PHP Headers Already Sent: Find the First Output

You call header() to redirect a request, but the browser stays on the old page—or PHP refuses to set a cookie. A headers already sent warning usually means response-body output began before PHP tried to send the header. The line calling header() may be fine; the useful clue is the first output, which often comes from an earlier include.

Ask PHP where output started

headers_sent() can return the filename and line where headers were sent. During development, log those values rather than printing a full server path on a public error page.

$file = '';
$line = 0;

if (headers_sent($file, $line)) {
    error_log("Headers started at {$file}:{$line}");
}

This check does not repair the response; it narrows the search. If the reported line has no visible echo, inspect the start of the file for a UTF-8 byte-order mark, whitespace after a closing ?>, output from an included template, or a PHP warning that was displayed to the browser.

If PHP points to the entry script, trace the bootstrap and its includes in order. If it points to an included file, inspect the content produced before that line. Omitting the closing PHP tag in files that contain only PHP reduces the chance that trailing whitespace becomes response output.

Keep redirects before rendering

Perform session and authorization checks before loading a template or emitting HTML. Once the decision is made, send the redirect and stop the current request:

header('Location: /account', true, 302);
exit;

Use a permanent redirect only when the move is genuinely permanent; browsers can cache it and make later testing confusing. The same header-order rule applies to HTTPS redirects. See redirecting to HTTPS with PHP for that separate setup.

Do not hide the source with buffering

ob_start() is appropriate when output buffering is part of the response design. Adding it to every page just to silence this warning can hide the file that emitted output and increase memory use. First remove or move the unintended output; buffer only when the application deliberately needs to assemble a response before sending it. PHP documents the behavior and parameters of headers_sent() and header().