What Is ERR_TOO_MANY_REDIRECTS? – Causes and Fixes
Learn why redirect loops happen, the four configurations that cause almost all of them, how to trace a chain, and how to fix each case.
ERR_TOO_MANY_REDIRECTS means the client followed redirects until it hit its limit, concluding it was in a loop. Browsers typically stop after around twenty hops.
1. What the Error Means
Two or more locations are redirecting to each other, directly or through a cycle.
- The site is reachable. Connectivity is fine.
- The loop is a configuration problem, almost always in redirect rules or session handling.
- Cookies are frequently involved, which is why clearing them sometimes appears to fix it.
2. Trace the Chain First
curl -sIL -o /dev/null -w "%{url_effective} %{http_code}\n" https://example.com/ | head -20
Or list each hop explicitly:
curl -sI https://example.com/ | grep -i "^location:"
The pattern in the chain identifies the cause immediately — the same two URLs alternating, or a longer cycle returning to its start.
3. The Four Common Causes
| Cause | Pattern |
|---|---|
| HTTP-to-HTTPS misconfiguration | Origin redirects to HTTPS while the proxy forwards as HTTP, so each hop repeats |
| Trailing slash disagreement | One rule adds a slash, another removes it |
| Authentication loop | A login page redirects to a protected page which redirects back, because the session cookie is not set or not read |
| Locale or currency redirect | Detection redirects to a regional path, which redirects back because the preference did not persist |
The first is the classic: an origin behind a proxy that terminates TLS sees plain HTTP and redirects to HTTPS forever.
4. Fixing Each Case
- Protocol loops — have the origin trust the forwarded-protocol header instead of inspecting the connection, or terminate the redirect at the proxy.
- Slash loops — pick one canonical form and implement it in exactly one place.
- Auth loops — verify the session cookie is actually being set: check its domain, path,
Secure, andSameSiteattributes. A cookie markedSecureon a plain-HTTP hop is silently dropped. - Locale loops — persist the preference before redirecting, and never redirect based on a value the redirect itself did not save.
5. What a Visitor Can Try
Clearing that site's cookies resolves loops caused by stale or malformed session state, and is the only client-side fix that regularly works. Trying a private window achieves the same thing more quickly.
If the loop persists in a fresh profile on another device, it is a server-side configuration problem.
6. In Automated Clients
Most HTTP libraries follow redirects with a configurable limit and raise an error at it. Two practices help:
- Cap the redirect count explicitly rather than relying on defaults.
- Log the chain on failure — the sequence of locations is the whole diagnosis.
For collection, a loop usually means a session or locale cookie is not being persisted between requests.
7. Real-World Examples
- A site behind a TLS-terminating proxy where the application still forces HTTPS.
- A CMS canonicalising to a trailing slash while the web server strips it.
- A login flow whose session cookie is
Securebut issued over an internal HTTP hop. - A regional redirect that never stores the chosen locale.
8. Summary
Redirect loops come from two rules disagreeing about the canonical form of a URL, or from a session that fails to persist across the redirect.
Trace the chain first — the alternating pattern names the cause — then fix the disagreement in one place rather than adding another rule on top.