Redirect HTTP to HTTPS without loops

An HTTPS redirect should send visitors from plain HTTP to HTTPS on your canonical host in a single 301. When plugins, .htaccess, WordPress settings, and a CDN all force HTTPS at once, browsers hit “too many redirects” and the site stops loading. Keep one place that writes the redirect, then make every other layer agree with that URL.

Count the hops before you change anything

Start by checking what the server actually returns. A quick curl check shows each Location header so you can see the chain instead of guessing.

curl -sI http://example.com | head -n 20

You want one 301 or 302 to your final https URL, then a 200. If you see http to https and back to http, something is still treating the site as insecure. Common causes are WordPress siteurl still set to http while the server forces https, a CDN sending HTTPS to origin while origin redirects back to the CDN hostname, or a plugin sending traffic to www while .htaccess sends www back to the apex.

Choose one canonical host and one writer

Decide whether the live site is www or apex, then 301 the other hostname to it. After that hop is settled, redirect HTTP to HTTPS. Do the redirect in LiteSpeed through .htaccess or at the CDN, not in both places. Set WordPress Address (URL) and Site Address (URL) to the full canonical https address so the application stops issuing its own redirects. If the server already redirects to HTTPS, turn off any force-HTTPS plugin. Add HSTS only after curl shows a single clean hop.

Clear caches and retest both hostnames

When the redirect chain is quiet, purge LiteSpeed Cache so old 301 responses are not still served. Test apex and www, and check trailing-slash rules if you rewrote those as well. Leave mail and API hostnames out of a blanket www redirect when they must stay on a fixed name. On a CDN, treat the edge rule and the origin protocol as two separate writers. Fix origin so the canonical https host returns 200, then let the edge handle at most the www-or-apex hop. WordPress behind that stack should already believe it is on https, or it will emit another Location and the hop count climbs again.

One canonical web host and one 301 onto it is the whole design. Shared hosting here uses cPanel with LiteSpeed, so .htaccess redirects and AutoSSL fit that model without root access. Two hops can be acceptable while you finish www versus apex; five hops means another layer is still fighting the first.