Fix Cloudflare Flexible SSL Loop Issues

There is nothing more frustrating than opening your browser to check your website only to see a “Too Many Redirects” error. This is a common headache for many website owners who use Cloudflare to manage their DNS and security. Most of the time, this happens right after you enable SSL or change your hosting provider, leaving your visitors stuck in a loop where the browser keeps asking the server for a page that never loads.

This specific problem is almost always caused by a mismatch in how Cloudflare communicates with your origin server. When you see a cloudflare flexible ssl redirect loop, it means your server and Cloudflare are essentially arguing over who should handle the HTTPS request. One tells the other to redirect, and the other sends it back, creating an infinite circle that crashes the page load.

Solving this does not require a degree in network engineering. In most cases, a simple toggle in your dashboard will fix it. However, understanding why it happens will help you prevent it from recurring when you update your site or change your web hosting Malaysia plan in the future.

Understanding the Cloudflare Flexible SSL Redirect Loop

To fix the loop, you first need to understand what Flexible SSL actually does. In Flexible mode, Cloudflare encrypts the connection between the visitor and the Cloudflare edge server. However, the connection between Cloudflare and your actual web server remains unencrypted (HTTP). This is great for people who cannot install an SSL certificate on their own server.

The loop happens when your origin server has its own rule that says, “All traffic must be HTTPS.” Here is the play by play of the disaster:

1. The visitor requests your site via HTTPS.
2. Cloudflare receives this and sends the request to your server via HTTP (because it is in Flexible mode).
3. Your server sees the HTTP request and says, “No, I only allow HTTPS!” and sends a redirect back to the visitor.
4. The visitor’s browser follows that redirect and asks Cloudflare for the HTTPS version again.
5. Cloudflare again sends it to the server via HTTP.

This cycle repeats indefinitely. Your server is trying to be secure, but Cloudflare is stripping that security away before the request hits the server. This is the classic cloudflare flexible ssl redirect loop scenario.

Identifying Your Current SSL Setting

Before making changes, you should verify your current settings. Log into your Cloudflare dashboard, select your domain, and navigate to the SSL/TLS tab. You will see several options: Off, Flexible, Full, Full (Strict), and Turn off Universal SSL. If you are seeing the redirect error, you are likely currently on the Flexible setting while your WordPress or server settings are forcing HTTPS.

The “Too Many Redirects” error is a sign that your server is fighting with your CDN settings. The solution is always to make sure both ends agree on whether the connection is encrypted or not.

How to Fix the Cloudflare Flexible SSL Redirect Loop

Depending on your technical setup, there are three main ways to resolve this. The best method depends on whether you have a valid SSL certificate installed on your actual hosting server.

Method 1: Change SSL Mode to Full or Full (Strict)

This is the most effective and secure solution. If your hosting provider provides a free Let’s Encrypt certificate or if you have installed one manually, you should stop using Flexible mode entirely. Instead, switch to Full or Full (Strict).

In Full mode, Cloudflare encrypts the connection from the visitor to the edge, and also from the edge to your server. Since the request arrives at your server as HTTPS, the server is happy and does not issue a redirect. This instantly breaks the loop. Full (Strict) is even better because it validates that the certificate on your server is authentic and not self-signed.

Method 2: Disable HTTPS Redirects on the Origin Server

If you absolutely cannot install an SSL certificate on your server, you must stop the server from forcing HTTPS. If you are using WordPress, this often means checking your site URL settings. Go to Settings and General, and ensure the WordPress Address and Site Address are both set to http instead of https.

However, I strongly advise against this. Running a site on HTTP in 2024 is a security risk and will hurt your SEO rankings. It is much better to use website security services to ensure your origin server is properly locked down.

Method 3: Using Cloudflare Page Rules

Sometimes the loop is caused by a specific Page Rule you created in Cloudflare. If you have a rule that says “Always Use HTTPS,” it might conflict with your server’s internal redirects. You can try disabling the “Always Use HTTPS” toggle in the SSL/TLS Edge Certificates section to see if the loop breaks. If it does, you know the conflict is happening at the edge level.

Comparison of Cloudflare SSL Modes

Choosing the right mode is the only way to avoid future loops. Use the table below to decide which setting fits your current server capabilities.

Advanced Troubleshooting for WordPress Users

WordPress users often face a specific version of the cloudflare flexible ssl redirect loop because of how the CMS handles the HTTP_X_FORWARDED_PROTO header. When Cloudflare talks to your server via HTTP, WordPress thinks the user is visiting via HTTP, even though the user is actually using HTTPS. WordPress then tries to “fix” this by redirecting the user to the HTTPS version of the site.

If changing the SSL mode to Full does not work, you may need to tell WordPress to recognize the Cloudflare proxy. You can do this by adding a small piece of code to your wp-config.php file. This code tells WordPress that if Cloudflare says the request is HTTPS, it should believe it.

Add this code above the line that says “That’s all, stop editing! Happy publishing”:

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https') { $_SERVER['HTTPS'] = 'on'; }

This simple addition prevents WordPress from triggering its own internal redirect, effectively killing the loop while allowing you to keep your security settings intact. For those who are not comfortable editing files, reaching out to eWallz Solutions can help you manage these technical configurations without breaking your site.

Preventing Future SSL Issues

To keep your site running smoothly, follow a few simple rules when managing your DNS and SSL. First, always try to have an SSL certificate installed on your origin server. Whether it is a free one from your host or a paid one, having an “Origin Certificate” from Cloudflare is the gold standard. This allows you to use Full (Strict) mode, which is the most secure configuration possible.

Second, be careful when combining multiple redirection tools. For example, if you have a plugin like “Really Simple SSL” installed in WordPress and you also have “Always Use HTTPS” enabled in Cloudflare, you are creating two different layers of redirection. This increases the chance of a conflict. Pick one method and stick to it.

Finally, always clear your browser cache and Cloudflare cache after making these changes. Sometimes the “Too Many Redirects” error is cached in your browser, making you think the fix didn’t work when it actually did. Use an Incognito window to test your site after every change.

Summary

Fixing a cloudflare flexible ssl redirect loop usually comes down to aligning your Cloudflare settings with your server settings. The most common fix is switching from Flexible to Full or Full (Strict) SSL mode. This ensures that the connection is encrypted all the way to your origin server, preventing the server from sending unnecessary redirect requests. If you are using WordPress, a small tweak to the wp-config.php file can also solve the issue by helping the CMS recognize the proxy header.

You Might Be Wondering (FAQ)

Why does my site say “Too Many Redirects” after I enabled Cloudflare?

This usually happens because you selected Flexible SSL, but your web server is configured to force all traffic to HTTPS. The server keeps redirecting the HTTP request from Cloudflare back to HTTPS, creating a loop.

Is Full SSL better than Flexible SSL?

Yes, Full SSL is significantly more secure. Flexible SSL only encrypts the connection between the user and Cloudflare. Full SSL encrypts the entire path, including the connection between Cloudflare and your host.

Do I need to pay for an SSL certificate to use Full (Strict) mode?

Not necessarily. You can use free certificates from Let’s Encrypt or generate a free Cloudflare Origin CA certificate from your dashboard to enable Full (Strict) mode.

Will changing my SSL settings affect my SEO?

Fixing a redirect loop will definitely help your SEO because search engine crawlers cannot index a page that is stuck in a loop. Moving from HTTP to a properly configured HTTPS site also provides a small ranking boost.

Can I use a WordPress plugin to fix the redirect loop?

Some plugins attempt to fix this, but it is usually better to fix it at the Cloudflare dashboard level or via the wp-config.php file to ensure the fix happens before the page even begins to load.