ERR_TOO_MANY_REDIRECTS redirect loop

Symptoms

The browser shows "This page isn't working, example.com redirected you too many times" or ERR_TOO_MANY_REDIRECTS. The site bounces from one URL to another and back, forever, so it can never load. The loop is often new: it starts after enabling HTTPS redirect, adding a security plugin, or moving hosting.

Common causes

• HTTPS redirection conflicts with another redirection rule, so http redirects to https and https redirects back.
• A security plugin, "force www" rule, or "force non-www" rule fights the CMS settings.
• A canonical or redirect plugin double-applies the same redirect.
• Cloudflare or a CDN is set to Always Use HTTPS while the origin also forces HTTPS, and one of them refuses the connection type.
• A redirect at the web server level (.htaccess) loops with one at the application level.
• A cookie-based redirect: a cookie cannot be set, so the rule that depends on it keeps firing.

How to fix

1. Find the loop with a redirect tracer. Use a browser dev-tools network tab, curl -I, or a redirect chain checker and note each hop and its status code.
2. Remove just added rules first. If the loop began after enabling a plugin or a force-HTTPS toggle, that is the prime suspect. Disable it and retest.
3. Disable the site-wide redirection plugin temporarily. WordPress sites often inherit a generic "HTTPS full site" plugin from the hosting onboarding.
4. Fix the double HTTPS. If you use Cloudflare, it is usually enough to let Cloudflare handle the redirect to HTTPS and make sure your origin does not also force it. If both force it, one side must give: set Cloudflare Flexible with origin forcing HTTPS can loop, because the origin redirects the edge connection.
5. Reset the CMS site URL to a plain value and let one layer own redirection. In WordPress this is Settings, General, where WordPress Address and Site Address must match exactly, ideally the same scheme and host for both.
6. Inspect .htaccess or the server config for duplicate redirect blocks and remove the redundant one.
7. Check cookie-based rules. The login or language cookie failed to save, so the rule redirects every attempt.

Prevention

• Own redirection in exactly one layer: edge, web server, or application, not two.
• Keep the CMS site URL consistent between the WordPress address and the site address.
• After enabling a new redirect or security layer, test http, https, www, and the bare domain in one pass before moving on.