Table of contents24
Your site loads, then the browser stops and shows “too many redirects” — in Chrome it reads ERR_TOO_MANY_REDIRECTS, in Firefox “The page isn’t redirecting properly”. Your site is not down. It is stuck in a loop: one address sends the browser to a second address, and the second sends it straight back. After about 20 trips round that circle the browser gives up. The fix is almost always one setting that disagrees with another, and you can find it in minutes if you check the layers in order.
Contents
- What a redirect loop actually is
- What causes it in WordPress
- Fix it in order: 10 steps
- After a migration
- Post-fix checklist
- FAQs
What a redirect loop actually is
A redirect is a normal instruction: a server tells the browser “this page has moved, go here instead”. A loop happens when two instructions contradict each other. Page A says go to page B, page B says go back to page A, and neither ever says stop. The browser follows the chain, counts the hops, and after roughly 20 redirects it shows the error instead of your site.
The error page never tells you which setting is wrong. That is why the first real step is tracing the chain — seeing the actual addresses the browser is bounced between tells you which layer is looping.
What causes it in WordPress
| Cause | Common sign | Where to fix it |
|---|---|---|
| Cloudflare on Flexible SSL while the host forces HTTPS | It started right after you added Cloudflare | Cloudflare SSL/TLS mode |
| WordPress Address and Site Address do not match | It started after a URL change or migration | Settings > General, or wp-config.php |
| HTTPS forced in two places at once | It started after adding an SSL plugin or a host HTTPS switch | Keep one HTTPS switch on |
| A bad rule in .htaccess | It started after editing .htaccess or a security plugin | Reset .htaccess to the WordPress default |
| A plugin forcing redirects | It started after installing or updating a plugin | Deactivate plugins one by one |
| Your browser’s stale cookies or cache | Only your browser shows it; other devices load fine | Clear this site’s cookies and cache |
| A proxy hiding HTTPS from WordPress | The site sits behind a proxy or load balancer | wp-config.php X-Forwarded-Proto fix |
Fix it in order: 10 steps
Before you change any file, make a full backup — files and database. Every fix below is reversible, but a backup is what makes “reversible” true.
Step 1: Rule out your own browser
Open the site in a private window. If it loads there, the loop is in your browser, not your site: clear cookies and cached data for this one domain only, then hard-refresh. If the site loads on your phone but not your laptop, the same applies — the server is fine, your browser is following a stale chain.
Step 2: Trace the redirect chain
You need to see the actual hops. A free redirect checker (for example httpstatus.io) shows each hop: the address requested, the status code, and the next address. If the chain shows the same two addresses repeating — for example http://example.com to https://example.com and back — you know the loop is between HTTP and HTTPS. If it shows /wp-admin/ bouncing to /wp-login.php/ and back, the loop is in the login area, and Step 9 applies.
If you have a terminal, the same trace is one command:
curl -sIL --max-redirs 10 https://example.com/Replace example.com with your own domain. The output lists each hop until the chain ends or the limit is reached.
Step 3: Make WordPress Address and Site Address match
In your dashboard, go to Settings > General. WordPress Address (URL) and Site Address (URL) must be identical: same https, same www choice, no slash at the end. If one says http://example.com and the other says https://www.example.com, WordPress redirects between them forever.
If you are locked out of the dashboard, set both in wp-config.php, above the line that says “That’s all, stop editing!”:
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );Use your real domain, and use the same value in both lines. To undo, delete the two lines.
Step 4: Fix the Cloudflare SSL mode
This is the single most common cause on sites behind Cloudflare. In Flexible mode, Cloudflare talks to your server over plain HTTP. If your server — or an SSL plugin — redirects every HTTP request to HTTPS, Cloudflare receives that redirect, passes it to the browser, the browser asks again over HTTPS, and the cycle repeats.
In the Cloudflare dashboard, go to SSL/TLS and set the mode to Full (strict) if your server has a valid certificate — most hosts provide a free one — or Full if your origin certificate is self-signed. Then purge the cache for your homepage. Flexible mode should not be used when the origin forces HTTPS.
Step 5: Force HTTPS in one place only
Check every layer that can force HTTPS: Cloudflare, your host panel, an SSL plugin, and .htaccess. Keep exactly one of them on and turn the others off. Two HTTPS switches that both redirect are the classic way to build a loop without touching a single setting twice — each layer is correct on its own, and wrong together.
Step 6: Tell WordPress it is behind a proxy
If your site sits behind a proxy or load balancer, WordPress may never see that the visitor arrived over HTTPS, so it keeps redirecting to HTTPS while the proxy keeps sending plain HTTP. Add this to wp-config.php, above the “That’s all, stop editing!” line:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
$_SERVER['HTTPS'] = 'on';
}This only applies when your proxy actually sends the X-Forwarded-Proto header, which Cloudflare and most load balancers do.
Step 7: Reset .htaccess to the WordPress default
A single bad rewrite rule in .htaccess can loop every request. Using your host’s File Manager or FTP, rename .htaccess to .htaccess_old and load the site. If the loop is gone, the file was the cause. Then rebuild a clean one: in the dashboard, go to Settings > Permalinks and press Save Changes — WordPress writes a fresh default .htaccess. To undo, rename the old file back.
The WordPress default looks like this:
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPressDo not add redirect rules above this block unless you know exactly what they do — rules above it run first.
Step 8: Deactivate your plugins
Redirect, SSL and SEO plugins are the usual suspects, but any plugin can cause a loop. If you can reach the dashboard, deactivate all plugins, check the site, then reactivate them one at a time until the loop returns — the last one reactivated is the cause.
If you are locked out, rename the plugins folder in wp-content to plugins_old using File Manager or FTP. That deactivates every plugin at once. Load the site: if it works, rename the folder back to plugins and reactivate one plugin at a time from the dashboard.
Step 9: If only wp-admin loops
When the front of the site loads but /wp-admin/ loops, the cause is usually the same address mismatch from Step 3 — the login page redirects to an address that redirects back — or a security plugin forcing HTTPS or a login redirect. Fix the two addresses first, then deactivate plugins as in Step 8. If the loop started right after a security plugin was set up, its HTTPS or login-redirect setting is the first place to look.
Step 10: Clear every cache, then test again
Caches remember the loop. After the fix, clear the WordPress cache, the server cache in your host panel, and any CDN cache, then test in a private window. If you only clear the browser cache, a server or CDN cache can keep serving the old redirect chain and make a fixed site look broken.
After a migration
A loop that appears right after moving hosts or changing domains is almost always Step 3: the old domain is still stored somewhere. Check both addresses in Settings > General, check wp-config.php for WP_HOME and WP_SITEURL lines pointing at the old domain, and check the database’s siteurl and home values if you can reach them. Fix the addresses, clear every cache from Step 10, and re-test before touching plugins or .htaccess.
Post-fix checklist
- The homepage loads in a private window with no error.
- The homepage loads on a second device or browser.
- /wp-admin/ opens and you can log in.
- The redirect checker shows one hop at most — direct to the final address, no repeated pair.
- WordPress Address and Site Address match exactly.
- Only one layer forces HTTPS.
- .htaccess is the WordPress default, or contains only rules you can explain.
- All plugins are reactivated except the one that caused the loop, if you found one.
- Every cache is cleared: browser, WordPress, server, CDN.
FAQs
Why does the error say “too many redirects” instead of naming the cause?
Because the browser only sees the chain, not the settings behind it. It counts the hops and stops after about 20. The cause is always in the settings that issued those redirects, which is why tracing the chain is the first real step.
Can a redirect loop lock me out of wp-admin?
Yes. If the loop covers the login page, you cannot reach the dashboard to fix it. Steps 3, 7 and 8 are written to work without dashboard access — wp-config.php, .htaccess and the plugins folder are all reachable through your host’s File Manager or FTP.
Is Cloudflare Flexible SSL ever the right choice?
Only when your server has no certificate at all and cannot get one. If your host forces HTTPS or you have a valid certificate, Flexible creates the exact loop described in Step 4. Full (strict) is the correct mode once the origin has a valid certificate.
I fixed the setting but the error is still there. Why?
Stale cache. Your browser, the WordPress cache, the server cache or the CDN may still be serving the old redirect chain. Clear all four, then test in a private window. If it still loops, trace the chain again — the hops will show whether the same pair is still repeating or a different layer has taken over.
Can a plugin update cause this overnight?
Yes. An update to a redirect, SSL, SEO or security plugin can add a redirect rule that conflicts with one you already had. If the loop started the morning after an update, Step 8 — deactivate, then reactivate one at a time — finds it fast.
Does a redirect loop hurt my search rankings?
While the loop is live, search engines cannot load the page, so the page cannot be crawled or shown properly. Fix it first, then check that the page loads cleanly — the loop itself is the problem, not a penalty. No ranking promise is made here; a working page is simply crawlable again.
Keep learning
If this fixed your loop, these guides cover the errors that usually come next: Can’t Log In to WordPress Admin? How to Fix It walks through login failures step by step; WordPress White Screen of Death: How to Diagnose It and Fix It Step by Step covers the blank-screen error; Error Establishing a Database Connection in WordPress: How to Diagnose It and Fix It covers the database error; What to Do When WordPress Gets Stuck in Maintenance Mode covers the maintenance-mode lock; and How to Clear WordPress Cache: Every Method That Works shows every cache-clearing method in one place. For the settings behind this fix, see The Safe WordPress Update Checklist: Before and After, How to Install WordPress Plugins Safely: Full Guide, Troubleshoot WordPress Plugin Conflicts, Secure wp-config.php: The Complete Guide, Why Caching Breaks Your WordPress Site — and the Fix, and WordPress Not Sending Emails: How to Diagnose It and Fix It Step by Step.
