ERR_TOO_MANY_REDIRECTS: how to find and break a redirect loop

02How do I see the redirect loop?

Use curl, which caches nothing and prints every hop. The first command lists the status line and Location header of each response; the second prints how far curl got. curl exits with code 47 when it reaches the limit you set.

The trace has one of two shapes. If the Location is the URL you just requested, the server does not see the request the way the browser sent it, almost always the scheme behind a proxy. If two Locations take turns, two rules disagree, typically www against the bare domain, or HTTP against HTTPS.

$ curl -sIL --max-redirs 5 https://example.test/ | grep -iE '^(HTTP|location)'
HTTP/1.1 301 Moved Permanently
Location: https://example.test/
HTTP/1.1 301 Moved Permanently
Location: https://example.test/
# ... the same pair four more times

$ curl -s -o /dev/null -L --max-redirs 5 -w '%{num_redirects} redirects, last %{http_code} to %{redirect_url}\n' https://example.test/; echo "exit $?"
5 redirects, last 301 to https://example.test/
exit 47

# a www ping-pong looks different: two Locations take turns
Location: https://www.example.test/
Location: https://example.test/
Location: https://www.example.test/

03What causes too many redirects?

Most redirect loops follow one of six patterns, and the trace usually shows which within seconds.

04Why redirect loops happen behind a CDN or reverse proxy

The classic loop after putting a site behind a CDN or reverse proxy runs in four steps. It was reproduced exactly with nginx on both sides for the trace above.

• 1. The browser requests https://example.com/ from the edge, which terminates TLS.
• 2. The edge forwards the request to the origin over plain HTTP on port 80.
• 3. The origin sees an HTTP request, applies its rule to always use HTTPS, and answers 301 to https://example.com/.
• 4. The edge passes the 301 back, the browser requests the same URL again, and the cycle repeats until Chrome stops at 20.

# on the proxy
location / {
    proxy_pass http://203.0.113.10;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
}

# on the origin
server {
    listen 80;
    server_name example.com;
    if ($http_x_forwarded_proto = "http") {
        return 301 https://$host$request_uri;
    }
    root /var/www/example;
}

05How to fix too many redirects in WordPress

WordPress stores two addresses, home and siteurl, and redirects requests that arrive under another address. If either still says http:// or the wrong host after a move to HTTPS or behind a proxy, WordPress and the server can redirect each other indefinitely. Both must match the canonical URL exactly, scheme and www included.

Behind a proxy that terminates TLS, WordPress also needs to know the original request was HTTPS. The WordPress handbook warns that, without this, its HTTPS-forcing options on a site behind an SSL-providing reverse proxy "will initially send any requests into an infinite redirect loop", and gives a wp-config.php fix based on X-Forwarded-Proto. If the loop persists, disable redirect and SSL plugins by renaming their folders in wp-content/plugins, then re-enable them one by one. The WordPress WAF guide covers running WordPress behind a proxy safely.

// wp-config.php, above the "stop editing" comment
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
    && strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
    $_SERVER['HTTPS'] = 'on';
}
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );

# or read and correct the stored values with WP-CLI
wp option get home
wp option get siteurl
wp option update home 'https://example.com'
wp option update siteurl 'https://example.com'

06How to fix ERR_TOO_MANY_REDIRECTS as a visitor

If the loop comes from the site's configuration, only the owner can fix it, but two causes do live in the browser: a stale cookie and a cached redirect. Firefox's own error page notes that the problem "can sometimes be caused by disabling or refusing to accept cookies".

• Delete the cookies and site data for that one site, from the site information icon left of the address or in Chrome's site settings, then reload.
• Open the page in a private window. If it loads there, the cause is a cookie, a cached redirect or an extension.
• Turn off extensions that rewrite or upgrade URLs, such as HTTPS-only or privacy tools, and retry.
• Allow cookies for the site if you block them; login pages often redirect until a cookie can be set.
• If it fails on every device and network, tell the site owner, with the exact URL.

07Server-side checks, in order

Find which layer issues each redirect before changing anything; the Server and Via headers of each hop in the full curl -sIL output often name it. Then work from the outside in.

• Check the CDN or proxy first: forced-HTTPS settings, redirect rules, and the mode it uses to reach the origin.
• Then the web server: nginx return and rewrite lines, and Apache RewriteRule lines in the configuration or .htaccess.
• On Apache behind a TLS-terminating proxy, RewriteCond %{HTTPS} off is always true, because Apache only sees HTTP; test RewriteCond %{HTTP:X-Forwarded-Proto} !https instead.
• Then the application: the site URL setting, framework options that trust proxy headers, and redirect plugins.
• After the fix, purge the CDN cache and retest with curl. RFC 9110 lets clients cache a 301, so a browser may keep looping until its cache is cleared.

08What a reverse proxy can and cannot do about redirect loops

A proxy or CDN can remove the most common loop entirely. It can redirect HTTP to HTTPS at the edge, so the origin needs no redirect of its own, pass X-Forwarded-Proto to the origin, and encrypt the origin connection so the origin sees HTTPS natively.

It cannot fix rules it does not own. A WordPress site URL set to http://, a plugin that forces a different host, a cookie the application never manages to set, or a 301 already cached in a visitor's browser keep looping however the edge is configured. The lasting fix is to make exactly one layer responsible for each redirect.