Headers already sent PHP Origin: Application & API Last updated 12 Oct 2026

Warning: Cannot modify header information - headers already sent

You called header(), setcookie() or session_start() after output had already been sent to the browser.

Exact message you may see headers already sentCannot modify header informationsession_start(): Session cannot be started after headers have already been sent
Seen on: PHP WordPress

Meaning

HTTP headers must come before the body. Any output — even a single space before <?php, a BOM, or an echoed warning — flushes headers. The message tells you exactly where output started: “output started at /path/file.php:12”.

Common causes

  • Whitespace or blank lines before <?php or after a closing ?>
  • UTF-8 BOM at the start of a file
  • echo/HTML before header() redirect
  • PHP notices/warnings printed before headers

⚡ Quick fix

  1. Open the file/line in “output started at…” and remove the output
  2. Omit closing ?> in pure-PHP files
  3. Save files as UTF-8 without BOM
  4. Do redirects/cookies before rendering any HTML

Detailed fix by platform

PHP

  1. As a last resort ob_start() at the very top buffers output, but fix the real cause.

Code examples

Output before header() — and the fix

php
<?php
echo '<p>Saving…</p>';           // ❌ output already sent
header('Location: /done.php');  // Warning: Cannot modify header information

<?php
saveOrder($data);               // ✅ do the work and redirect first
header('Location: /done.php');
exit;

Find a BOM or whitespace before <?php

bash
head -c 3 config.php | xxd        # "efbb bf" at the start = UTF-8 BOM
grep -rlI $'^\xEF\xBB\xBF' --include=*.php .

Re-save those files as "UTF-8 without BOM" and drop closing ?> tags in pure PHP files.

How to diagnose

  1. Output start — Which file:line does the warning name?
  2. Encoding — BOM present?
  3. Order — Is header() called after HTML?

🔧 Still not fixed?

Many errors look alike. If the steps above didn’t solve it, one of these is probably what you’re facing:

Where this error sits

Origin: Application & API. Errors that are often confused with or caused by this one (click to open):

100 — HTTP 100 Continue (HTTP)100103 — HTTP 103 Early Hints (HTTP)1031040 — Cloudflare Error 1040 / 1041: Invalid request header modification (Cloudflare)1040416 — HTTP 416 Range Not Satisfiable (HTTP)416500 — HTTP 500 Internal Server Error (HTTP)500BOM output — Unexpected characters at the top of the page / headers already sent by BOM (PHP)BOM outputCall to undefined function — PHP Fatal error: Uncaught Error: Call to undefined function (PHP)Call to undefined fun…Cookies are blocked — WordPress login: Error: Cookies are blocked or not supported by your browser. You must enable cookies to use WordPress. (WordPress)Cookies are blockedHeaders a…

Explore the map of this error Full error map →

🧠 Still stuck? Analyze your error

Paste the full message, response headers or stack trace — we'll detect the platform and point to the most likely cause.

💬 What worked for others

No tips yet — did something else fix this for you?

Share what worked for you

Tips are checked by an editor before they appear. Links are removed.