headers_sent() usually reports the PHP file and line that produced the first output. A blank filename with line 0 means output began before PHP executed the script, so searching templates for whitespace will not locate the source.
Last updated: October 22, 2026.
<?php
$file = '';
$line = 0;
if (headers_sent($file, $line)) {
if ($file === '') {
error_log(
'Headers were sent before script execution; ' .
'check startup and request-parsing logs.'
);
} else {
error_log("Headers were sent at {$file}:{$line}");
}
}Run this check before calling header(), setcookie(), or session_start(). Do not print the diagnostic on a production response because that creates more output and can expose server paths.
Look before normal script execution
The PHP manual documents that the filename is empty when output starts before the PHP source file is executed. This can happen when PHP emits a startup or request-parsing warning. One example is a request that exceeds an input limit before user code runs.
Check the PHP error log, web-server log, and PHP-FPM or hosting control-panel log at the exact request time. Confirm the active php.ini, because command-line and web requests may load different configurations. In production, keep display_errors disabled and send errors to a protected log; a displayed warning can both reveal details and prevent later header changes.
Account for output buffering
Output buffering can delay when content leaves PHP, so headers_sent() may remain false after an echo until a buffer is flushed. The official output buffering documentation explains that buffered output allows headers to change while the buffer remains unflushed. Inspect output_buffering, application-level ob_start() calls, and any framework middleware before comparing environments.
Once the pre-script warning is fixed, retest the original request rather than hiding the symptom with a larger buffer. Also verify upload and request-size limits together; changing one limit can expose the next. Continue with building a secure upload pipeline, hardening PHP sessions, and processing forms securely.
