What the check looks at
A4 requests your home page twice, once starting at http:// and once at https://, exactly as a visitor would, and follows every redirect itself: 301, 302, 303, 307 and 308. For each step it records the status, the Location and who redirected (WordPress names itself in X-Redirect-By; otherwise the step is marked edge or server).
An address that comes back a second time is a loop, and so is a chain longer than 10 steps. A redirect to a host other than your Site Address and WordPress Address ends the chain and is marked left this site; since version 1.0.1 the www form of your domain counts as another host. A chain that reaches a private address, such as the login page, stops there, because the plugin never requests a private address the way a visitor would.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
| Result | What it means |
|---|---|
| PassedConfidence: High | Redirects reach the page without looping The https address answers in at most 3 steps, and the http address is sent on to https. |
| FailedConfidence: High | Your site redirects in a loop A request comes back to an address it has already been sent to, so a browser gives up and nobody can reach the page. |
| WarningConfidence: High | Plain http is answered instead of redirected A visitor who types the address without https gets the page over plain http. |
| Could not checkConfidence: Medium | This check could not be completed Both chains reached a private address, such as the login page ( redirect_to_private). |
| Could not checkConfidence: Low | This check could not be completed Neither address answered, or the chain did not end at a page the plugin could read. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
redirect_to_private: Your home page redirects to a private address such as the login page, so the plugin stopped rather than requesting it the way a visitor would. When only the http chain stops, the https chain decides the result and the stop stays in the evidence.loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- The browser reports too many redirects, and the site does not open at all.
- The site opens on http:// without a padlock when someone types the address without https.
Why it happens
The usual loop: Cloudflare connects to your server over http (Flexible SSL), and the server or WordPress redirects every http request to https. Cloudflare asks over http again, and the circle closes. Cloudflare’s documentation says not to use Flexible when the origin redirects http to https (Cloudflare: Flexible).
Other loops come from two layers that disagree, for example a redirect rule at Cloudflare to www and one on the server back to the bare domain.
Confirm it by hand
Follow the chain yourself and print every step:
curl -sIL --max-redirs 10 "http://example.com/" | grep -iE "^HTTP|^location|x-redirect-by"A Location that repeats is the loop. X-Redirect-By: WordPress tells you WordPress sent that step.
How to fix it
For a loop with Flexible SSL: move to Full (strict) as check A2 explains, or stop redirecting at the server.
For http that is not redirected: turn on Always Use HTTPS, which redirects at the edge.
In WordPress: make both addresses under Settings, General https (check A3), and look at redirect plugins and server rules (.htaccess) for a second redirect that fights the first.
Limitations
A4 follows only the home page. A loop on another address, for example a single page with its own redirect, is not seen.
Redirects that depend on the visitor (country, language or device) can differ from what the server sees.
Related checks
- A2 Flexible SSL: the usual cause of the loop.
- A3 WordPress addresses still on http: WordPress addresses on http.
- E3 Cloudflare 52x errors: the other way a site stops loading.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.