ERR_TOO_MANY_REDIRECTS: find the loop and fix it

The browser gave up because the site kept sending it somewhere else, and that somewhere sent it back. The loop is almost always two rules that disagree, and one command shows you both.

What the browser is telling you

Chrome shows This page isn’t working: example.com redirected you too many times. ERR_TOO_MANY_REDIRECTS; Firefox says The page isn’t redirecting properly; Safari says Too many redirects occurred. Each browser follows about 20 redirects in a row, then stops. Nothing is “down”: every response is a valid 301, 302, 307 or 308 (what each redirect code means), they just form a circle.

See the loop

curl -sIL --max-redirs 10 https://example.com/ | grep -iE "^(HTTP|location)"

HTTP/2 301
location: https://example.com/
HTTP/2 301
location: https://example.com/
...

Read the location lines. The pattern tells you the cause:

If curl shows no loop but the browser still does, it’s probably cookies or a cached 301: try a private window, or clear the site’s cookies and cache. Browsers remember 301s and 308s hard.

Cloudflare Flexible SSL (the classic)

With Flexible, Cloudflare talks to your server over plain HTTP. Your server sees http, redirects to https, the visitor comes back through Cloudflare, which again talks http to your server… forever. Fix: install a certificate on the origin (a free Cloudflare Origin Certificate is fine) and set SSL/TLS to Full (strict). Also check you don’t have both “Always Use HTTPS” and a redirect rule pointing the other way.

Behind a load balancer or reverse proxy

TLS ends at the proxy, so the app receives plain HTTP and thinks it must redirect. Make the proxy send X-Forwarded-Proto: https and tell the app to trust it:

# nginx in front of the app
proxy_set_header X-Forwarded-Proto $scheme;

# Express
app.set('trust proxy', 1);

# Django settings.py
SECURE_PROXY_SSL_HEADER = ("HTTP_X_FORWARDED_PROTO", "https")

# Flask
from werkzeug.middleware.proxy_fix import ProxyFix
app.wsgi_app = ProxyFix(app.wsgi_app, x_proto=1, x_host=1)

# Rails config/environments/production.rb
config.assume_ssl = true   # with config.force_ssl = true

WordPress

• Settings, General: WordPress Address and Site Address must both be the same scheme and host (both https://www.… or both without www). If you’re locked out, set them in wp-config.php with define('WP_HOME', 'https://example.com'); and define('WP_SITEURL', 'https://example.com');.
• Behind a proxy or Cloudflare, add if (($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '') === 'https') $_SERVER['HTTPS'] = 'on'; near the top of wp-config.php.
• Temporarily rename the plugins folder to rule out an SSL or redirect plugin fighting the server.

nginx and .htaccess rules

Redirect only when the request really is http, and keep the HTTPS server block free of the redirect:

server { listen 80;  server_name example.com www.example.com;
         return 301 https://example.com$request_uri; }
server { listen 443 ssl; server_name www.example.com;
         return 301 https://example.com$request_uri; }
server { listen 443 ssl; server_name example.com;  # the real site, no redirect here
         ... }

Pick one canonical host and one trailing-slash style, and make every layer (CDN, server, app) agree with it. A quick way to compare long redirect URLs that differ only in encoding is to paste them into the URL encoder/decoder. If the browser never connects because DNS fails, that is ERR_NAME_NOT_RESOLVED, not a redirect loop; TLS confusion after a bad redirect is covered in ERR_SSL_PROTOCOL_ERROR.

Related

download won't resume

Questions

Published 4 November 2026.