Troubleshooting guide
Cloudflare SSL Redirect Loop: How to Fix HTTPS Loops Safely
Troubleshoot Cloudflare SSL redirect loops caused by Flexible SSL, origin HTTPS redirects, WordPress settings, NGINX config and proxy modes.
CloudflareSSLredirect loopHTTPSDNS
What this problem usually means
A Cloudflare SSL redirect loop usually happens when Cloudflare and the origin server disagree about whether the request is HTTP or HTTPS. The common cause is Flexible SSL combined with origin-side HTTPS redirects.
Production caution: Switching SSL modes randomly can make the site unavailable. Confirm whether the origin has a valid certificate before moving to Full Strict.
Common symptoms
- Browser shows too many redirects
- Site works when Cloudflare proxy is disabled
- WordPress admin redirects repeatedly
- HTTP to HTTPS rules conflict with origin redirects
- Only some paths or subdomains loop
Common causes
- Cloudflare SSL mode set to Flexible while origin redirects to HTTPS
- WordPress site URL or proxy headers not handled correctly
- NGINX or Apache redirect rules conflict with Cloudflare rules
- Multiple page rules or bulk redirects overlap
- Origin certificate missing or invalid while Full Strict is enabled
Safe first checks
These checks are intended to help identify the direction of the issue. Always adjust paths, service names and commands for your environment.
Check response headers
curl -I https://example.comCheck Cloudflare SSL mode
Review SSL/TLS settings in Cloudflare dashboardCheck origin redirect config
grep -R "return 301\|rewrite\|HTTPS" /etc/nginx/ /etc/apache2/ -nCheck WordPress URLs
wp option get siteurl && wp option get homeTypical fixes
- Use Full or Full Strict with a valid origin certificate where possible
- Remove duplicate HTTP to HTTPS redirects
- Set correct proxy headers for WordPress/app frameworks
- Audit Cloudflare page rules and redirects
- Test one hostname at a time before applying broad rules
When to get help
Get help if the system is production-facing, customer data is involved, backups are uncertain, or the issue affects revenue, security or uptime. We can review the logs, confirm the cause and quote a fixed-scope fix where appropriate.
Need this fixed?
Get remote support for this issue.
Fixed technical support starts from $499. Emergency incident support is $199/hr with a minimum window.