Glossary

Redirect loop

A redirect loop is a cycle of HTTP redirects that never reaches a final response: A points to B, B points back to A, and the client follows until it gives up. Browsers stop after a fixed number of hops and show an error; crawlers stop and record the URL as unreachable. A loop is almost never one broken rule — it is two rules that are each correct in isolation and contradict each other when both apply to the same request.

What a client does when it finds one

Browsers cap the number of redirects they will follow — typically around twenty — and then display an error stating that the page is not redirecting properly.

Command-line clients behave the same way with an explicit limit: curl's `-L` follows up to a maximum and then reports that the number of redirects was exceeded.

Search engine crawlers abandon the URL. It cannot be indexed, because no content was ever served, and it is reported as a redirect error rather than as a missing page.

Nothing downstream can be measured: a page trapped in a loop has no HTML, no headers of its own, and no content to evaluate.

Where loops come from

Two canonicalisation rules disagreeing. One rule adds a trailing slash, another removes it; one forces `www`, another forces the apex. Each is defensible; together they alternate forever.

HTTP-to-HTTPS enforcement behind a proxy that terminates TLS. The application sees a plain HTTP request from the proxy, redirects to HTTPS, the proxy forwards it again as HTTP, and the cycle closes. The fix is the forwarded-protocol header, not another rule.

Authentication logic that redirects an unauthenticated visitor to a login page that itself requires authentication.

Localisation that redirects a visitor to a language version whose own rules redirect back — common when the language is inferred from an IP address rather than from an explicit choice.

A CMS-level redirect and a web-server-level redirect for the same path, written by different people at different times, neither aware of the other.

Loops and chains are different findings

A chain is several redirects that do reach a destination. It works, it is just slower than it needs to be, and each hop dilutes the signal slightly.

A loop never reaches a destination. It is a hard failure, and the page is unavailable to everyone.

The diagnosis overlaps, because a long chain and a loop look alike until you see the repeated URL, but the urgency does not: a chain is a cleanup task, a loop is an outage on those URLs.

Both are found the same way — by following the redirects and recording each hop — which is why a tool that reports one normally reports the other.

How to trace one

`curl -sSIL https://example.com/path | grep -iE "^(HTTP|location)"` prints each hop's status and target in order. The repeated pair of URLs is the loop.

Read the sequence rather than the endpoint. The two URLs that alternate name the two rules in conflict, and one of them is the one to remove.

Check the protocol on each hop. A loop between the same path on `http` and `https` is almost always a proxy not forwarding the original scheme.

Test with and without a trailing slash, and with and without `www`. Most loops on a well-configured site are found by one of those four combinations.

Frequently asked questions

How many redirects is too many?
A loop is unbounded and always a failure. For working chains, one hop is ideal and more than three is worth removing — each adds a full round trip.
Why does the loop only happen on the live site?
Because a proxy or CDN in front of the application only exists there. It terminates TLS and forwards plain HTTP, which triggers the application's own HTTPS redirect.
Can a redirect loop be cached?
A 301 in the cycle can be cached by the browser, which makes the loop persist for that visitor even after the server-side rule is fixed.

Sources

Related

VeriFixScan crawls a site and applies its checks to every page it reaches, keeping the evidence behind each finding. Scanning one website is free.

Scan a website