The fastest fix is usually to stop using Flexible SSL. If WordPress or your web server redirects every HTTP request to HTTPS, Flexible mode creates a loop: the visitor connects to Cloudflare over HTTPS, Cloudflare connects to the origin over HTTP, and the origin keeps sending Cloudflare back to HTTPS. In Cloudflare, open SSL/TLS → Overview and select Full or Full (strict), then make sure the origin really serves HTTPS on port 443.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
After changing the mode, remove duplicate HTTP-to-HTTPS rules from WordPress, the origin server, Cloudflare Redirect Rules or Page Rules, Always Use HTTPS, and HSTS. Keep one deliberate redirect policy. The sections below show how to identify the layer issuing each redirect, choose the correct encryption mode, and resolve the related 521 and 526 errors.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What causes the loop
A redirect loop is not a single Cloudflare bug. It is a disagreement about whether the request is HTTP or HTTPS. The browser asks for an HTTPS URL, Cloudflare receives that encrypted request, and Cloudflare then contacts your origin according to the selected SSL/TLS mode. If the origin’s view of the request does not match Cloudflare’s view, one layer redirects to the other indefinitely. Browsers eventually display ERR_TOO_MANY_REDIRECTS.
The Flexible-mode pattern
In Flexible mode, the browser-to-Cloudflare connection is HTTPS, but Cloudflare-to-origin traffic is HTTP. A WordPress site commonly has a server rule that turns HTTP into HTTPS. The origin therefore receives HTTP from Cloudflare and returns a redirect to HTTPS. Cloudflare repeats the origin request over HTTP, producing the same response again.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Cloudflare states: “If your origin server forces HTTPS by automatically redirecting HTTP requests to HTTPS, do not use Flexible mode.” Flexible is suitable only when the origin cannot support TLS and does not force HTTPS. It is not a compatibility setting for an origin that already requires secure connections.
The Full or Full (strict) pattern
Full and Full (strict) make an HTTPS connection from Cloudflare to the origin when the visitor requests HTTPS. A different loop appears if the origin receives that HTTPS request and redirects it to an http:// URL. Cloudflare follows the origin’s HTTP location, the edge policy sends the visitor back to HTTPS, and the cycle starts again.
HSTS and overlapping rewrite rules can add another redirect even when the SSL/TLS mode itself is correct. The reliable fix is to map every redirect and leave only one HTTP-to-HTTPS decision point.
Choose the right Cloudflare SSL/TLS mode
| Mode | Connection to the origin | Origin requirement | When it fits | Loop or error risk |
|---|---|---|---|---|
| Flexible | HTTP | No TLS required, and the origin must not force HTTPS | Only for an origin that genuinely cannot support HTTPS | Loops when WordPress or the server redirects HTTP to HTTPS |
| Full | HTTPS | HTTPS listener on port 443; certificate need not be publicly trusted | The origin supports HTTPS but uses a self-signed, private, or otherwise untrusted certificate | Loops if the origin redirects HTTPS back to HTTP; origin connectivity failures can produce 521 |
| Full (strict) | HTTPS | HTTPS on port 443 and a certificate Cloudflare can validate for the hostname | The normal choice when the origin certificate is valid, current, and hostname-matched | Certificate validation failures produce 526; HTTPS-to-HTTP rewrites can still loop |
In SSL/TLS → Overview, select Full when the origin has working HTTPS but its certificate is not publicly trusted. Select Full (strict) when the certificate is valid and verifiable for the requested hostname. Do not switch to Flexible merely to hide an origin certificate problem; fix the certificate or use Full while you replace it.
Step 1: Confirm which mode is active
- Sign in to Cloudflare and choose the affected site.
- Open SSL/TLS → Overview.
- Record the current mode before changing it.
- If it is Flexible and the site has an HTTP-to-HTTPS redirect, change it to Full or Full (strict) according to the table above.
- Wait for the setting to apply, then test an HTTPS page in a private browser window.
If changing from Flexible exposes a certificate warning, 526, or an origin connection failure, that is useful information: the origin is not yet ready for the selected end-to-end mode. Continue with the origin checks rather than reverting to a configuration that loops.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Step 2: Make the origin serve HTTPS correctly
Full modes are viable only when the origin accepts HTTPS. Check the web server or hosting control panel for an HTTPS virtual host or listener on port 443. Install a certificate that covers the exact hostname visitors use, including a wildcard or alternate name when your site requires one.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsFor Full mode
Full encrypts the Cloudflare-to-origin connection but does not require Cloudflare to validate the certificate in the same way as Full (strict). It can bridge a temporary period in which the origin certificate is self-signed or privately issued. The certificate still needs to be installed on the HTTPS listener, and the server must present a certificate and complete the TLS handshake.
For Full (strict)
Full (strict) validates the origin certificate. The certificate must be current, cover the hostname, and chain to a certificate authority Cloudflare accepts. Cloudflare’s Origin CA certificates are one documented way to provide an origin certificate for this connection. If the certificate is expired, issued for a different name, incomplete, or not installed on the listener, strict mode returns an error instead of forwarding the request.
Check the hostname and port
- Use the same hostname in your test that is configured in Cloudflare and named on the certificate.
- Confirm the firewall permits Cloudflare traffic to the HTTPS service on port 443.
- Make sure the server does not answer an HTTPS request by redirecting to an
http://URL. - After installing or renewing a certificate, reload the web server so it presents the new certificate.
Step 3: Remove duplicate redirect policies
Once Cloudflare can reach the origin over HTTPS, inspect every place that can issue a redirect. The goal is one coherent HTTP-to-HTTPS policy, not several rules that happen to point in the same direction.
WordPress address settings
- In WordPress, open Settings → General.
- Check WordPress Address (URL) and Site Address (URL).
- For a site that is intended to be HTTPS-only, both values should use the same canonical
https://hostname. - Save only after confirming there is no accidental difference such as
wwwversus the apex hostname.
Do not alternate the two fields between HTTP and HTTPS. A mismatch can make WordPress generate redirects even after the server and Cloudflare settings are corrected.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Web-server rewrite rules
Review Apache, Nginx, or your hosting panel for HTTP-to-HTTPS redirects and for rules that redirect HTTPS requests to HTTP. Keep the intended HTTPS canonicalization rule, but remove duplicate versions that run after Cloudflare has already enforced the same policy. In Full or Full (strict), an HTTPS request should remain HTTPS at the origin; an origin rule that emits an http:// Location header is a loop trigger.
Cloudflare redirect products
Inspect Rules → Redirect Rules and any legacy Page Rules. Look for rules that redirect all traffic to HTTPS, redirect one hostname to another, or rewrite a path that is itself redirected by WordPress. Disable overlapping rules one at a time and test after each change so you know which rule was responsible.
Step 4: Use Always Use HTTPS only once
Cloudflare’s Always Use HTTPS setting is an edge redirect from HTTP to HTTPS. For a site that fully supports HTTPS, it can be the single place where that redirect is enforced. Cloudflare recommends avoiding a second redirect at the origin because duplicate policies increase the chance of a loop.
If Always Use HTTPS is enabled, decide whether the origin must also redirect direct HTTP requests. In a proxied setup, keep the policy simple: the edge upgrades HTTP, while the origin serves HTTPS normally and does not redirect an already-HTTPS request to HTTP. If you disable Always Use HTTPS, ensure another clearly defined layer performs the upgrade and that no two layers disagree about the destination.
Step 5: Check HSTS and browser-cached redirects
HTTP Strict Transport Security (HSTS) tells a browser to use HTTPS automatically. It can make a fixed server rule appear broken because the browser continues to upgrade requests from a previous policy. HSTS does not replace correct Cloudflare and origin settings; it adds another client-side constraint.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
- Check whether HSTS is enabled at Cloudflare or emitted by the origin’s
Strict-Transport-Securityheader. - Do not enable an aggressive HSTS policy until every required hostname and subdomain works over HTTPS.
- After changing redirects, test in a private window or a different browser profile, and clear the affected browser’s cached site data.
Testing privately prevents an old 301 response or HSTS policy from hiding the result of your current configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 6: Install the Cloudflare WordPress integration
Cloudflare recommends the WordPress plugin and its Automatic HTTPS Rewrites feature to reduce mixed-content problems and the conditions that often accompany redirect loops. Install it through the normal WordPress plugin administration screen, connect it to the correct Cloudflare zone, and enable Automatic HTTPS Rewrites if your site still contains hard-coded HTTP asset URLs.
Automatic HTTPS Rewrites changes eligible resource links; it is not a substitute for choosing the correct SSL/TLS mode or removing a server redirect that sends HTTPS back to HTTP. Treat it as a WordPress-layer cleanup after the connection path is correct.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Step 7: Find the layer issuing the redirect
Do not guess which component is responsible. Inspect the redirect chain.
- Open browser developer tools, select the Network panel, enable recording, and request the original URL with a fresh private window.
- For each 301 or 302 response, record the status code, the responding host, and the complete
Locationvalue. - Look for a repeating sequence such as
https://…tohttp://…and back tohttps://…. - The response that first changes the scheme identifies the layer to inspect: Cloudflare rules, the origin server, or WordPress.
- After changing one rule, clear relevant caches and repeat the request until the final response is the page itself rather than another redirect.
From a shell, a header-only request can expose the same chain:
curl -I -L https://example.com/Replace the example hostname with your own. The repeated Location headers show whether the loop is between HTTP and HTTPS or between two hostnames or paths. A redirect that never reaches an origin response indicates an edge rule; a redirect returned only after Cloudflare contacts the server points to the origin or WordPress.
Step 8: Resolve Cloudflare error codes after the change
Error 521: the origin is refusing or not accepting the connection
Error 521 means Cloudflare cannot establish the required connection to the origin. In Full or Full (strict), verify that the origin is listening on the port required for HTTPS, normally 443, and that the firewall allows the connection. Check that the web server is running and that the hostname resolves to the intended origin. A 521 is a connectivity or port problem, not a certificate-validation message.
Recommended Free Tools
Error 526: the origin certificate cannot be validated
Error 526 occurs when Full (strict) cannot validate the origin certificate. Confirm the certificate’s expiration date, hostname coverage, issuer or chain, and installation on the HTTPS listener. Replace an invalid certificate or use Full temporarily only when the origin connection is otherwise working and you understand that strict validation is not yet available. Return to Full (strict) after installing a valid certificate.
Decision guide: the shortest safe path
| Your condition | Action | Where HTTPS is enforced | What to watch for |
|---|---|---|---|
| Origin has no HTTPS and does not redirect HTTP | Flexible can function, but plan to add origin TLS | Cloudflare or another single edge rule | Do not add an origin HTTPS redirect while remaining on Flexible |
| Origin has HTTPS, certificate is not publicly trusted | Use Full and keep the origin on HTTPS | One edge HTTP-to-HTTPS rule; origin serves HTTPS | An origin HTTPS-to-HTTP redirect creates a loop |
| Origin has valid, hostname-matched certificate | Use Full (strict) | One edge HTTP-to-HTTPS rule; origin serves HTTPS | Invalid certificates produce 526 |
| Mode is correct but loop remains | Inspect WordPress, server rewrites, Cloudflare rules, Always Use HTTPS, and HSTS | Remove all duplicate or opposing rules | Find the first changing Location response |
Final verification checklist
- SSL/TLS mode matches the origin’s real HTTPS and certificate capabilities.
- The origin accepts HTTPS on port 443 and does not redirect HTTPS to HTTP.
- WordPress Address and Site Address use the same canonical HTTPS hostname.
- Only one deliberate HTTP-to-HTTPS redirect is active.
- Cloudflare Redirect Rules, legacy Page Rules, and Always Use HTTPS do not overlap.
- HSTS is compatible with every hostname you intend to serve.
- Automatic HTTPS Rewrites is enabled when hard-coded HTTP assets cause mixed content.
- Private-window and header-chain tests finish at the intended HTTPS page without repeating
Locationheaders. - Any 521 is handled as an origin connection or port issue; any 526 is handled as certificate validation.
Once these checks pass, purge or clear WordPress and browser caches, then test the homepage, an internal post, an administrative login, and a representative asset. Testing more than the homepage catches path-specific rewrite rules that can otherwise leave part of the site in a loop.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
