Why the loop happens
Cloudflare's Flexible mode encrypts traffic between the visitor and Cloudflare, but Cloudflare connects to your origin over HTTP. Its documentation says redirect loops will occur if the origin automatically redirects all HTTP requests to HTTPS, and tells you not to use Flexible in that case. A WordPress site whose address is set to https, or a host that forces HTTPS, does exactly that: every request Cloudflare sends arrives as HTTP and is sent back to HTTPS, forever.
WordPress.org's HTTPS page describes the same problem from the WordPress side: when a reverse proxy provides SSL but the site behind it is hosted without SSL, the HTTPS settings can send requests into an infinite redirect loop. Cloudflare in Flexible mode is that kind of proxy.
Flexible is also a poor fit for course sites for a second reason. Cloudflare recommends Full or Full (strict) when an application handles sensitive information such as personalized data or user logins, which describes every membership and LMS site.
Cloudflare's documented causes and fixes
Cloudflare's ERR_TOO_MANY_REDIRECTS troubleshooting page lists the settings that can produce a loop. Each one only loops when it disagrees with what the origin does.
| Setting | When it loops | Cloudflare's fix |
|---|---|---|
| Flexible encryption mode | Origin redirects all HTTP requests to HTTPS | Remove the origin's HTTPS redirects, or switch to Full or higher (needs a certificate on the origin) |
| Full or Full (strict) | Origin redirects HTTPS requests to HTTP | Remove the HTTP redirects at the origin |
| Always Use HTTPS | Origin redirects HTTPS requests back to HTTP | Remove those origin redirects, or disable Always Use HTTPS |
| HSTS | Origin redirects HTTPS to HTTP, or encryption mode is Off | Remove the redirects and use Flexible or higher, or disable HSTS |
| Redirect Rules and Page Rules | Two rules send a request back and forth, for example between two hostnames | Review the rules for conflicts |
Fix order for a WordPress course site
First, make sure the origin has a certificate Cloudflare will accept. Cloudflare's Full (strict) page requires a certificate that is unexpired, issued by a publicly trusted certificate authority or by Cloudflare's Origin CA, and that names the requested hostname in its Common Name or Subject Alternative Name. If any of those fail, visitors may see a 526 error instead of a loop.
Second, switch the encryption mode to Full (strict). Cloudflare's Full mode also stops the loop, but its documentation says the origin certificate is not validated in any way and can be expired, self-signed or for the wrong name, which leaves room for someone to intercept the connection. Use Full only while you are waiting for a valid certificate.
Third, decide where the HTTP to HTTPS redirect lives. Cloudflare's Always Use HTTPS page says the setting redirects all visitor requests from http to https and recommends not performing redirects at your origin web server, because that can cause loops. With Full (strict) the origin's own HTTP to HTTPS redirect does not loop, but keeping a single redirect at the edge makes later debugging simpler.
WordPress-side checks
Confirm home and siteurl both start with https and that wp-config.php does not override them with an http value in WP_HOME or WP_SITEURL. If your stack terminates SSL at a proxy and talks to WordPress over HTTP, WordPress.org documents setting $_SERVER['HTTPS'] to on when the HTTP_X_FORWARDED_PROTO header contains https, and says such settings belong in wp-config.php rather than a plugin.
Then look for redirects WordPress or a plugin adds: redirect manager plugins, security plugins that force HTTPS, and old .htaccess rules that point to a different hostname or to http. Cloudflare's page names conflicting redirects between two hosts as a cause, which on a migrated site often means one rule sending www to the bare domain and another sending it back. Cloudflare also notes that WordPress users can reduce loops and mixed content with its WordPress plugin and the Automatic HTTPS Rewrites option.
Pre-cutover check: does the new host already have its certificate?
A loop is harder to untangle when the host move and the Cloudflare change land on the same day. Before you point DNS or the Cloudflare record at the new server, request the site from the new origin directly and confirm it presents a valid certificate for your hostname. Our guides on testing the new host before DNS changes and on getting a certificate before cutover cover how to do that without affecting live students.
If the new host cannot issue a public certificate until DNS points at it, a Cloudflare Origin CA certificate meets the Full (strict) requirements listed above, because Cloudflare accepts certificates it issued for this purpose. Install it on the origin first, then switch modes, then change the record.
Redirect loop checklist
- Note the current Cloudflare encryption mode before changing anything.
- Confirm the origin has an unexpired certificate for the hostname from a public CA or Cloudflare Origin CA.
- Switch to Full (strict); avoid Flexible on any site with logins.
- Keep one HTTP to HTTPS redirect, preferably Always Use HTTPS at the edge.
- Check that no origin rule redirects HTTPS back to HTTP.
- Review Redirect Rules, Page Rules and redirect plugins for www and bare-domain conflicts.
- Confirm home and siteurl use https and wp-config.php does not override them.
Questions before you decide
Why does Flexible SSL cause too many redirects on WordPress?
In Flexible mode Cloudflare connects to the origin over HTTP. If WordPress or the server redirects HTTP to HTTPS, the request goes back to Cloudflare, which again connects over HTTP, so it loops. Cloudflare says not to use Flexible when the origin forces HTTPS.
Should I choose Full or Full (strict)?
Full (strict). Cloudflare documents that Full does not validate the origin certificate at all, while Full (strict) requires an unexpired, trusted certificate that matches the hostname. Use Full only briefly while a valid certificate is being issued.
What causes a 526 error after switching to Full (strict)?
Cloudflare says visitors may see a 526 error when the origin certificate is expired, not issued by a publicly trusted CA or Cloudflare Origin CA, or does not name the hostname. Fix the certificate rather than switching back to Flexible.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Cloudflare: ERR_TOO_MANY_REDIRECTS Accessed 30 Oct 2026
- Cloudflare: Flexible encryption mode Accessed 30 Oct 2026
- Cloudflare: Full encryption mode Accessed 30 Oct 2026
- Cloudflare: Full (strict) encryption mode Accessed 30 Oct 2026
- Cloudflare: Always Use HTTPS Accessed 30 Oct 2026
- WordPress.org: HTTPS Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.