How to fix "too many redirects" (ERR_TOO_MANY_REDIRECTS)

Website errorsUpdated 29 October 20263 min read

Short answer: the page keeps sending the browser between two or more addresses until the browser gives up. As a visitor, clear cookies for the site and try again. As the site owner, the usual causes are a Cloudflare SSL mode set to Flexible while the server also forces HTTPS, WordPress address settings that don't match, and duplicate redirect rules in .htaccess or plugins.

For visitors: two quick checks

Delete cookies for that site only (browser settings → privacy → site data), then reload.
Open the page in a private window. If it works there, an old cookie was the cause.

If it still loops, the problem is on the website's side.

For site owners: find the loop

Look at the chain of redirects. Browser developer tools (Network tab, with "Preserve log" on) show each hop. Typical patterns:

Pattern you see	Likely cause
http → https → http → https	Proxy SSL mode and server HTTPS rules fight each other
www → non-www → www	Two places force opposite versions of the domain
/page → /page/ → /page	Trailing-slash rules from the server and the app disagree
/login → /dashboard → /login	Login cookie isn't being saved, often a domain or HTTPS mismatch

Fix 1: Cloudflare or another proxy

With Cloudflare's Flexible SSL mode, Cloudflare talks to your server over plain HTTP. If your server then redirects HTTP to HTTPS, you get a loop. Install an SSL certificate on the server (most hosts include a free one) and set Cloudflare to Full (strict).

Fix 2: WordPress site addresses

In Settings → General, the WordPress Address and Site Address must both use the same version, for example https://www.example.com. If you're locked out, set them in wp-config.php:

define('WP_HOME', 'https://www.example.com');
define('WP_SITEURL', 'https://www.example.com');

Fix 3: one place for each redirect

Pick one place to force HTTPS and one version of the domain, either the hosting panel, .htaccess, a plugin or the app, and remove the others. A clean .htaccess rule for HTTPS plus non-www looks like this:

RewriteEngine On
RewriteCond %{HTTPS} off [OR]
RewriteCond %{HTTP_HOST} ^www\. [NC]
RewriteRule ^ https://example.com%{REQUEST_URI} [L,R=301]

Behind a proxy, %{HTTPS} may always be "off". In that case, check %{HTTP:X-Forwarded-Proto} instead, or let the proxy handle HTTPS.

Fix 4: plugins and caches

Turn off redirect, SSL and cache plugins one at a time. Then purge every cache: plugin, server and CDN. Cached redirects can keep looping after you've fixed the rule.

After the fix

Test http://, https://, with and without www, in a private window. Each should reach the final address in one hop.
Update internal links to the final address so they don't depend on redirects.
Related: how to fix the "Not secure" warning and 404 errors and redirects.

Questions

Is "too many redirects" a virus?

No. It's a configuration problem: two rules sending the browser back and forth.

Why does it only happen on some devices?

Old cookies or cached redirects on those devices. Clearing site data usually fixes it there.

How many redirects is too many?

Browsers give up after about 20 hops. For speed and SEO, aim for at most one redirect between any old address and the final page.