ERR_TOO_MANY_REDIRECTS

The site keeps redirecting the browser in a circle, usually between HTTP and HTTPS or between two domains, so the browser stops trying.

Browser page
This page isn’t working my-app.com redirected you too many times. Try deleting your cookies. ERR_TOO_MANY_REDIRECTS

Also appears as

  • The page isn’t redirecting properly Firefox has detected that the server is redirecting the request for this address in a way that will never complete.
  • Safari Can’t Open the Page Too many redirects occurred trying to open “https://my-app.com/”. This might occur if you open a page that is redirected to open another page which then is redirected to open the original page.

Prompt to fix it

My deployed site shows "ERR_TOO_MANY_REDIRECTS" ("redirected you too many times"). Find every place that can redirect: auth middleware and route guards, redirect rules in vercel.json, netlify.toml, or _redirects, and framework config. Trace the loop and fix it at its source. If auth sends visitors to /login, exclude the login, signup, and auth callback routes from that check. Redirect between www and the bare domain in one place only. If the domain sits behind Cloudflare, tell me to set its SSL/TLS mode to Full (strict) instead of adding more redirects. Keep the redirects that protect private pages.

Paste into Layerwise or any AI coding tool.

What it means

A redirect tells the browser “this page lives at another address.” This error means the redirects form a loop: address A sends the browser to B, and B sends it back to A. Chrome and Firefox give up after 20 redirects and show this page.

On sites behind Cloudflare, the classic cause is the Flexible SSL/TLS mode. Visitors reach Cloudflare over HTTPS, but Cloudflare reaches your host over plain HTTP. Hosts like Vercel and Netlify answer HTTP with a redirect to HTTPS, Cloudflare passes that redirect back to the visitor, and the visitor’s next HTTPS request reaches the host as HTTP again.

Deleting cookies, as Chrome suggests, rarely helps. The loop lives in your settings, so check every layer that can redirect: the Cloudflare proxy, the host’s domain settings, redirect rules, and the app’s own sign-in checks.

Common causes

  • Cloudflare’s SSL/TLS encryption mode is set to Flexible while the host redirects HTTP to HTTPS.
  • The host redirects www to the bare domain while a Cloudflare rule redirects the bare domain back to www.
  • Auth middleware sends signed-out visitors to /login, and the same check also runs on /login, so the login page redirects to itself.
  • A redirect rule in vercel.json, netlify.toml, _redirects, or Cloudflare matches its own destination.

How to fix it

  1. Run curl -sIL https://my-app.com | grep -i location, or check the Network tab with Preserve log on, to see which addresses bounce back and forth.
  2. If the domain uses Cloudflare’s proxy, open SSL/TLS in the Cloudflare dashboard and set the encryption mode to Full (strict).
  3. Pick one canonical address, www or the bare domain, and set that redirect in one place, usually the host’s domain settings. Remove any matching Cloudflare redirect rules.
  4. If the loop involves /login, make the auth check skip the login, signup, and auth callback routes.
  5. Retest in a private window after each change, because browsers cache permanent 301 and 308 redirects.

Related errors

All errors
Your connection is not private Attackers might be trying to steal your information from my-app.com (for example, passwords, messages, or credit cards). Learn more about this warning NET::ERR_CERT_COMMON_NAME_INVALID

NET::ERR_CERT_COMMON_NAME_INVALID

The site’s security certificate was issued for a different domain name, so the browser can’t confirm it’s really your site.

Connection timed out Error code 522 Visit cloudflare.com for more information. 2026-10-27 18:42:10 UTC

Error 522: Connection timed out

Cloudflare couldn’t open a connection to the server behind your site in time, so it showed its own error page in place of your app.

Mixed Content: The page at 'https://my-app.com/' was loaded over HTTPS, but requested an insecure resource 'http://api.example.com/items'. This request has been blocked; the content must be served over HTTPS.

Mixed Content: requested an insecure resource

Your secure https page tried to load data or code over plain http, and the browser blocked that request to keep the page secure.

This site can’t be reached Check if there is a typo in my-app.com. If spelling is correct, try running Network Diagnostics. DNS_PROBE_FINISHED_NXDOMAIN

DNS_PROBE_FINISHED_NXDOMAIN

The browser asked DNS where your domain lives and was told the name doesn’t exist, usually because a record is missing or still spreading.

Build with an agent that checks its work

The Layerwise agent clicks through the live preview and reads the console, so it catches errors before you do.

DownloadRead the docs