PHP Warning: Cannot Modify Header Information — Headers Already Sent — What It Means & How to Fix It

What Does This Error Mean?

This PHP warning means you are calling a function that must send HTTP headers (like header(), setcookie(), or session_start()) after some HTML or output has already been sent to the browser. HTTP headers must be sent before any output — once a single character of output is sent, headers are locked. The fix is to ensure no output (not even a blank line or space) occurs before your header() or session_start() calls. A BOM character in a file or whitespace before <?php are the most common accidental causes.

Affected Models

PHP 7.4
PHP 8.0
PHP 8.1
PHP 8.2
PHP 8.3

Common Causes

HTML or whitespace appears before <?php in your PHP file, sending output before the header call
A file included or required before the header call contains output or whitespace outside of PHP tags
An echo, print, or var_dump statement appears before a header() or session_start() call
A UTF-8 BOM (Byte Order Mark) character is invisibly present at the start of the PHP file
An error or warning message is being displayed before the header call, which counts as output

How to Fix It

The error message tells you exactly where output started. Read it carefully: 'Cannot modify header information - headers already sent by (output started at /path/to/file.php:12)'. Open that file at that line and look for any output.

Line 1 often means there is whitespace or a BOM character before the opening <?php tag — these are invisible in most text editors.
Ensure your PHP file starts with <?php on the very first character of the first line. No spaces, no blank lines, no HTML — nothing before <?php.

Many 'headers already sent' errors are caused by a single blank line or space before <?php that is easy to miss when scrolling.
Check all included and required files. If any file loaded before your header() call contains output or whitespace outside PHP tags, it will trigger this error. The include chain counts — check all of them.

A common culprit is a config.php or functions.php that was saved with a trailing newline after the closing ?> tag.
Save all PHP files without a UTF-8 BOM. Open the file in a code editor that supports BOM detection (VS Code, Notepad++). Look for 'UTF-8 with BOM' encoding and re-save as 'UTF-8' without BOM.

BOM characters are completely invisible in the browser but are sent as output before your PHP code runs, causing this error on the first header() call.
Use output buffering as a temporary fix. Add ob_start() as the very first line of your main script. This buffers all output and sends it after headers. Note: this masks the problem rather than fixing it — also track down and remove the premature output.

ob_start() is acceptable as a permanent fix in some architectures, but it is best practice to also eliminate the premature output.
Remove or suppress error output that appears before headers. If PHP error reporting is printing warnings or notices before your header() call, those messages count as output. Disable display_errors in php.ini or use error_log to log errors instead of displaying them.

In production, display_errors should always be Off. Log errors to a file and review the log rather than displaying them to users.

When to Call a Professional

This is a PHP output buffering and header ordering issue — no external service is needed. You fix it entirely by restructuring your PHP file to ensure all header calls come before any output. A good code editor with UTF-8 BOM detection can help find invisible BOM characters.

Frequently Asked Questions

Why can't I send headers after output in PHP?

HTTP requires that headers come before the response body in the data stream. Once PHP sends the first byte of output to the browser, the HTTP response body has started and headers are sent automatically. Any subsequent call to header() arrives too late — the headers have already been transmitted. This is not a PHP limitation but an HTTP protocol requirement.

What is a UTF-8 BOM and how do I remove it?

A BOM (Byte Order Mark) is a hidden 3-byte sequence (0xEF 0xBB 0xBF) that some text editors add to UTF-8 files to indicate the file's encoding. PHP treats this as literal output, sending it to the browser before your script runs. To remove it: in VS Code, click the encoding shown in the bottom right status bar > select 'Save with encoding' > choose 'UTF-8' (not 'UTF-8 with BOM'). In Notepad++: Encoding menu > Convert to UTF-8 (without BOM).

Should I use ob_start() to avoid this error?

ob_start() is a valid and widely-used solution, especially in frameworks and CMS systems. It buffers all output so that header() calls work even if output was started earlier. However, using ob_start() without also fixing the root cause means premature output still exists — it is just hidden. For your own code, fixing the premature output is cleaner. For legacy or third-party code where you cannot control all includes, ob_start() is a practical solution.