“Cannot modify header information - headers already sent by” in WordPress: find the cause and fix it

How to read the message

Warning: 1Cannot modify header information - headers already sent by (2output started at /var/www/html/wp-content/plugins/contact-box/contact-box.php:7) in /var/www/html/wp-content/plugins/contact-box/contact-box.php 3on line 4
Form sent

php.net explains the rule: “Remember that header() must be called before any actual output is sent, either by normal HTML tags, blank lines in a file, or from PHP.” (php.net) WordPress sends headers for redirects, cookies and logins, so this shows up as a login that loops, a form that doesn’t take you to the next page, or settings that don’t save.

Cause 1: a blank line outside the PHP code

This is the example above: a plugin file ends its PHP code with ?>, then a blank line, then more PHP. That blank line is printed to the visitor, and the redirect after it fails, on every PHP version:

<?php
function contact_box_redirect() {
    // WordPress's wp_redirect() sends the same header
    header('Location: /thank-you/');
}
?>

<?php
contact_box_redirect();
echo "Form sent\n";

Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-content/plugins/contact-box/contact-box.php:7) in /var/www/html/wp-content/plugins/contact-box/contact-box.php on line 4
Form sent

Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-content/plugins/contact-box/contact-box.php:7) in /var/www/html/wp-content/plugins/contact-box/contact-box.php on line 4
Form sent

Look at the file and line after “output started at”. A blank line or space before <?php at the top, or after ?> at the end, is the cause. The same goes for an invisible byte-order mark (BOM) that some text editors add at the very start of a file.

Cause 2: a PHP message printed on the page

Anything printed counts, including a PHP message. After a PHP upgrade, plugins often trigger new deprecation notices or warnings. If those are displayed, the first one is “output”, and every header after it fails. Here the redirect fails on PHP 8.5 but not on 8.1, only because 8.5 prints a deprecation notice first:

<?php
class Contact_Form {
    public function __construct() {
        $this->sent = true;
    }
}

$form = new Contact_Form();
// After sending, the plugin sends the visitor to a thank-you page
// (WordPress's wp_redirect() does this with the same header):
header('Location: /thank-you/');
echo "Form sent\n";

Form sent

Deprecated: Creation of dynamic property Contact_Form::$sent is deprecated in /var/www/html/wp-content/plugins/contact-box/contact-box.php on line 4

Warning: Cannot modify header information - headers already sent by (output started at /var/www/html/wp-content/plugins/contact-box/contact-box.php:4) in /var/www/html/wp-content/plugins/contact-box/contact-box.php on line 11
Form sent

In this case “output started at” points to the line of the notice. WordPress itself says debug display isn’t for live sites: its debug tools “are meant for local testing and staging installs” (developer.wordpress.org).

Fix it

If the file belongs to a plugin or theme, don’t edit it yourself: an update would undo the change. Update it, or ask its developer.

Before your next PHP upgrade

Cause 2 is predictable: the deprecation notices a PHP upgrade brings are in the code before you switch. CompatNav, a free plugin on wordpress.org, lists them per plugin and theme for the PHP version you choose (8.0 to 8.5), labelled “Deprecation notice”, so you can update first and switch with fewer surprises. For what each kind of message does to a page: deprecation notice or fatal error.