clean default file, then re-add only the redirects you need.
2. Temporarily deactivate SSL and redirect plugins. Rename their folders in wp-content/plugins/ if you can't reach wp-admin.
3. Pick one place to handle the HTTPS and www redirect. I prefer the server or Cloudflare (a single redirect rule), since it's faster than letting PHP do it.

A correct HTTPS + non-www redirect for Apache .htaccess, placed above the WordPress block, looks like this:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]

Don't use this rule behind Cloudflare Flexible SSL or a proxy (causes 1 and 3), because %{HTTPS} will always be off there, and the rule itself becomes the loop.

Cause 5: Only wp-admin or the login page loops

If the front end works but logging in sends you back to the login page over and over, the login cookie isn't being saved or read:

• Clear cookies for the domain and try again.
• Make sure home and siteurl use the same domain (cause 2). The cookie is set for one domain and checked on the other.
• Exclude wp-login.php and /wp-admin/ from any page cache or Cloudflare "Cache Everything" rule.
• If you've defined COOKIE_DOMAIN in wp-config.php, check it matches the current domain, or remove it.

After it's fixed

Run the curl command from Step 1 against both http:// and www. versions of your URL. Each one should reach the final URL in a single 301 redirect. Then purge your caches (plugin, host and Cloudflare) so nobody gets a cached redirect.