Headers already sent: find the first output boundary

Understand the likely causes

• Common causes are echo in a helper, whitespace outside PHP tags, a UTF-8 byte-order mark, displayed warnings, or template rendering before the response decision. Sending Location does not terminate execution. Output buffering can postpone commitment but cannot make arbitrary response ordering a sound design.

1. Locate the first output, not only the failing header call

Inspect the warning’s first-output file and line, then follow includes and helper calls before the header operation. In a controlled local setup, headers_sent can report whether output has already committed and provide the originating file/line. Do not dump private configuration into the response to debug it. Check source encoding and text outside PHP tags, especially in included PHP-only files. The visible warning line is often where the problem is noticed, while the real cause occurred earlier.

2. Separate data work from response emission

Make reusable functions return data rather than print it. Decide status, cookies, content type, or redirect before rendering the body, and emit the response once at the boundary. Omit closing tags from PHP-only source files to reduce accidental trailing whitespace. After a redirect decision, return or terminate the current path deliberately so later writes and output do not continue. If a warning caused early bytes, repair its underlying input or environment assumption instead of hiding all errors with @ or a public display toggle.

3. Use buffering only as an owned tool

A deliberately buffered template can produce a body string before the adapter sends headers. The CLI example captures owned output and confirms it has not yet committed before the final echo. It demonstrates buffer ownership, not real HTTP status or cookie delivery. Always close or clean buffers according to the operation’s failure path; nested buffers and long-lived processes need particular care. Do not add ob_start at an arbitrary point after bytes already escaped and expect it to retroactively restore header control.

<?php
declare(strict_types=1);
ob_start();
echo "body";
$body = ob_get_clean();
$state = headers_sent() ? "sent" : "not sent";
echo $state, ":", $body, PHP_EOL;

not sent:body

4. Check the actual web adapter separately

After repairing construction, use an isolated HTTP request to inspect status, Location, Set-Cookie, content type, and body as relevant. Do not infer these from CLI output alone. For a JSON route, confirm there are no leading bytes or warning text and that the body parses as one document. For a redirect, confirm no forbidden state change occurs afterward. If middleware or a framework owns emission, adapt to that contract rather than adding competing raw header calls; framework-specific details belong in the corresponding course.

Keep it from recurring

• Centralize response emission, keep PHP-only includes free of accidental output, and test content type and body parsing together. Keep diagnostics private and fix first-output causes. Treat buffering as a documented rendering strategy with cleanup, never as a substitute for a coherent response lifecycle.