HTTP to HTTPS Redirect Misconfigured: Causes and How to Fix It

A misconfigured HTTP to HTTPS redirect can cause infinite loops, ERR_TOO_MANY_REDIRECTS errors, or mixed-content warnings that damage both user experience and Google rankings. The good news: the cause is almost always one of three things — and each has a fix that takes minutes.

This guide walks through the most common HTTPS redirect errors on shared hosting and the exact steps to correct each one, whether you're using cPanel, WordPress, or editing .htaccess directly.

What "Forcing HTTPS" Means — and Why It Fails

Forcing HTTPS means automatically redirecting any request that arrives over HTTP (port 80) to its secure HTTPS equivalent (port 443). The goal is to ensure no one accesses your site over an unencrypted connection.

In theory it's simple: one line in .htaccess or a panel toggle. In practice it fails when:

• The SSL certificate is not properly installed or has expired.
• The redirect is configured in two places that conflict (cPanel + WordPress + .htaccess).
• A proxy or CDN (like Cloudflare) already applies the redirect and the server applies it again, creating a loop.
• The WordPress site URL still points to http:// in the database.
• Embedded resources (images, scripts, stylesheets) still load over HTTP — mixed content.

Error 1: Redirect Loop (ERR_TOO_MANY_REDIRECTS)

This is the most frequently reported error. The browser receives a 301 or 302 response sending it from HTTP to HTTPS… then another response sending it back from HTTPS to HTTP — an endless cycle.

Cause A: Conflict Between Cloudflare and the Server

If you're using Cloudflare with SSL mode set to Flexible, Cloudflare speaks HTTPS with the visitor but HTTP with your server. If your server also redirects HTTP → HTTPS, a loop forms.

Fix: in the Cloudflare dashboard, change the SSL mode from Flexible to Full (or Full (strict) if you have a valid certificate on the server). With Full, Cloudflare already communicates with your server over HTTPS, so the .htaccess redirect no longer conflicts.

Cause B: Duplicate Redirect (cPanel + .htaccess)

If you enabled "Force HTTPS" in cPanel and also have redirect rules in .htaccess, both execute. Leave only one:

• If you prefer cPanel: remove the manual redirect rules from .htaccess.
• If you prefer .htaccess: disable "Force HTTPS" in cPanel → Domains → Force HTTPS.

Error 2: Invalid or Missing SSL Certificate

Without a valid certificate, any redirect to HTTPS will show a security warning in the browser, and many users will abandon the site.

Check the certificate status:

1. In cPanel, go to Security → SSL/TLS.
2. Confirm that the domain has a certificate installed and that the expiry date is in the future.
3. If there is no certificate, install a free one from Let's Encrypt via SSL/TLS → Let's Encrypt™ SSL (available on most shared hosting platforms).

If the certificate was just installed, wait 10–15 minutes for it to propagate before activating the redirect.

Error 3: WordPress Site URL Still Points to HTTP

WordPress stores the site URL in the database. If you installed the CMS when the site was HTTP and later added SSL, the root URL is still http://yourdomain.com — and WordPress will keep serving resources over HTTP even if the redirect is active.

Fix via the WordPress Dashboard

1. Go to Settings → General.
2. Change both WordPress Address and Site Address to https://yourdomain.com.
3. Save and log out (the panel will prompt you to log back in).

Fix via wp-config.php (When You Can't Access the Dashboard)

Add these two lines before the line /* That's all, stop editing! */:

define('WP_HOME', 'https://yourdomain.com');
define('WP_SITEURL', 'https://yourdomain.com');

This forces the URL even if the database still holds the old value.

Error 4: Mixed Content

The site loads over HTTPS but the browser shows a broken padlock or warnings. This means some resources (images, scripts, CSS) are still loading over http://.

Steps to fix it:

1. Open your browser's developer tools (F12) → Console tab. Mixed-content resources appear as warnings.
2. In WordPress, install the Really Simple SSL or Better Search Replace plugin to replace all http://yourdomain.com URLs with https://yourdomain.com in the database.
3. For non-CMS sites, update paths manually in the source code or use protocol-relative URLs (//yourdomain.com/image.jpg).

For more comparisons of hosting providers with included SSL and active technical support, browse our hosting comparisons section.

The Correct .htaccess Redirect Rule

If you want to manage the redirect manually, here is the recommended rule for Apache (used by most shared hosting providers):

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Place it at the top of the .htaccess file, before WordPress or any other CMS rules. If you already have a RewriteEngine On block, don't duplicate the directive — just add the two rule lines.

What to Avoid in .htaccess

• Don't use R=302 (temporary) to force HTTPS in production; always use R=301 (permanent) so Google transfers the SEO value.
• Don't place the rule inside the # BEGIN WordPress block — WordPress will overwrite it.
• Don't activate the redirect before confirming the SSL certificate is installed.

Final Verification: Post-Configuration Checklist

• Open http://yourdomain.com in an incognito window and confirm it redirects to https://.
• Verify the final URL shows the padlock (or security icon) in the browser address bar.
• Use a tool like SSL Labs (ssllabs.com/ssltest) to validate the certificate configuration.
• In Google Search Console, confirm your sitemap points to the HTTPS version.
• If you use Google Analytics or a tracking pixel, update the site URL in those platforms.

Having a technical team configure and audit these redirects from the start saves hours of troubleshooting. The team at elenlace.com offers SSL configuration reviews and HTTP→HTTPS migrations with zero downtime.

Key Takeaways

• Redirect loops almost always stem from a conflict between Cloudflare in Flexible mode and a server-side redirect.
• Without a valid SSL certificate installed, activating an HTTPS redirect only produces security errors.
• With WordPress, update the site URL in Settings → General in addition to adding the .htaccess rule.
• Mixed content requires a database URL replacement, not just enabling HTTPS.
• Always use R=301 (permanent redirect) so Google transfers your ranking value.
• Verify the result with SSL Labs and in Google Search Console before calling the job done.

Managing multiple domains or running an online store where downtime isn't an option? Contact the specialists at elenlace.com for a seamless HTTPS migration with no disruption to your SEO.

FAQ

How long does it take Google to index the site with HTTPS after migration?

If the 301 redirect is properly configured, Google detects the change on its next crawl, which can happen within hours or days depending on how frequently Googlebot visits your site. For medium-traffic sites, rankings typically stabilize within 1–2 weeks.

Will I lose my rankings when switching from HTTP to HTTPS?

A well-executed migration using permanent 301 redirects should not cause long-term ranking loss. You may see minor fluctuations during the first few days while Google re-indexes, but the ranking signal is transferred via the 301.

Can I force HTTPS in cPanel without editing .htaccess?

Yes. In modern cPanel, go to Domains → Domain Manager, find your domain, and enable the "Force HTTPS" option. This inserts the rules into .htaccess automatically — no manual editing required.

Is a Let's Encrypt SSL certificate enough for an online store?

For most small and medium-sized stores, yes. Let's Encrypt issues DV (Domain Validation) certificates that encrypt the connection just as well as a paid certificate. Organizations that need to display OV (Organization Validation) or EV (Extended Validation) indicators in the browser address bar require a commercial certificate.

Useful resources

Other providers and guides worth comparing:

• HostGator México
• Hostinger
• HubSpot