Fix WordPress redirect loop (.htaccess)

Quick reset (safe order)

1. Back up & reset .htaccess: rename .htaccess to .htaccess.bak, then visit Settings → Permalinks and click Save to regenerate default rules. This writes the official WordPress rewrite block.
2. Verify WordPress URLs: in Settings → General, make sure WordPress Address (URL) and Site Address (URL) are correct (usually identical and including https://). You can also check/update via WP‑CLI:

   wp option get home
   wp option get siteurl
   wp option update home 'https://example.com'
   wp option update siteurl 'https://example.com'

   These govern how WordPress generates links.

3. Clear caches: purge plugin/page cache and any CDN after changes.

If the site loads now, add any HTTPS/WWW redirect carefully (see the next answer) so you don’t reintroduce a loop.

Default WordPress .htaccess (Apache)

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress

Regenerate this block by saving Settings → Permalinks if needed.

Canonical HTTPS/WWW rules (place above the WordPress block)

Choose ONE of the following and replace example.com with your domain. Put it above “# BEGIN WordPress”.

Force HTTPS (keep host as is)

RewriteEngine On
# If behind a proxy that sets X-Forwarded-Proto, also check it:
RewriteCond %{HTTP:X-Forwarded-Proto} !https [OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Force HTTPS + non‑www

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP:X-Forwarded-Proto} !https [OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Force HTTPS + www

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\.example\.com$ [NC]
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]
RewriteCond %{HTTP:X-Forwarded-Proto} !https [OR]
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://www.example.com%{REQUEST_URI} [L,R=301]

Why the proxy condition? If you’re on Cloudflare Flexible SSL or any SSL‑terminating proxy, the origin may think the request is HTTP and keep redirecting. Checking X‑Forwarded‑Proto, or using Cloudflare’s Full/Full (strict) mode, prevents loops.

Cloudflare loop fix

1. In Cloudflare → SSL/TLS, switch encryption from Flexible to Full (or Full (strict)) so Cloudflare connects to your origin via HTTPS.
2. Remove duplicate HTTPS rules at the origin (keep either origin redirects or Cloudflare’s Always Use HTTPS, not both).
3. Optionally install Cloudflare’s WordPress plugin and enable Automatic HTTPS rewrites to reduce mixed‑content issues.

Reverse proxy/load balancer (HTTPS detection)

Tell WordPress it’s actually being requested via HTTPS when a proxy sets X‑Forwarded‑Proto:

// Add near the top of wp-config.php, before "require_once ABSPATH . 'wp-settings.php';"
if ( isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https' ) {
    $_SERVER['HTTPS'] = 'on';
}

This prevents is_ssl() mis‑detecting the scheme and causing redirect loops. WooCommerce/WordPress dev docs recommend this approach for proxied sites.

Subdirectory installs (common loop source)

1. Make sure Site Address (URL) is the root (e.g., https://example.com) and WordPress Address (URL) points to the subdir (e.g., https://example.com/wordpress) if you’re intentionally running that layout.
2. Use the default WordPress rewrite block at the domain root (see the default snippet above). Avoid stacking multiple WordPress blocks for both / and /wordpress—that can loop.

Confirm the loop (CLI & browser)

• cURL: follow redirects and inspect status/location:

  curl -I -L https://example.com

• DevTools: open Network tab, reload, and watch the 301/302 chain (often http↔https or www↔non‑www bouncing).

When you see alternating targets, look for duplicate HTTPS or host‑canonical rules in .htaccess or proxy/CDN settings. (cURL -L follows redirects.)

Other things that commonly cause loops

• Two HTTPS enforcers at once (e.g., host panel “Force HTTPS” + .htaccess rule + CDN rule).
• Mismatched URLs (admin uses https://www, front uses https://non‑www) — align both home and siteurl.
• Plugin rewrite blocks left behind in .htaccess after uninstall—compare against the default block and remove or re‑add the plugin.
• Cache (page/object/CDN) serving old redirects—purge after every change.