Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11If /wp-admin/ keeps bouncing between HTTP and HTTPS, alternates between www and the root domain, or returns ERR_TOO_MANY_REDIRECTS, the usual problem is not the certificate itself. WordPress, the web server, and an SSL-terminating proxy disagree about the request’s real scheme or canonical host.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Fix the loop by tracing the redirect chain, choosing one HTTPS hostname, making WordPress and its database use that URL, passing the original HTTPS state through any proxy, assigning HTTP-to-HTTPS redirection to one layer, and only then forcing SSL for the administrator.
As an Amazon Associate I earn from qualifying purchases.
What causes a WordPress admin redirect loop?
A redirect loop is a cycle in which each request is answered with another redirect instead of a final page. For example, a browser requests HTTPS, a proxy forwards the request to the origin as HTTP, WordPress decides HTTPS is required and redirects, and the proxy sends the request back to the origin as HTTP again. The browser repeats the cycle until it reports too many redirects.
The same thing can happen when one component considers https://example.com canonical while another insists on http://www.example.com. A stale WordPress URL, a second redirect rule, or a plugin that tries to enforce SSL can add another leg to the cycle.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Layer | Typical disagreement | What you observe | Corrective action |
|---|---|---|---|
| WordPress configuration | WP_HOME, WP_SITEURL, or database values still use HTTP, www, or an old hostname |
Login redirects to a different host or repeatedly returns to the login page | Set one canonical URL and align the constants with the home and siteurl options |
| Origin web server | Apache or Nginx redirects independently of the proxy | Alternating status codes or hostnames in the chain | Remove duplicate or contradictory redirect rules |
| CDN or load balancer | TLS ends at the edge, but the origin sees HTTP | HTTPS is redirected back to HTTPS indefinitely | Forward the original scheme and configure a single redirect owner |
| SSL-enforcing plugin or theme | Application code adds a second canonicalization rule | Loop appears after a plugin, theme, or migration change | Temporarily disable extensions, test, then reactivate one at a time |
| Browser, CDN, or cached 301 | An old permanent redirect remains cached | Server configuration looks correct, but one browser still loops | Clear cookies and caches, then retest privately |
Step 1: Capture the complete redirect chain
Do not change several settings at once. First identify every hop, including the scheme, host, status code, and destination. A healthy chain may contain one HTTP-to-HTTPS redirect, but it must finish at one HTTPS hostname and a page response.
Use browser developer tools
- Open a private window so existing cookies do not influence the test.
- Open Developer Tools and select the Network panel.
- Request
https://example.com/wp-admin/and enable the option that preserves the request log. - Inspect each 301, 302, 307, or 308 response. Record its
Locationheader, host, scheme, and whether the destination changes.
Look for patterns such as HTTPS to HTTP, the root domain to www and back, or /wp-admin/ to /wp-login.php and back. A redirect to the login form is normal when you are not authenticated; repeated login redirects indicate that WordPress cannot keep a valid session or that its URL settings conflict.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use curl from a shell
curl -I -L https://example.com/wp-admin/The -I option requests headers and -L follows redirects. Run the same command against the HTTP version and each hostname you support:
curl -I -L http://example.com/wp-admin/
curl -I -L https://www.example.com/wp-admin/Stop following redirects when you need to inspect one response in isolation:
curl -I https://example.com/wp-admin/Write down the sequence before editing files. If the chain alternates between two URLs, the two layers responsible are usually visible from the destinations.
Step 2: Establish one canonical HTTPS URL
Choose the exact public URL users should see, including the hostname and whether it uses www. In the examples below, that URL is https://example.com. Do not leave a trailing slash in the values unless your existing WordPress setup specifically requires one.
Check wp-config.php
Open the WordPress root’s wp-config.php and inspect these constants:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
define( 'WP_HOME', 'https://example.com' );
define( 'WP_SITEURL', 'https://example.com' );WP_HOME is the public site address. WP_SITEURL is where the WordPress core files are addressed. For a standard installation they normally match. If either constant contains http://, an old domain, or a different www choice, replace it with the canonical HTTPS URL.
These constants override the corresponding database options, which makes them useful during recovery. Keep the syntax exactly as shown, place the definitions before the line that says WordPress stops editing, and avoid defining the same constant twice.
Check the database options
In the options table for the affected site, inspect the rows named home and siteurl. They must use the same scheme and hostname as the constants. Replace stale values such as http://example.com, https://www.example.com, or an old migration domain with the selected canonical URL.
Use a database backup before editing. If you cannot access the dashboard, use your host’s database interface or a command-line client. A mismatch between constants and stored options can make different requests appear to use different URLs, especially after a migration.
Step 3: Tell WordPress when HTTPS ends at a proxy
If visitors connect to HTTPS at a CDN, reverse proxy, or load balancer, the proxy may connect to the origin over ordinary HTTP. Without an explicit indication of the original scheme, WordPress sees HTTP even though the browser is using HTTPS and sends a new HTTPS redirect on every request.
Use the forwarded scheme only from a trusted proxy
WordPress documents checking HTTP_X_FORWARDED_PROTO and setting the server HTTPS flag when the trusted proxy reports HTTPS:
if ( isset( $_SERVER['HTTP_X_FORWARDED_PROTO'] )
&& strpos( $_SERVER['HTTP_X_FORWARDED_PROTO'], 'https' ) !== false ) {
$_SERVER['HTTPS'] = 'on';
}
define( 'FORCE_SSL_ADMIN', true );Place the detection code in wp-config.php before WordPress loads. Use it only when your proxy actually sets this header and untrusted clients cannot spoof it on a direct path to the origin. If the origin is publicly reachable without the proxy, restrict that path or configure the web server so clients cannot supply a false forwarded scheme.
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Forward the complete request context
A reverse proxy should preserve the host and client context as well as the scheme. The proxy configuration should pass:
HostX-Real-IPX-Forwarded-ForX-Forwarded-HostX-Forwarded-Proto
When the host is not forwarded, WordPress can construct links for the origin hostname instead of the public hostname. When the scheme is not forwarded, it may repeatedly redirect HTTPS requests. Confirm the actual headers arriving at the origin with your server logs or a temporary diagnostic that you remove immediately after testing.
Check the proxy’s encryption mode
Some edge services offer modes that encrypt traffic from the browser to the edge but use HTTP between the edge and origin. That arrangement requires correct forwarded-scheme handling at WordPress. A mode that also encrypts the edge-to-origin connection avoids that particular mismatch, but it still does not justify running two independent redirect systems. Ensure the certificate presented by the origin is valid for the hostname the proxy uses.
Step 4: Give HTTP-to-HTTPS redirection one owner
Redirects can be enforced at the CDN edge, the origin web server, WordPress, or a plugin. Select one deliberate owner for the basic HTTP-to-HTTPS rule and remove rules that point in the opposite direction. Having an edge rule and an origin rule is not automatically wrong, but both must agree on the same final host and scheme; during troubleshooting, one owner is easier to verify.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| Redirect owner | Best fit | Required checks | Common failure |
|---|---|---|---|
| CDN or edge | Sites where all public traffic passes through the edge | Origin accepts the edge’s scheme and host headers; encryption mode matches | Edge sends HTTPS to an origin that redirects based on perceived HTTP |
| Origin server | Sites that do not use an SSL-terminating proxy | Virtual host and certificate cover the canonical hostname | Separate rules for www, HTTP, and HTTPS fight one another |
| WordPress | Application-specific redirects after server canonicalization is settled | home, siteurl, and proxy detection are correct |
Plugins or constants enforce SSL before the request scheme is detected |
Review edge rules
If you use an edge service, inspect both its dashboard redirect rules and the origin configuration. An “Always Use HTTPS” setting should point to the same hostname that WordPress uses. Remove rules that send HTTPS back to HTTP, that switch between www and the root domain in both directions, or that match the admin path separately without a clear reason.
Review origin rules
Check Apache rewrite directives, Nginx server blocks, hosting control-panel redirects, and any application bootstrap code. Search for every rule that contains http, https, the old hostname, or a condition on the forwarded protocol. Keep one canonicalization path and test it with curl after each change.
Step 5: Enable forced SSL for the admin only after detection works
define( 'FORCE_SSL_ADMIN', true ); tells WordPress to use SSL for login and administration sessions. It protects the intended admin URL, but it cannot correct a proxy that makes HTTPS look like HTTP. If you enable it before proxy detection and canonical URLs are correct, it can reproduce the infinite redirect.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Temporarily remove or comment out FORCE_SSL_ADMIN while diagnosing a loop. Verify that a normal front-end request reaches HTTPS without cycling, then verify that WordPress recognizes the request as secure at the origin. Add the constant back only after those checks pass.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Step 6: Rule out plugins, must-use plugins, and themes
Security, caching, canonical-URL, and SSL plugins can add redirects outside the core configuration. A theme can also redirect requests during initialization. Isolate extensions without relying on the dashboard if the dashboard is inaccessible.
Disable regular plugins from the filesystem
- Use SFTP, FTP, or the host’s file manager to open
wp-content. - Rename
pluginsto a temporary name such asplugins.off. - Test
/wp-login.php,/wp-admin/, and a front-end URL. - If the loop stops, restore the directory name and deactivate or remove the responsible plugin from the dashboard or database.
- Reactivate plugins one at a time, testing after each activation.
Renaming the directory disables all ordinary plugins at once. It does not necessarily disable must-use plugins, which are loaded from wp-content/mu-plugins. If the loop remains, temporarily rename that directory as well, then test again and restore it immediately after the diagnosis.
Switch to a bundled theme
If plugins are not responsible, use a default bundled theme through the dashboard or database. A theme that redirects based on host, scheme, authentication state, or maintenance mode can mimic a server loop. Restore the original theme after testing and inspect its redirect code before reactivating it.
Step 7: Clear cookies and cached redirects
Login cookies are tied to the site’s domain and secure status. Delete cookies for every hostname involved, clear the browser cache, and repeat the test in a private window. This is especially important after changing from HTTP to HTTPS or switching between www and the root domain.
Free tools Windows power users keep installed
One-click scans. No signup required.
Clear the CDN cache and any page-cache layer after correcting server settings. Browsers and intermediaries may retain cached 301 responses, so test with a fresh private session and with curl, which does not use the browser’s stored redirect cache. Do not treat a single browser’s continued error as proof that the server still loops.
Step 8: Test each URL and session state
Run a controlled test matrix after every configuration change:
| Request | Expected result |
|---|---|
http://example.com/ |
At most one redirect to the canonical HTTPS hostname, then a page response |
https://example.com/ |
Direct page response on the canonical host |
https://example.com/wp-login.php |
Login form without cycling |
https://example.com/wp-admin/ while logged out |
One normal redirect to the login form, not an endless sequence |
https://example.com/wp-admin/ while logged in |
Dashboard loads and the session remains authenticated |
| Alternate hostname | One redirect to the canonical HTTPS hostname, if the alternate hostname is intentionally supported |
If the dashboard loads but immediately returns to the login page, inspect cookie-domain and secure-cookie behavior after confirming the URL and proxy settings. A scheme mismatch can prevent WordPress from accepting the cookie it just issued.
Common symptoms and targeted fixes
HTTPS alternates with HTTP
This almost always means the origin does not know that the client connected through HTTPS. Confirm X-Forwarded-Proto, apply trusted proxy detection, and remove any rule that redirects the proxy’s HTTPS request based on the origin connection being HTTP.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemswww and the root domain alternate
Choose one hostname in WP_HOME, WP_SITEURL, and the database. Then leave only one host-canonicalization rule active. Check edge rules, web-server rules, and plugins for the reverse redirect.
The login page keeps reappearing
First clear cookies and test privately. Next verify that the login URL and site URL use the same HTTPS host and that the proxy marks the request secure. If the problem survives those checks, disable plugins and the theme because an extension may be changing authentication redirects.
The loop began after enabling “Always Use HTTPS”
Inspect the edge setting and origin redirects together. Ensure the edge forwards the original scheme and that the origin does not send the edge’s HTTPS request back to HTTP. Temporarily disable the edge rule while you establish a working canonical path, then re-enable it only if it remains the sole public redirect owner.
The loop began after a migration
Search both configuration constants and the database for the previous domain, scheme, and hostname variant. Update serialized URLs with a WordPress-aware migration method rather than blind text replacement, and retest every URL in the matrix.
When to involve the hosting provider
Escalate when the canonical URLs, proxy headers, redirect ownership, plugins, themes, and caches have been checked but requests still fail. Ask the provider to inspect:
- Firewall rules that block loopback requests
- DNS records and split-horizon DNS
- TLS certificates and the certificate selected for each hostname
- Load-balancer health checks and forwarded headers
- HTTP authentication rules applied to the origin
- Server-level rewrites outside your account
WordPress may report loopback or site-health failures when the server cannot call its own public URL. Those failures can coexist with an admin redirect problem, so provide the provider with the exact redirect chain, timestamps, hostnames, and status codes rather than only a screenshot.
Quick Recap
A safe recovery order
- Record the chain with browser tools or
curl. - Choose one canonical HTTPS hostname.
- Align
WP_HOME,WP_SITEURL, and the database’shomeandsiteurl. - Confirm where TLS terminates and pass the original scheme through a trusted proxy.
- Remove contradictory edge, server, and application redirects.
- Keep
FORCE_SSL_ADMINdisabled until secure-scheme detection works, then enable it. - Disable plugins, must-use plugins, and the theme if the loop remains.
- Clear cookies and caches, then run the complete URL and login test matrix.
- Give the host the captured chain if server-side loopbacks or TLS still fail.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
