Redirect loops
WordPress ERR_TOO_MANY_REDIRECTS
A loop is two systems disagreeing about the canonical URL. Cloudflare Flexible SSL versus WordPress forcing HTTPS is the classic public case. A hop list tells you the pattern. It does not always name the plugin.
Direct answer
The browser stops when it sees the same URL cycle, often HTTP ↔ HTTPS or www ↔ non-www. WordPress stores home and siteurl. The host, CDN, and a redirect plugin each add their own 301. If Cloudflare terminates TLS as Flexible, the origin still sees HTTP. WordPress then 301s to HTTPS. Cloudflare sends HTTP to origin again. That is a loop. We call it a possible Cloudflare/WordPress HTTPS conflict, not a proven Flexible setting, unless you can see the dashboard.
Diagnostic sequence
- Run the free WordPress Redirect and HTTPS diagnostic. Read every hop status. A loop is visible as a repeated URL.
- Compare
homeandsiteurlin the database (or wp-config overrides) with the URL you typed. Mixed http/https here is enough. - If you use Cloudflare, Full (strict) plus a valid origin cert is the usual alignment. Flexible plus a WordPress “force SSL” plugin is the usual conflict.
- Rank Math, Redirection, and server rewrite rules can stack. Disable one layer at a time on staging, not all of them on a live site with no backup.
- A cookie or HTTPS plugin that redirects based on
X-Forwarded-Protocan loop if the proxy does not send that header. The public hop list will not prove the missing header. It can only show the bounce.
What not to do
- Do not add another redirect plugin on top of a loop.
- Do not change siteurl in the database without a backup.
- Do not assume “too many redirects” is malware. Check the hop list first. Malware redirects usually leave the hostname.