How do I fix 'Cannot modify header information - headers already sent' in PHP?

HTTP headers (including redirects and the session cookie) must be sent before any body output. Once PHP outputs even one byte, headers are sent and later header(), setcookie() or session_start() calls fail. The warning tells you where output started: login.php:3.

Typical causes

1. Whitespace or HTML before <?php, including a blank line at the top of the file or an included file.
2. Closing ?> tag followed by newline at the end of an include file. Omit the closing tag in pure PHP files, which is the PSR standard.
3. UTF-8 BOM added by some editors at the beginning of the file. Save as "UTF-8 without BOM". Check with head -c 3 file.php | xxd.
4. echo, print_r or var_dump debugging before the redirect.
5. Warnings or notices printed to the page before the header (the error message itself is output).
6. Included files such as config.php or functions.php that output text.

Fix pattern

<?php
declare(strict_types=1);
session_start();

// logic first, no output
if (!isset($_SESSION['user_id'])) {
    header('Location: /login.php');
    exit;          // always stop after a redirect
}

// HTML below
?>
<!doctype html>

Note exit after header('Location: ...'): PHP keeps running the script otherwise.

Workaround: output buffering

ob_start();   // at the very top
// ... later
ob_end_flush();

or output_buffering = 4096 in php.ini. It hides the problem rather than fixing it, so use it only as a safety net.

Debug: headers_sent($file, $line) returns the file and line where output started:

if (headers_sent($file, $line)) {
    exit("Output started in $file:$line");
}

Also never send a redirect with a relative path on unusual setups; use an absolute path such as /dashboard.php.