Driver FixRecommendedSound, Wi-Fi or graphics acting up? Check drivers firstFind missing or outdated drivers fast.Check DriversHalloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsWindows FixRecommendedWindows errors stealing your time? Find the fix fastScan stability, cleanup and performance issues.Fix Now×
Skip to content
World desk10 min

How to Fix a WordPress Redirect Loop After Migrating Your Site

A practical, layer-by-layer guide to diagnosing and fixing WordPress redirect loops after migration, including HTTPS proxy detection, URL options, wp-config.php constants, server rules and admin-only loops.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A WordPress redirect loop after migration usually means two URL or HTTPS rules disagree. Pick one canonical public URL—including scheme, hostname, path, and trailing-slash convention—then make WordPress, the database, the web server, CDN or reverse proxy, and redirect plugins agree. Start by recording every redirect hop and taking a backup; change one layer at a time.

What a redirect loop is—and why migrations trigger it

A browser reports ERR_TOO_MANY_REDIRECTS when it follows repeated HTTP 301 or 302 responses without reaching a final page. After a move, the browser may bounce between http:// and https://, between a www and non-www hostname, or between the old and new path. An apparently simple “force HTTPS” setting can also loop when the visitor connects over HTTPS to a CDN or load balancer but the origin server sees plain HTTP.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

WordPress can generate redirects through its URL settings, login and canonical URL logic, and calls to wp_redirect(). Apache or Nginx rules, .htaccess, a CDN edge rule, hosting-level HTTPS enforcement, and redirect plugins can add more. A migration often leaves one of those layers pointing at the old domain or unaware that TLS was already terminated upstream.

The objective is not to remove every redirect. It is to have one intentional redirect, if one is needed, to one canonical URL, followed by a normal response such as HTTP 200.

#1 Best Overall
Sale
TOZO A1 Wireless Earbuds Bluetooth 5.3 Light Weight in Ear Headphones | IPX5 Waterproof,2 Mics for AI Calls,Immersive Premium Sound Bass Headset with Charging Case,32 EQ via App Black
  • [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
  • [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
  • [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
  • [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
  • [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.

Capture the loop before changing anything

Do not edit the database, proxy, server rules, and plugins simultaneously. First identify the exact chain and which layer sends each response.

  1. Use a clean browser session. Open developer tools, select the Network panel, enable “Preserve log,” and load the affected address in a private window. Record each request URL, status code, and Location value. A cached 301 can hide a change, so test in a private window or clear the site’s cookies and cache.
  2. Trace headers from a shell. Run curl -I -L https://your-domain.example/, replacing the address with the URL that loops. The output shows every response and its Location header. For a less confusing first pass, run curl -I https://your-domain.example/ without -L, then follow each location manually.
  3. Classify the pattern. Note whether the scheme alternates, the hostname changes, a path is added and removed, or the same URL points back to itself. Response headers and server logs can indicate whether WordPress, the web server, or a proxy produced the redirect.
  4. Back up before recovery work. Save a copy of the complete WordPress directory, uploaded files, configuration files, and database. A backup gives you a way back if a URL edit or rewrite change makes the site less accessible.

Keep this record while testing. It prevents a successful-looking change in one layer from being mistaken for a permanent fix when another layer still redirects.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Choose one canonical public URL

Write down the exact address visitors should use. Decide all of these parts together:

  • Scheme: normally https once the certificate and proxy configuration are working.
  • Host: either the www hostname or the bare domain, not both.
  • Path: include a subdirectory such as /blog if WordPress is installed there.
  • Slash convention: use the convention already intended by the site and let one layer enforce it.

For example, a site might choose https://example.com/blog. WordPress’s “WordPress Address (URL)” is where the core files reside; “Site Address (URL)” is the address visitors enter. When HTTPS is canonical, both values should contain https:// and neither should end with a slash.

Setting What it controls Typical canonical value
WordPress Address (URL) Location of WordPress core files https://example.com/blog
Site Address (URL) Public address visitors use https://example.com/blog

They can legitimately differ in specialised installations, but after a migration an unintended difference is a common source of redirects. If the site is intended to live at the same public path as its files, make them identical.

Correct the database URL values

The durable WordPress values are the siteurl and home rows in the wp_options table. Your installation may use a different table prefix, so confirm the actual options table name before running SQL.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #2
Sale
Smart Watch for Men Women Compatible with iPhone Samsung Android Phone 1.69 inch Full Touch Screen IP68 Waterproof Bluetooh Fitness Tracker Heart Rate/Sleep Monitor (Black)
  • 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
  • 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
  • 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
  • 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
  • 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
  1. Open the database in the hosting control panel’s database tool or another trusted SQL client.
  2. Run a read-only query first:
SELECT option_name, option_value
FROM wp_options
WHERE option_name IN ('siteurl', 'home');

Replace wp_options with the real table name. Compare both values character by character with the canonical URL: scheme, hostname, subdirectory, and slash convention must agree.

  1. If they are wrong, update only those two rows to the exact canonical value:
UPDATE wp_options
SET option_value = 'https://example.com/blog'
WHERE option_name IN ('siteurl', 'home');

Run the update only after confirming the backup and the intended address. If the database tool displays a serialized value or a different prefix, do not alter unrelated rows. The goal here is to correct the two URL options, not to perform an unbounded search-and-replace across the database.

When you can reach the dashboard, the same values appear under Settings > General as WordPress Address (URL) and Site Address (URL). Save them only after checking that the resulting address is the one you intend; changing these fields can immediately move the login URL.

Check WP_HOME and WP_SITEURL overrides

Definitions in wp-config.php override the database values. This makes them useful for regaining access during recovery, but it also means a stale definition can make a corrected database appear ineffective.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
define( 'WP_HOME', 'https://example.com/blog' );
define( 'WP_SITEURL', 'https://example.com/blog' );

If these constants exist, compare them with the canonical URL and with home and siteurl. Use one of two approaches:

  • Permanent configuration: keep both constants set to the exact canonical URL and document that they are authoritative.
  • Database-driven configuration: remove stale definitions (or comment them out temporarily), then let the corrected database values control the site.

Do not leave a temporary recovery value in place while believing that the database is authoritative. After editing, clear the browser session and repeat the header trace so you know which values are actually being used.

Rank #3
New Bee Guitar Cable 10ft Electric Instrument Bass AMP Cord
  • [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
  • [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
  • [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
  • [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
  • [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by

Fix HTTPS detection behind a CDN or reverse proxy

This is the characteristic cause of an HTTPS loop behind a proxy. The visitor connects securely to the CDN or load balancer, but the proxy connects to the origin over HTTP. WordPress then sees an insecure request and redirects to HTTPS; the proxy receives that request and sends it to the same HTTP origin again.

The proxy must pass the original protocol and host, and the origin must trust those headers only from the proxy that you control. The important protocol header is X-Forwarded-Proto: https for a secure visitor request. The host header must also carry the public hostname rather than an internal origin name.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

In wp-config.php, a commonly used recognition block is:

if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
     && 'https' === $_SERVER['HTTP_X_FORWARDED_PROTO'] ) {
    $_SERVER['HTTPS'] = 'on';
}

Use this only when your deployment ensures that the header comes from your trusted proxy. If the application is directly exposed to the internet, an unvalidated forwarded header can let a client claim to be using HTTPS. Configure the proxy to send a single, correct protocol value and ensure the origin’s web server does not overwrite it.

Verify host forwarding as well. A reverse proxy that replaces HTTP_HOST with an internal name can make WordPress redirect to that name or back to the public name on every request. Depending on the deployment, the application may need to derive the host from the trusted HTTP_X_FORWARDED_HOST value or from the server’s configured name. Do not accept arbitrary host values; allow only the public hostname(s) you operate.

After changing proxy or application settings, test both a direct origin request (if your setup permits it) and a normal public request. The public request should be recognised as HTTPS by WordPress, while the origin should no longer create its own competing HTTPS redirect.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Rank #4
BSIMB 15.6" Digital Family Calendar & Chore Chart, No Subscription Fees
  • Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
  • Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
  • All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
  • Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
  • Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.

Audit every layer that can own a redirect

Leave one layer responsible for each canonicalisation decision. If the CDN, web server, WordPress, and a plugin all enforce HTTPS or hostname changes independently, their rules can disagree and form a loop.

Layer What to inspect When the change is durable Access needed
WordPress database home and siteurl in the options table Yes, when they match the chosen public URL Database or dashboard
wp-config.php WP_HOME, WP_SITEURL, and proxy HTTPS handling Yes if intentionally maintained; otherwise remove recovery overrides File access
Web server Apache rewrite rules, .htaccess, Nginx server blocks, and host-level HTTPS rules Yes, after removing duplicate or stale rules Server or hosting control panel
CDN or reverse proxy Edge redirects, origin protocol mode, forwarded host and protocol headers Yes, when the edge and origin agree Proxy account or administrator
Plugins Redirect, SSL, caching, security, and migration plugins Yes after correcting or removing conflicting settings Dashboard or file access
Application code Theme or custom code calling wp_redirect() Yes after identifying the condition and target Code or deployment access

Web-server and .htaccess rules

Review rules added for the old domain, old subdirectory, HTTP-to-HTTPS enforcement, and www normalisation. A rule that redirects HTTPS to HTTP, or a rule that adds a path already present in the request, can create an immediate loop. Migration work may require updating rewrite or redirect files; compare them with the new document root and public URL. Keep one canonicalisation rule and remove obsolete copies rather than stacking exceptions.

CDN and hosting controls

Check whether the proxy is configured to talk to the origin using HTTP or HTTPS, whether an edge rule forces HTTPS, and whether a hosting panel also forces HTTPS. “Flexible” or mixed modes that terminate TLS at the edge while making WordPress believe the request is HTTP require correct forwarded-protocol handling. Do not enable a second HTTPS redirect at the origin until WordPress can correctly recognise the original request.

Plugins and custom code

Redirect and SSL plugins can retain the old domain or enforce a policy that duplicates the server rule. Caching and security plugins can also serve a cached redirect after the underlying setting is fixed. Temporarily disable the suspected component, purge its cache, and retest. If the redirect is generated by custom code, inspect the condition and destination of each wp_redirect() call together with server and proxy redirects; an application redirect is only one hop in the complete chain.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Recover when only the dashboard loops

An admin-only loop often points to a cookie, URL option, proxy scheme, or plugin conflict rather than a homepage redirect.

  1. Delete cookies for the site, close the browser tab, and retry in a private window. A cookie issued for the old domain or scheme can keep sending the login flow to the wrong address.
  2. Confirm that home, siteurl, and any constants use the same canonical scheme and host. A mismatch can redirect /wp-admin even when the homepage appears normal.
  3. Check proxy HTTPS recognition. WordPress may send the login request back to HTTPS repeatedly if the origin still sees HTTP.
  4. Temporarily rename the plugins directory through file access, for example from wp-content/plugins to plugins.disabled. This disables plugins without requiring the dashboard. Test the login, then restore the directory name and reactivate plugins individually to identify the conflict.

Use the rename only as a diagnostic step. Once access returns, restore the directory name and correct or remove the plugin that owns the conflicting redirect.

Retest the complete site, not just the homepage

After each controlled change, repeat the header trace and clear relevant caches. A successful fix should produce a predictable chain:

  • At most one intentional redirect from a legacy HTTP, hostname, or path variant to the canonical URL.
  • A final successful response, normally HTTP 200, for the canonical homepage.
  • A working login at the canonical /wp-admin address without repeated redirects.
  • Media and stylesheet URLs resolving under the correct scheme and hostname.
  • Representative old URLs reaching the intended new location rather than cycling.

Test the canonical URL, the old HTTP URL, both hostname variants if they existed, and any subdirectory used during the migration. Inspect the final Location header rather than relying only on what a browser displays. If a loop remains, the first hop that points away from the intended URL identifies the next layer to inspect.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Common patterns and their targeted fixes

Observed chain Likely disagreement Targeted action
http://host → https://host → http://host Origin does not recognise proxy HTTPS Pass and trust the original protocol header; remove duplicate origin rules
www.host → host → www.host Conflicting hostname rules Choose one host and make database, server, proxy, and plugin settings agree
New domain → old domain → new domain Stale database value, constant, or migration redirect Correct home/siteurl, inspect constants, and remove the old-domain rule
Homepage works; login repeats Cookie, admin URL, proxy scheme, or plugin conflict Clear cookies, verify URL settings, and isolate plugins
Every URL gains and loses a subdirectory Document-root or path rewrite mismatch Align the WordPress path with server rules and the chosen Site Address
Loop persists after a fix Cached redirect at a CDN, server, or plugin Purge the relevant cache, then capture a fresh header trace

Clean up temporary recovery changes

Once the database and proxy configuration are correct, remove temporary constants, debug edits, disabled-plugin renames, and emergency rewrite workarounds that are no longer needed. Keep a written record of the canonical URL and which layer owns HTTPS and hostname redirects. Future migrations should apply the database, proxy headers, server rules, and plugin settings as one planned change, with a backup and a header trace before and after.

WordPress’s HTTPS migration logic can update the home and siteurl values to HTTPS and replace insecure URLs after an HTTPS move, but it cannot resolve a proxy that reports the wrong scheme or two infrastructure layers that issue opposing redirects. Those boundaries are why the durable fix is agreement across the stack, not simply turning on another “force HTTPS” switch.

Final verification checklist

  • One canonical scheme, host, path, and slash convention is documented.
  • A current backup of files and database exists.
  • home and siteurl match the canonical URL.
  • WP_HOME and WP_SITEURL are either intentionally correct or removed.
  • The proxy forwards the original host and protocol, and WordPress recognises HTTPS safely.
  • Server, .htaccess, CDN, hosting, plugin, and application redirects have one clear owner each.
  • The homepage, login, media, and representative legacy URLs end in the expected response without a loop.

With those checks complete, a migration redirect should be a single, explainable hop rather than an endless exchange between layers.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.