Cloudflare Too Many Redirects? Fix the SSL Loop in Minutes

You turn on Cloudflare, or change one setting, and suddenly the site won’t load. Chrome shows ERR_TOO_MANY_REDIRECTS and “This page isn’t working. example.com redirected you too many times.” Firefox calls it “The page isn’t redirecting properly.” Sometimes the front end works and only /wp-admin/ loops.

The good news: the cause of the Cloudflare too many redirects error is nearly always one of four settings, and you can find the right one in a few minutes. On client sites we’ve seen it most often right after moving DNS to Cloudflare, when the default SSL mode meets a host that already forces HTTPS.

This guide shows you how the loop happens, how to confirm which layer is causing it, and the exact fix for WordPress, cPanel and other hosts.

Why Cloudflare causes a redirect loop

When Cloudflare’s proxy is on (the orange cloud in DNS), there are two connections, not one:

1. Visitor to CloudflareThe browser asks for https://example.com. This part is encrypted.
2. Cloudflare to your serverIn Flexible mode, Cloudflare requests http://example.com (no encryption).
3. Your server repliesIt sees an HTTP request and answers “301, go to https://example.com”.
4. Cloudflare passes it backThe browser follows the redirect to HTTPS, which lands at step 1 again.

The browser gives up after about 20 hops and shows ERR_TOO_MANY_REDIRECTS.

Cloudflare’s own troubleshooting page says it plainly: in Flexible mode, “redirect loops will occur if your origin server automatically redirects all HTTP requests to HTTPS.” Your server never sees HTTPS, so it keeps asking for it.

The reverse can happen too. In Full or Full (strict) mode, Cloudflare connects over HTTPS, and if your server forces everything back to HTTP, you get the same loop from the other direction.

Cloudflare SSL modes explained (Flexible vs Full vs Full strict)

Most loops come down to picking the wrong encryption mode, so it helps to know what each one does. You’ll find them in the Cloudflare dashboard under your domain, then SSL/TLS > Overview.

Cloudflare also offers Automatic SSL/TLS, which scans your origin (roughly monthly, per Cloudflare’s docs) and picks the most secure mode that works. It’s a sensible default for new sites, but if you’re mid-fix, choose a mode manually so you know exactly what’s set.

Step 1: Confirm where the loop is coming from

Before changing anything, spend one minute confirming the loop. It saves guessing.

Check the redirect chain

If you’re comfortable with a terminal, run this (it works on macOS, Linux and Windows 10/11):

curl -sIL --max-redirs 5 https://example.com

You’ll see each response’s status and Location header. If the same URL appears over and over with 301 or 302, and the Location keeps pointing at https://example.com/, it’s the Flexible SSL loop. If it bounces between http:// and https://, something is forcing HTTP.

No terminal? Open Chrome DevTools (F12), go to the Network tab, tick Preserve log, and reload. You’ll see the repeated 301s in a list.

Pause Cloudflare as a quick test

In the Cloudflare dashboard, open your domain’s Overview page and find Pause Cloudflare on Site. Wait a few minutes and test the site in a private window. If it loads fine without Cloudflare, the problem is the Cloudflare and server combination, not WordPress on its own. Remember to resume Cloudflare afterwards.

Step 2: Fix the SSL mode (the fix for most sites)

This is the fix for the majority of Cloudflare too many redirects errors.

1. Make sure your host has a valid SSL certificate for the domain. On cPanel, check Security > SSL/TLS Status. Most hosts issue a free one through AutoSSL or Let’s Encrypt.
2. In Cloudflare, go to your domain, then SSL/TLS > Overview.
3. Choose Full (strict). If your host only has a self-signed certificate, choose Full for now.
4. Save, wait a minute, then clear cookies for the site (or use a private window). Browsers cache 301 redirects, so an old loop can stick around after the fix.
5. Load the home page and /wp-admin/ to confirm both work.

Step 3: Stuck on Flexible? Stop the server forcing HTTPS

Some cheap hosts or old servers can’t serve HTTPS at all. If you must stay on Flexible, the server and WordPress need to stop redirecting to HTTPS themselves, and let Cloudflare do it.

Turn off host-level HTTPS redirects

• cPanel: go to Domains and switch off the Force HTTPS Redirect toggle for the domain.
• .htaccess: look for rules like RewriteCond %{HTTPS} off followed by RewriteRule ... https:// and comment them out. Take a backup of the file first.
• Plugins: SSL plugins and some security plugins add their own HTTPS redirect. Check their settings and turn that option off.

Tell WordPress the visitor is on HTTPS

WordPress decides whether a request is secure by looking at the server’s HTTPS flag. Behind Flexible SSL, that flag is always off. WordPress’s own documentation warns that behind a reverse proxy that handles SSL, forcing HTTPS “will initially send any requests into an infinite redirect loop.”

The official fix is to add this to wp-config.php, above the line that says /* That's all, stop editing! */:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] ) && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) { $_SERVER['HTTPS'] = 'on'; }

Cloudflare sends the X-Forwarded-Proto header with every proxied request, so WordPress now knows the visitor is really on HTTPS. We’ve added an isset() check to the WordPress.org example so it doesn’t throw a warning when the site is accessed directly without Cloudflare.

The Flexible SSL for CloudFlare plugin does the same job if you’d rather not edit files. It’s only needed for Flexible mode, and you should remove it once you move to Full.

Other causes: Always Use HTTPS, HSTS and redirect rules

If your SSL mode is already Full or Full (strict) and the loop continues, work through these.

Always Use HTTPS plus a server that forces HTTP

SSL/TLS > Edge Certificates > Always Use HTTPS sends every HTTP request to HTTPS. If your server or WordPress redirects HTTPS back to HTTP, you get a loop. Check Settings > General in WordPress: both WordPress Address (URL) and Site Address (URL) should start with https://. If they’re greyed out, they’re set by WP_HOME and WP_SITEURL in wp-config.php.

HSTS

HSTS tells browsers to only ever use HTTPS. If it’s on and your SSL mode is Off, or your server redirects to HTTP, the site will loop. Cloudflare’s advice is to keep the mode at Flexible or higher and remove any HTTP redirects on your server. Be careful turning HSTS off: browsers remember it for the max-age you set, so the change doesn’t take effect for returning visitors straight away.

Redirect Rules and Page Rules

Go to Rules in the Cloudflare dashboard and look at Redirect Rules and any old Page Rules. A rule that sends www to the root domain, combined with a WordPress setting that uses www, will bounce visitors back and forth forever. Make sure the rule and your WordPress Site Address agree on one version.

After the fix: clear caches

Redirects get cached in several places. Once the site loads in a private window, purge Cloudflare’s cache under Caching > Configuration > Purge Everything, then clear any WordPress caching plugin. Our guide to clearing WordPress and Elementor caches in the right order walks through each layer.

If you just moved DNS to Cloudflare, it’s also worth sending a test email from your contact form. MX records that were missed during the move are a common side effect, and our post on fixing WordPress contact form emails with SMTP covers how to test delivery properly.

Frequently asked questions

More step-by-step fixes are in our How-To & Fixes section.

Sources: Cloudflare Docs: ERR_TOO_MANY_REDIRECTS; Cloudflare Docs: Encryption modes; WordPress Developer Resources: HTTPS; cPanel Docs: Domains; WordPress.org: Flexible SSL for CloudFlare. Checked September 2026.

More in How-To & Fixes

How-To & Fixes

Squarespace Tax Not Showing at Checkout? 6 Fixes to Try

Squarespace tax not showing at checkout? Find the cause in your automated or manual setup, registrations or Include in price, and fix it in minutes.

Oct 21, 2026 · 9 min read

How-To & Fixes

WordPress REST API Returning Old Data? Fix the Cache

WordPress REST API returning old data? Find the cache serving stale JSON, then bypass /wp-json/ in Cloudflare, LiteSpeed or WP Rocket and purge it.

Oct 19, 2026 · 9 min read

How-To & Fixes

WooCommerce Showing Wrong Currency? 5 Fixes That Work

WooCommerce showing wrong currency? Find the setting, plugin, code snippet or cached page behind it and fix the symbol, prices and store location.

Oct 17, 2026 · 8 min read