When a site shows "too many redirects", the usual advice is to clear your cookies. I went through 165 public threads where someone hit this error and the cause was confirmed, and clearing cookies fixed just 4 of them. In 65, about 4 in 10, the cause was the same mistake: HTTPS handled in two places that can't see each other, so each one keeps sending the browser to the other.
The threads come from Cloudflare Community, WordPress.org, Stack Overflow and the forums of hosts and site builders such as Netlify, Webflow and Ghost, from 2013 to 2026. I only counted a thread when the person confirmed the fix worked or an accepted answer named the cause.
Below is what the error means, what caused those 165 loops, how to tell which layer your loop is in from the addresses it bounces between, and the fix for each.
What the too many redirects error means
A redirect is a site telling the browser "this page lives at another address, go there". A loop happens when two rules undo each other: one sends the browser from A to B, the other from B back to A. The browser follows along until it hits its limit. Chrome and Firefox give up after 20 redirects, the limit set by the web's Fetch standard, and show one of these messages:
- Chrome and Edge: "This page isn't working. yoursite.com redirected you too many times." with ERR_TOO_MANY_REDIRECTS
- Safari: "Safari can't open the page. Too many redirects occurred trying to open..."
- Firefox: "The page isn't redirecting properly"
If you're only visiting the site: reload once, then delete the cookies and site data for just that site and try again, or open it in a private window. In Chrome, click the icon to the left of the address and open the site's cookies and site data. In Safari on iPhone, go to Settings, Safari (under Apps on newer iOS), Advanced, Website Data, and remove the site. If it still fails, the problem is on the site's side, and the rest of this post is for its owner.
What causes too many redirects: 165 confirmed cases
The two red bars are the same mistake in different places: HTTPS handled twice. Browser cookies, the usual first suggestion, fixed 4.
Cloudflare's own forum is a quarter of the sample, which inflates the Cloudflare causes. But outside that forum the same mistake still leads: Flexible SSL in 14 threads, and HTTPS hidden by a proxy or load balancer in 22 more.
The pattern behind the top two is worth understanding, because it explains most loops. Your visitor's connection is secure up to some middle layer, such as Cloudflare, a load balancer or a reverse proxy, and that layer talks to your server over plain http. Your server sees an http request, redirects it to https, and the middle layer passes that redirect back to the browser, which asks again over https. Round and round, 20 times.
Find the loop from the addresses it bounces between
Before changing settings, look at the actual hops. Paste the address into the redirect checker, which follows each redirect and stops at the loop, or run curl -IL https://yoursite.com in a terminal. Where the addresses bounce tells you which layer is to blame:
| The hops look like | Usual cause |
|---|---|
| The same https address, over and over | HTTPS handled twice: Cloudflare Flexible, a proxy or load balancer, or a tunnel connecting over http |
| yoursite.com to www.yoursite.com and back | Two layers disagree on www: host or site builder settings against Cloudflare, the server or the CMS |
| /page to /page/ and back | Trailing slash rules: the framework adds the slash and the host or proxy strips it |
| /en to / and back, or between language subdomains | A language redirect that also runs on the address it redirects to |
| /dashboard to /login and back | Login or middleware: the session is not seen, or the login page runs the same check |
| One address redirecting to itself | A rule matching its own target, such as a too-broad redirect plugin rule |
If the loop only happens for you and not in a private window or on your phone, it is the rare cookie case. Otherwise it is in the site's settings, and the fixes below follow the order of how often each cause came up.
How to fix too many redirects, cause by cause
Cloudflare SSL mode set to Flexible (40 cases)
In Cloudflare, open SSL/TLS and change the encryption mode from Flexible to Full (strict), or Full if your server only has a self-signed certificate. That makes Cloudflare connect to your server over https, so the server stops redirecting. Cloudflare's troubleshooting guide covers the same fix. Check it even if you never picked Flexible: in three of the threads, Cloudflare's Automatic setting had chosen it.
HTTPS hidden by a proxy or load balancer (25 cases)
This is the same loop without Cloudflare: an AWS load balancer, Heroku's router, nginx in front of Apache, a Docker proxy or a Kubernetes ingress handles https and passes plain http to your app. The fix is to let the app trust the X-Forwarded-Proto header that the proxy sets:
-
WordPress: add the snippet from WordPress's HTTPS guide to wp-config.php, which sets
$_SERVER['HTTPS'] = 'on'when the header says https. -
Django: set
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https"), with the HTTP_ prefix, which one thread missed. -
Express: call
app.set('trust proxy', 1)and checkreq.secure, not the raw protocol, which is always http behind Heroku. -
nginx in front of another app: pass
proxy_set_header X-Forwarded-Proto httpswhen an outer proxy already handled https, because$schemewill be http there.
Three of these cases were a Cloudflare Tunnel pointed at http://localhost while the server forced https. Point the tunnel at the https port instead, or stop redirecting on the server; my guide to exposing a local API with Cloudflare Tunnel shows the setup.
A WordPress plugin (24 cases)
SEO, redirect, security, membership and caching plugins all add redirects. Yoast SEO came up in 6 threads, half of them its option to remove the category base from URLs; the Redirection plugin looped when a rule matched its own new address. If you can't reach the dashboard, rename the plugin's folder in wp-content/plugins to turn it off, then turn plugins back on one at a time. Security plugins can leave rules in .htaccess that keep looping after they are removed, so check that file too.
Domain settings on the host or site builder (15 cases)
Site builders and hosts pick one address as the main one and redirect the rest to it. In 5 of the Webflow threads, Webflow's default domain was the bare domain while the DNS was set up for www, and making the www address the default fixed it. Netlify and Google Sites looped when their DNS records were switched to Proxied in Cloudflare; setting them to DNS only fixed it. Most of the rest were DNS records pointing somewhere other than the host, such as a Shopify store whose A record did not point to Shopify, or registrar forwarding left on for a Bubble app.
Trailing slash, language and login loops (23 cases)
These are rules in the app itself. A language redirect has to skip addresses that already have the language; a trailing slash rule has to agree with what the host does to the URL; and login middleware must not run on the login page, static files or the page it sends users to. In Next.js, use the middleware matcher to exclude those paths. When a login loop only happens in production, check that the session cookie and the app's base URL use the same host, including www.
Server rules, site address and www conflicts (25 cases)
In WordPress, the WordPress Address and Site Address under Settings, General must match the real address exactly; two threads were fixed by removing capital letters from them. Then make sure only one layer decides between www and the bare domain and between http and https: the host, a Cloudflare redirect rule, .htaccess or nginx, not two of them. Four of the loops came from Cloudflare redirect rules, so check Rules in the Cloudflare dashboard too.
How to stop redirect loops from coming back
- Decide one final address, such as https://www.yoursite.com, and write it down.
- Let one layer do each redirect. If Cloudflare forces https, the server doesn't need to; if the host picks www, nothing else should.
- Test after every change to DNS, SSL, plugins or hosting: the redirect checker tests http, https, www and the bare domain at once, and all four should reach the final address in one hop.
More on domains, SSL and hosting is in Launch and hosting. And if you'd rather hand it over, I fix redirect loops and run domain and hosting moves as client projects. Email me the site address and where it is hosted.
Common questions
What does "too many redirects" mean?
The site kept telling the browser to go to another address, which sent it back again, until the browser gave up. Chrome and Firefox stop after 20 redirects, the limit set by the web's Fetch standard. It is almost always a problem with the site, not your device.
How do I fix too many redirects in Safari or Chrome?
Reload once, then delete the cookies and site data for just that site and try again, or open it in a private window. In Safari on iPhone that is Settings, Safari (under Apps on newer iOS), Advanced, Website Data. If it still fails, the site itself is broken and only its owner can fix it.
Does clearing cookies fix too many redirects?
Rarely. In 165 cases where the cause was confirmed, clearing cookies or cache was the fix in only 4, all visitors to sites like Amazon, Gmail and Yahoo. In the other 161 the loop was in the site's own settings.
Why does Cloudflare cause too many redirects?
With the SSL/TLS mode set to Flexible, Cloudflare connects to your server over plain http. If the server redirects http to https, Cloudflare passes that back to the browser, which asks again over https, and the loop never ends. Switch the mode to Full (strict).
How do I fix too many redirects in WordPress?
Check Cloudflare's SSL mode first, then make the WordPress Address and Site Address match your real address exactly, including https and www. If the loop started after installing or changing a plugin, rename its folder in wp-content/plugins to turn it off.
How many redirects is too many?
Browsers give up at 20, but a healthy address needs at most one: from http or www straight to the final https address. Google's crawlers follow up to 10 hops, and every extra hop slows the page down.
This post first appeared on tusharbhendarkar.com. I write about the engineering behind what I ship. If something here is broken for you, email me at [email protected].
Top comments (0)