To make https://example.com the final address, treat HTTPS enforcement and hostname canonicalization as two separate redirects. Make both example.com and www.example.com resolve to the same redirect owner, install a certificate that covers every HTTPS hostname users can request, then add one permanent rule from https://www.example.com/path to https://example.com/path while preserving the query string. Remove competing www and non-www rules, and make sure a proxy tells your origin that the original request was HTTPS. Those changes eliminate the usual “www keeps coming back,” “non-www does not redirect,” and “too many redirects” failures.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What the finished redirect should do
Choose one canonical host before changing any setting. In this guide, the canonical host is the apex (also called non-www) hostname: example.com. The expected end state is:
As an Amazon Associate I earn from qualifying purchases.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Request | Expected result |
|---|---|
http://example.com/page?ref=mail |
Redirects to https://example.com/page?ref=mail |
http://www.example.com/page?ref=mail |
Redirects to https://example.com/page?ref=mail |
https://www.example.com/page?ref=mail |
Redirects to https://example.com/page?ref=mail |
https://example.com/page?ref=mail |
Serves the page directly, without another redirect |
The path and query string should survive the hostname change. A request for /products/7 must not be reduced to the home page, and a tracking parameter such as ?ref=mail must not disappear.
HTTPS and www are different decisions
HTTPS answers whether the connection is encrypted. The www choice answers which hostname represents the site. Enabling “Always Use HTTPS” does not, by itself, decide whether the final host is www.example.com or example.com. Conversely, a www-to-apex rule does not necessarily upgrade an HTTP request to HTTPS.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Keep the decisions in a predictable order: first ensure the request can reach a TLS endpoint for the hostname the visitor typed, then converge the hostname, and finally serve the canonical HTTPS URL. You can perform both redirects at the edge, but there should still be one clear owner and one direction for each transformation.
Why redirects fail or loop
Competing canonical-host rules
A rule that sends the apex to www conflicts with a rule that sends www to the apex. The browser follows the first response, receives a redirect in the opposite direction, and repeats. Search the edge, load balancer, web server, application, and CMS for every rule that mentions either hostname. Keep only the direction you selected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The request bypasses the redirect owner
An edge redirect can run only when DNS and proxy routing send the request through that edge. If one hostname is proxied and the other is DNS-only, they may reach different systems. The DNS-only hostname must have an origin capable of answering the request and issuing its own redirect, or you must route both names through the edge.
The certificate does not cover the typed hostname
TLS negotiation happens before an HTTP redirect can be returned. Therefore, a visitor requesting https://www.example.com needs a certificate valid for www.example.com at the layer that terminates TLS. A certificate covering only example.com cannot reliably redirect the www request. With a proxied hostname, the edge certificate is relevant; with DNS-only traffic, the origin certificate must cover the name.
An origin misreads HTTPS as HTTP
When a reverse proxy or load balancer terminates TLS, it may send plain HTTP to the origin. Unless the proxy passes the original scheme and the application trusts that information, the origin believes the request was HTTP. It then issues an HTTP-to-HTTPS redirect even though the visitor is already on HTTPS. Apache documents this behavior: its %{HTTPS} variable can remain off when SSL/TLS ended upstream. The result is a loop between the proxy and origin.
Conflicting SSL/TLS modes
Cloudflare identifies encryption-mode mismatches and overlapping redirect rules as common causes of “too many redirects.” A setting intended to solve an origin problem can make the edge and origin disagree about the scheme. Fix the scheme and ownership instead of adding another redirect.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallRank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Fix the configuration step by step
1. Write down the canonical URL
Use one exact answer, such as https://example.com. Decide whether every path on the site supports HTTPS. If some paths cannot, do not blindly force HTTPS for those paths; make a path-specific plan and document the exceptions.
- Canonical host:
example.com - Canonical scheme:
https - Canonical port: the standard HTTPS port unless your site intentionally uses another one
- Path handling: preserve the original path
- Query handling: preserve the original query string
Do not leave a second policy that prefers www.example.com. A site can technically answer on both names, but redirects must point in only one direction.
2. Make both hostnames reach the intended service
Check the DNS records for the apex and www names. Both must resolve to the service that owns the redirect, or each must reach an origin configured to handle its name. If you use Cloudflare Redirect Rules, the hostname must pass through Cloudflare; a DNS-only record bypasses those rules.
Alias-domain redirects can run at Cloudflare without a separate origin serving the alias, but the alias still needs DNS that reaches Cloudflare. If the record is missing, points elsewhere, or is not proxied as expected, no edge rule can answer the request.
- Confirm that
example.comresolves to the intended edge or origin. - Confirm that
www.example.comresolves to the same redirect-capable service. - Check whether each record is proxied or DNS-only.
- Remove stale records that send one hostname to an old load balancer or server.
3. Verify certificate coverage before redirecting HTTPS
Test the certificate presented for both HTTPS hostnames. The certificate’s names must include the exact hostname requested, either directly or through an appropriate wildcard. Verify coverage at the TLS-terminating layer, not just on a server that may never see the connection.
| Traffic path | Certificate that must cover the hostname |
|---|---|
| Proxied through an edge provider | The provider’s active edge certificate for the requested name |
| DNS-only to the origin | The origin’s certificate for the requested name |
| Load balancer terminates TLS | The load balancer’s certificate; the origin still needs correct forwarded-scheme handling |
Do this check for both example.com and www.example.com. A redirect cannot repair a certificate-name failure because the browser must complete TLS before it receives the HTTP status.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
4. Inspect all four combinations
Use a header-following HTTP client from a network outside your server when possible. The following commands show each response without hiding intermediate redirects:
curl -I http://example.com/path?ref=mail
curl -I http://www.example.com/path?ref=mail
curl -I https://www.example.com/path?ref=mail
curl -I https://example.com/path?ref=mail
For a complete chain, use:
curl -IL http://www.example.com/path?ref=mailRecord the status code and every Location header. During diagnosis, a temporary redirect is easier to change than a cached permanent one. The successful chain should end at the canonical HTTPS apex, retain /path and ?ref=mail, and stop after the expected one or two hops.
Recommended Free Tools
5. Identify every redirect owner
Make an inventory before editing. Redirects can be generated by more than one layer:
- Cloudflare Redirect Rules or “Always Use HTTPS”
- A load balancer or reverse proxy
- Apache or Nginx
- The application framework
- A content-management system or plugin
Temporarily disable duplicate rules, then test after each change. Cloudflare recommends not performing redirects at the origin web server when the edge already owns that policy because the combination can create loops. The practical implication is not that origin redirects are forbidden; it is that one layer should be authoritative for a given redirect.
6. Add one www-to-apex rule
For an apex-canonical site, create a rule matching the HTTPS www hostname and return a permanent redirect to the equivalent apex URL. A concrete pattern is:
Match: https://www.example.com/*
Target: https://example.com/$1
Status: 301
Query string: preserveCloudflare’s documented wildcard form uses a match such as https://www.*, a target such as https://${1}, status 301, and query-string preservation. Replace the wildcard with your actual domain and ensure the path capture is retained by the rule syntax used in your dashboard.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Do not enable the reverse rule at the same time. The reverse direction is a separate policy: match https://example.com/* and target https://www.example.com/${1}. Choose one direction only.
7. Enforce HTTP-to-HTTPS at the edge when appropriate
If all site paths support HTTPS, enforce the scheme at the edge. Cloudflare requires an active edge certificate for this feature. Check the edge setting and the origin configuration together; enabling edge HTTPS enforcement while the origin independently rewrites schemes can create a loop.
If the origin must own HTTP-to-HTTPS, make sure the edge forwards the original scheme and that the application trusts the proxy. Otherwise, every HTTPS request can look like HTTP to the origin and trigger another upgrade.
8. Correct forwarded-scheme handling
Inspect the headers your proxy sends to the origin, commonly a forwarded-protocol value, and inspect the framework setting that marks the proxy as trusted. The exact label varies by server and application, so use the configuration for your stack rather than copying a setting intended for another platform.
- The proxy terminates TLS and knows the visitor used HTTPS.
- The proxy forwards that original scheme to the origin.
- The application is configured to trust the proxy’s scheme header.
- The application generates absolute HTTPS URLs without issuing a second upgrade redirect.
If you cannot verify all four conditions, temporarily disable the application’s own scheme redirect and let the edge handle it while you correct the trust configuration.
9. Do not use Flexible mode to hide an origin loop
When an origin redirects HTTP to HTTPS, Cloudflare Tunnel guidance says to use an HTTPS service URL or remove the origin redirect and use HTTP consistently between the edge and origin. Switching to Flexible encryption to conceal the mismatch is not the fix; it leaves the edge-to-origin scheme inconsistent and can perpetuate the loop.
10. Retest, then make the redirect permanent
Use a temporary redirect while editing. Test all four scheme-and-host combinations, several deep paths, an empty query string, and a query string with multiple parameters. Check the certificate name and inspect cache behavior after each change.
Only after the chain converges reliably should you change the www-to-apex rule to status 301. Retest again from a clean client and with the header-following command, because browsers and intermediaries can cache permanent redirects.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsEdge redirect or origin redirect?
| Decision point | Edge-owned redirect | Origin-owned redirect |
|---|---|---|
| Where TLS is terminated | At the CDN or edge; the edge certificate must cover the requested name | At the load balancer or origin; that endpoint’s certificate must cover the name |
| DNS requirement | Both names must route through the edge | Both names must resolve to an origin that handles them |
| Loop risk | Conflicts with origin or application redirects | Can misfire when a proxy makes HTTPS look like HTTP |
| Best use | Simple host and scheme policy for every path | Path-specific logic or an environment where the origin is the sole authority |
| Testing status | Use temporary status while rules are changing; switch to 301 when stable | Use the same temporary-then-permanent process |
The important choice is ownership, not a universal preference. A single clear owner prevents two layers from trying to canonicalize the same request in different ways.
Diagnose by the symptom
| Symptom | Likely cause | What to check |
|---|---|---|
| HTTPS works, but www remains in the address | No www-to-apex rule, or the rule does not match the HTTPS hostname | Rule expression, wildcard capture, target host, and query preservation |
| Non-www HTTP does not redirect | The apex DNS record bypasses the edge or the origin lacks HTTP handling | DNS mode, routing target, and the layer receiving port 80 traffic |
| HTTPS www fails before any redirect | Certificate does not cover www.example.com |
Certificate names at the TLS-terminating endpoint |
| “Too many redirects” appears | Opposing host rules, duplicate edge/origin rules, or an SSL-mode mismatch | Every Location header and each redirect owner |
| Origin redirects an already-HTTPS request | Proxy termination is hidden from the application | Forwarded scheme and trusted-proxy settings |
| Path or tracking parameters disappear | Target was hard-coded to the home page or query preservation is disabled | Wildcard capture and the preserve-query option |
Verification checklist
- One canonical host is documented:
example.com. - No rule redirects apex to www while another redirects www to apex.
- Both DNS names reach the chosen redirect owner.
- The TLS endpoint has valid coverage for both hostnames.
- The HTTPS www rule preserves the path and query string.
- HTTP-to-HTTPS enforcement is enabled only where paths support HTTPS.
- The origin receives and trusts the original HTTPS scheme when TLS ends at a proxy.
- Flexible mode is not being used to mask an origin redirect mismatch.
- All four URL combinations converge in one or two expected hops.
- The permanent status is enabled only after temporary testing succeeds.
Frequently asked questions
Can I redirect an HTTPS www request if the www certificate is missing?
No. The browser must complete TLS before it can receive an HTTP redirect, so the certificate presented for www.example.com must be valid even if the final site is non-www.
Should both www and non-www URLs stay accessible without redirects?
They can, but that creates two public hostnames and does not establish one canonical address. If the goal is a non-www canonical site, redirect www to the apex consistently.
Why does a redirect rule work for one hostname but not the other?
The names may use different DNS or proxy modes, or only one may match the rule expression. Compare routing, TLS coverage, and the exact host pattern for each name.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What status should I use while troubleshooting?
Use a temporary redirect while changing rules, then switch to 301 after every combination reaches the canonical HTTPS apex with the expected path and query string.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
