Just see the following code snippet. I have came across this in one of the plugins that I am reading now.

if ( ! defined( 'ABSPATH' ) ) {
  header( 'Status: 403 Forbidden' );
  header( 'HTTP/1.1 403 Forbidden' );

I understand that this script is sending an forbidden 403 header response to the browser for unauthorized access. But why two 403 headers ? Is the second one kind of fallback to the first one ?

  • The second line is bogus. There is no good reason for it.
    – fuxia
    Jul 27, 2016 at 15:40
  • Actually I am confused, the second line is seen on most of the tutorials and even some of the highly voted questions here. I never found first one on any of the tutorials or answers here. Is your comment specific to wordpress ? Jul 27, 2016 at 15:50

1 Answer 1


The proper way to send a status (when WordPress is not available) is:

http_response_code( 403 );

See the PHP Manual for its definition.

But in Plugin files, this should never be the "default" code on top of a file header. See Worthwhile to restrict direct access of theme files? for a discussion.

In WordPress, use status_header( 403 ) if you need it.

A note on the code you've posted:

header( 'Status: 403 Forbidden' );
header( 'HTTP/1.1 403 Forbidden' );

The first line is a "special" treatment for PHP running in CGI mode, the second is using a specific HTTP protocol version without any check. If the connection is over HTTP 2 or 1.1, this makes no sense.

Both are wrong, because the correct way to send the proper status with header() is using the second and the third argument of that function.

So this would work better:

header( 'Status: 403 Forbidden', true, 403 );

The second argument tells PHP to overwrite other headers with the same name, the third is for the real status. The code that you posted is a good counter-example. :)

  • Sorry for bugging you, I understand that I should use status_header(), a wrapper function for header(), But When I had a look at the source of status_header(), this function is preparing and calling original header() in $protocol $code $description format, which translates to header('HTTP/1.1 403 Forbidden'), which you called a bogus line. Any other reason for calling it bogus ? Jul 27, 2016 at 16:43
  • Because it repeats the functionality of the first line @NareshDevineni Jul 27, 2016 at 19:38
  • Got it! So both of them are same. Since plugin was written by one of the best wordpress plugin authors, I thought there must be some hacky reason behind it !! Jul 27, 2016 at 19:42
  • 1
    @NareshDevineni See my update for an explanation. I won't comment on "best plugin author" … :)
    – fuxia
    Jul 27, 2016 at 20:08
  • Now it makes sense. Thank you for the detailed explaination :) Jul 27, 2016 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.