[JAY]

CloudPanel too many redirects or mixed content after SSL: how to fix

You installed an SSL certificate, and now the browser says ERR_TOO_MANY_REDIRECTS ("redirected you too many times"), or the site loads but the padlock is broken and some images or styles are missing. Both are very common after switching a site to HTTPS. Here's what causes them and how to fix each one.

Part 1: "Too many redirects"
A redirect loop means two parts of your setup disagree: one says "go to HTTPS", the other says "go back to HTTP", forever.

Cause 1: Cloudflare SSL set to "Flexible" (most common). With Flexible, Cloudflare talks to your server over plain HTTP. Your server (or WordPress) redirects HTTP to HTTPS, Cloudflare asks over HTTP again, and so on.
Fix: in Cloudflare, go to SSL/TLS > Overview and choose Full (strict). Your CloudPanel site needs a valid certificate for this, which a Let's Encrypt or Cloudflare Origin certificate gives you. Full setup steps are in How to set up Cloudflare with CloudPanel.

Cause 2: WordPress URLs disagree. WordPress stores its own address. Check it with WP-CLI (as the site user, in the site folder):

Code:Copy

cd ~/htdocs/example.com wp option get home wp option get siteurl

Both should be

Code:Copy

https://example.com

(with or without www, but the same as the domain you actually use). Fix them:

Code:Copy

wp option update home 'https://example.com' wp option update siteurl 'https://example.com'

Also check

Code:Copy

wp-config.php

for hard-coded

Code:Copy

WP_HOME

/

Code:Copy

WP_SITEURL

lines from an old setup.

Cause 3: www and non-www fight each other. For example, a plugin forces

Code:Copy

www.example.com

while a vhost rule forces

Code:Copy

example.com

. Pick one version, make WordPress use it, and remove the other redirect.

Cause 4: a redirect plugin plus a server redirect. "Really Simple SSL"-style plugins and your own vhost redirect can stack up. Use one place for the HTTP→HTTPS redirect, not three.

Find the loop yourself:

Code:Copy

curl -sIL http://example.com | grep -iE '^(HTTP|location)'

This prints every hop. You'll see the address bouncing between two values; that tells you which two settings disagree.

Part 2: mixed content (broken padlock, missing styles)
The page itself loads over HTTPS, but some images, scripts or CSS files still use

Code:Copy

http://

links. Browsers block or warn about those.

Find them: open the page, press F12, and look at the Console tab. Every "Mixed Content" warning names the exact file.

Fix them in WordPress by replacing old links in the database. Always do a dry run first and take a database backup:

Code:Copy

wp db export ~/before-https.sql wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run wp search-replace 'http://example.com' 'https://example.com' --all-tables

Repeat for

Code:Copy

http://www.example.com

if the old site used www. More WP-CLI tips: WP-CLI on CloudPanel.

Links hard-coded in your theme files, or loaded from other sites over http, must be changed in the files themselves.

Then purge every cache: the site's Varnish cache in CloudPanel, any WordPress cache plugin, Cloudflare (Caching > Purge Everything) and your browser.

Certificate itself not working?
If the browser complains about the certificate (not the redirects), see How to install a free Let's Encrypt certificate in CloudPanel and CloudPanel SSL renewal failed.

Sources: Cloudflare: too many redirects · WP-CLI: search-replace


More CloudPanel troubleshooting

• Installation failed: common install errors
  
• Can't log in: port 8443, password and 2FA
  
• Site shows 403 Forbidden or 404
  
• PHP extension missing / enable ionCube
  
• WordPress asks for FTP or can't update plugins
  
• Varnish showing old pages or breaking logins
  
• Restore a site from a backup
  
• SSH or SFTP login fails
  
• Node.js app shows 502 or keeps restarting
  
• Site hacked: find malware and clean up
  
• clpctl errors: not found, wrong user, quoting
  

Applies to CloudPanel v2 on Ubuntu and Debian, October 2026. Replace

Code:Copy

example.com

with your domain.