How to Stop Site From Redirecting: Fix Loops & Hacks

If your site is throwing "too many redirects" at visitors, or quietly bouncing traffic to an unfamiliar domain, you're dealing with one of two problems: a configuration mistake looping back on itself, or an intruder who has planted redirect code on your server. Figuring out which one you have is the first step toward learning how to stop a site from redirecting for good — the fixes are completely different, and applying the wrong one wastes time while the problem keeps costing you traffic.

Why Your Website Keeps Redirecting

In most cases, this comes down to two distinct root causes.

The first is a misconfiguration loop — something in your own setup tells browsers to bounce between two or more URLs indefinitely. Common causes include stale browser cache, a broken .htaccess file, an SSL/TLS mismatch between HTTP and HTTPS versions of your site, DNS or domain-forwarding rules pointing in circles, or a CMS plugin conflicting with your site's URL settings. These are technical problems you can usually diagnose and fix yourself.

The second is a hijacked or malicious redirect — your site sending visitors to a spam page, fake storefront, or scam landing page that has nothing to do with your content. This happens when injected code or malware has been planted in your files, database, or theme, and it's a security incident rather than a configuration slip. It typically doesn't loop; it sends visitors somewhere else cleanly, which is a useful diagnostic clue.

Once you know which category you're in, jump to the matching section below.

How to Fix a Redirect Loop on Your Own Site

If your browser shows ERR_TOO_MANY_REDIRECTS on your own domain, work through these steps in order — fastest and lowest-risk first, most involved last.

Clear Cache, Cookies, and Test in Another Browser First

Before touching any code, clear your browser's cache and cookies for the site, then reload. Browsers cache old redirect rules aggressively, especially ones that force HTTPS, so a stale local cache alone can produce a loop that no longer exists on the server. Next, open a private/incognito window and load the site fresh. If it loads fine there or on a different device, the problem was local to your browser and you're done. If the loop persists in incognito or on another device, the issue lives on the server side, and you'll need to keep working through the steps below.

Check Your CMS URL Settings and Plugins

For WordPress sites, one of the most frequent causes is a WordPress Address (URL) and Site Address (URL) mismatch under Settings > General — if these fields don't match, or one still points to an old domain or http:// instead of https://, the site can loop trying to reconcile them. Correct both to match your live, secure domain.

If settings look correct, the next suspect is a plugin conflict — particularly caching plugins, security plugins, or anything handling redirects or SSL enforcement. Rename your plugins folder via FTP or your host's file manager to deactivate all plugins at once without needing dashboard access, then check if the site loads. If it does, rename the folder back and reactivate plugins one at a time, reloading after each, until you find the culprit.

Review .htaccess, SSL, and DNS/Domain Forwarding Rules

If clearing cache and checking plugins didn't resolve it, the cause is likely deeper in your server configuration. An .htaccess loop often happens when multiple rewrite rules conflict — for example, one rule forcing www and another forcing non-www, or duplicate HTTPS-enforcement rules stacked by both your CMS and a plugin. Back up your current .htaccess file, then temporarily replace it with a default version to see if the loop clears; if it does, the issue is in your custom rules, and you can rebuild them one at a time.

An SSL redirect loop fix usually means checking that your certificate is active and correctly installed, and that your CMS, CDN, and hosting panel aren't each independently trying to force HTTPS — a common cause when a service like Cloudflare is set to "Flexible" SSL while your server also forces a redirect, creating a loop between HTTP and HTTPS.

Finally, check DNS records for a CNAME loop — this occurs when a CNAME record points to a domain that eventually points back to the original, or when domain forwarding is set up at the registrar level while separate redirect rules exist on the server. Your host's server logs will usually show the redirect chain explicitly, making it much faster to spot exactly where the loop closes.

If It's Malicious: Signs Your Site Was Hacked

A site redirecting to a spam site, gambling page, or unfamiliar storefront — especially only for some visitors, like those coming from Google search results — is a strong signal of a malicious redirect hack rather than a configuration error. Other signs include new admin accounts you didn't create, unfamiliar files in your theme or plugin directories, a spike in outbound links reported by Google Search Console, or a manual action notice in Search Console itself.

For a WordPress hacked redirect, the cleanup sequence is: run a full malware scan using a reputable security plugin or your host's built-in scanner; identify and remove injected code, which often hides in functions.php, header/footer templates, or database options tables; check core CMS files against a clean copy to spot unauthorized changes; and, if the infection is extensive, restore from a clean backup taken before the compromise. Change all passwords — admin, database, hosting, FTP — as part of the same pass, since a single leaked credential is usually how the injection got in.

How to Stop This From Happening Again

Both scenarios share the same prevention playbook. Keep regular backups so a restore is always an option rather than a last resort. Keep your CMS core, themes, and plugins updated, since outdated software is the single most common entry point for the injected code behind malicious redirects. And put monitoring in place so you're not relying on customer complaints or a Google manual action to find out something's broken.

Manual checks only catch problems you already suspect. A proper website audit tool checks continuously for broken redirects, SSL mismatches, and the security signals that precede a hijack — the kind of underlying site health issue covered in more depth in Website Health Check: What It Really Means in 2026.

Fixing a redirect loop or cleaning up a hack is reactive by nature — you're always responding after traffic and conversions have already taken a hit. Scheduling recurring automated audits with Optimevra flips that around, flagging redirect chains, certificate mismatches, and conversion-killing issues before visitors or Google ever encounter them. See it in action with the live demo, or compare plans on the pricing page once you're ready to put ongoing monitoring in place.

Frequently Asked Questions

Why does my website keep redirecting to another site?

It's usually either a misconfiguration — mismatched HTTP/HTTPS settings, conflicting .htaccess rules, or DNS forwarding errors — or a malicious hijack where injected code sends visitors elsewhere. Loops within your own domain point to configuration; being sent to an entirely different, unfamiliar domain points to a hack.

How do I fix the ERR_TOO_MANY_REDIRECTS error on my own site?

Start by clearing your browser cache and testing in incognito mode to rule out a local issue. If it persists, check your CMS URL settings for mismatches, disable plugins to isolate a conflict, and review your .htaccess, SSL, and DNS configuration for conflicting redirect rules.

Can clearing my cache and cookies really fix a redirect loop?

Yes, in many cases. Browsers cache old HTTPS-enforcement or redirect rules, so if a server-side issue was already fixed, your browser might still be acting on outdated cached instructions until you clear it.

How do I know if my site was hacked and is causing the redirects?

Look for redirects to unfamiliar domains (especially only from search traffic), new admin accounts you didn't create, unrecognized files in your theme or plugin folders, or a manual action notice in Google Search Console. A malware scan will confirm injected code if these signs are present.

Does a WordPress setting cause sites to redirect to the wrong URL?

Yes — a mismatch between the WordPress Address (URL) and Site Address (URL) fields under Settings > General is one of the most common causes. Both should match your live, secure domain exactly, including the https:// protocol.

Will fixing a redirect loop or hack hurt my Google rankings?

No, resolving the underlying issue protects your rankings rather than harming them. Google penalizes sites that stay broken or compromised, so a prompt fix, followed by a request for reindexing if needed, is the path back to normal visibility.