Fix PHP Headers Already Sent & Session Start Errors

This guide explains how to resolve the common PHP errors “headers already sent” and “session start(): session_start(): Cannot send session cache limiter – headers already sent”. These errors occur when output is sent to the browser before PHP tries to send HTTP headers (which include cookies for sessions). You’ll learn the causes and step-by-step fixes, from simple whitespace removal to restructuring your code.

What You’ll Need

• Access to your PHP files (via FTP, file manager, or a code editor).
• A text editor that shows invisible characters (like Notepad++, VS Code, or Sublime Text).
• Basic understanding of PHP syntax and file structure.

Step-by-Step

1. Identify the exact error message. The error will usually include a file name and line number, e.g., “Warning: Cannot modify header information – headers already sent by (output started at /path/to/file.php:12)”. This tells you exactly which file and line caused the output.
2. Check for whitespace or BOM before <?php. Open the file mentioned in the error. Look at the very top. There must be absolutely nothing before <?php — not even a single space or a newline. Also check for a UTF-8 Byte Order Mark (BOM), which is an invisible character at the start of the file. In your editor, enable “show all characters” or “show whitespace”. If you see any dots or spaces before <?php, delete them and save the file as UTF-8 without BOM.
3. Check for output after ?>. If your file has a closing PHP tag ?> at the end, there might be whitespace or a newline after it. That whitespace is sent to the browser. The safest fix is to remove the closing ?> tag entirely from files that contain only PHP code. This is a recommended practice in modern PHP.
4. Look for echo, print, or HTML before header()/session_start(). In the file where the error occurs, search for any echo, print, printf, or raw HTML (like <!DOCTYPE html> or a <div>) that appears before your header() or session_start() call. Move the PHP functions to the very top of the file, before any output.
5. Check included files. The error might point to a file that is included via include or require. If that included file has whitespace or output, it will also trigger the error. Apply the same checks to every included file.
6. Use output buffering (temporary fix). At the very top of your main script, before any output, add ob_start();. This buffers all output and sends it only after headers are processed. It’s a quick fix, but not a permanent solution — you should still find and remove the actual output source.
7. Restructure your code. If you have functions that send output before you call session_start(), refactor them. For example, move session_start() to the top of your script, or use a bootstrap file that starts the session before any other code runs.

Common Mistakes

• Leaving a closing ?> tag — even if there’s no whitespace after it, some editors add a newline automatically. Removing it is the best practice.
• Using UTF-8 BOM — many editors (especially on Windows) add a BOM by default. This is invisible but counts as output.
• Calling session_start() after include that has HTML — the included file’s output counts as output.
• Forgetting that header() can be called multiple times — but only before any output. If you call it after output, the error appears.

Tips

• Enable error reporting in development: error_reporting(E_ALL); ini_set('display_errors', 1); — this shows all warnings, making it easier to spot the exact file and line.
• Use a consistent coding style — always place session_start() and header() at the very top of your script, before any HTML or whitespace.
• Consider using a front controller pattern — route all requests through a single index.php that starts the session and then includes other files. This centralizes session handling.
• In production, set display_errors to Off — but log errors to a file. This prevents users from seeing ugly warnings.

Troubleshooting

If the error persists after following the steps:

• Check all files in the include chain. The error message might point to a file, but that file might be included from another file that also has output. Trace the entire include path.
• Use a hex editor to view the raw bytes of the file. Look for EF BB BF at the start — that’s the BOM. Remove it.
• If you’re using a framework or CMS, the error might be caused by a plugin or theme. Temporarily disable plugins or switch to a default theme to isolate the issue.
• Check for PHP short tags — if your server has short_open_tag enabled, <? is treated as PHP. If you have a literal <?xml in your code, it might be interpreted as PHP and cause unexpected output. Use <?php instead.
• Verify that your editor is not adding a newline at the end of the file — even a newline after ?> is output. Remove the closing tag.

Frequently Asked Questions

Why does this error happen even though my file looks clean?

Invisible characters like BOM or trailing spaces are the usual culprits. Enable “show whitespace” in your editor to see them.

Can I use output buffering as a permanent fix?

It’s a workaround, not a fix. It can mask the problem and cause memory issues with large outputs. Better to remove the actual output source.

Does this error affect all PHP versions?

Yes, it’s a fundamental behavior of PHP — headers must be sent before any output, regardless of version.

What if I’m using a framework like Laravel or WordPress?

Frameworks usually handle sessions automatically. If you see this error, it’s often due to a plugin or custom code that echoes something before the framework starts the session. Check your theme’s functions.php or plugin files.

Is it safe to remove the closing ?> tag?

Yes, it’s recommended. PHP will automatically end the script at the end of the file. This prevents accidental whitespace output.

Can I call session_start() multiple times?

It’s not necessary, but you can call it multiple times without error as long as no output has been sent. However, it’s better to call it once at the top of your script.

Related

• MKV DTS to AC3/AAC: How to Convert Audio
• OneDrive to MEGA Cloud Storage: How to Switch
• Qi2 Magsafe: Leaving Samsung for Pixel