Too Many Redirects: Finding the Loop in Under Ten Minutes

A redirect loop means two things disagree about where a URL should go, and each sends the browser back to the other. The browser gives up after roughly twenty hops. The fix is easy once you can see the chain, and almost impossible to guess at.

See the chain

curl -sIL https://example.com | grep -iE '^(HTTP|location)'

This prints every hop. Read it and the loop usually names itself — you will see two URLs alternating, and the difference between them is the cause.

What the chain shows	Cause
http ↔ https	SSL mismatch between WordPress and the server
www ↔ non-www	Two canonical rules disagreeing
with slash ↔ without slash	A rewrite rule fighting WordPress
/page ↔ /page	A plugin redirect pointing at itself
Loop only when logged in	A membership or role-based redirect

1. The SSL mismatch, which is most of them

WordPress thinks the site is HTTPS, the server thinks the request arrived as HTTP, so WordPress redirects to HTTPS, and the server strips it again. This is the classic Cloudflare Flexible SSL loop.

Two fixes, and you want both:

1. Set your CDN’s SSL mode to Full or Full (strict), never Flexible. Flexible means the CDN talks to your origin over plain HTTP, which is what creates the disagreement.
2. Tell WordPress to trust the forwarded protocol header.

// wp-config.php, above the “stop editing” line
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
     && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
    $_SERVER['HTTPS'] = 'on';
}

2. Conflicting www rules

One rule adds www, another removes it. Check all four places a redirect can live:

• .htaccess or the Nginx server block
• WordPress Settings → General (Site URL and Home URL)
• Your CDN’s page rules
• An SEO or redirect plugin

Pick one canonical form, set it in exactly one place, and remove the others.

3. Hard-code the URLs while you diagnose

If you cannot reach the admin, pin them in wp-config.php. This overrides the database and is the fastest way to break a loop:

define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

Remove these once you have fixed the real cause, or you will be confused in six months when changing the URL in Settings does nothing.

4. Disable plugins from the filesystem

mv wp-content/plugins wp-content/plugins-off

If the loop stops, a plugin is responsible. Move them back one at a time. Redirect plugins, SEO plugins, membership plugins and security plugins are the usual candidates.

5. The logged-in-only loop

If the site is fine logged out and loops logged in, the cause is role-based: a membership plugin redirecting non-subscribers, or a login redirect pointing at a page that itself requires login.

Common questions

Why does it work in a private window?

Because a permanent redirect was cached in your normal browser. Clear site data for the domain.

Can a redirect loop hurt SEO?

Yes, quickly. Crawlers abandon the URL. Fix it the same day.

Why did it start after I added Cloudflare?

Almost certainly Flexible SSL mode. Change it to Full.