Just see the following code snippet. I have came across this in one of the plugins that I am reading now.

if ( ! defined( 'ABSPATH' ) ) {
  header( 'Status: 403 Forbidden' );
  header( 'HTTP/1.1 403 Forbidden' );

I understand that this script is sending an forbidden 403 header response to the browser for unauthorized access. But why two 403 headers ? Is the second one kind of fallback to the first one ?

  • The second line is bogus. There is no good reason for it. – fuxia Jul 27 '16 at 15:40
  • Actually I am confused, the second line is seen on most of the tutorials and even some of the highly voted questions here. I never found first one on any of the tutorials or answers here. Is your comment specific to wordpress ? – Naresh Devineni Jul 27 '16 at 15:50

The proper way to send a status (when WordPress is not available) is:

http_response_code( 403 );

See the PHP Manual for its definition.

But in Plugin files, this should never be the "default" code on top of a file header. See Worthwhile to restrict direct access of theme files? for a discussion.

In WordPress, use status_header( 403 ) if you need it.

A note on the code you've posted:

header( 'Status: 403 Forbidden' );
header( 'HTTP/1.1 403 Forbidden' );

The first line is a "special" treatment for PHP running in CGI mode, the second is using a specific HTTP protocol version without any check. If the connection is over HTTP 2 or 1.1, this makes no sense.

Both are wrong, because the correct way to send the proper status with header() is using the second and the third argument of that function.

So this would work better:

header( 'Status: 403 Forbidden', true, 403 );

The second argument tells PHP to overwrite other headers with the same name, the third is for the real status. The code that you posted is a good counter-example. :)

  • Sorry for bugging you, I understand that I should use status_header(), a wrapper function for header(), But When I had a look at the source of status_header(), this function is preparing and calling original header() in $protocol $code $description format, which translates to header('HTTP/1.1 403 Forbidden'), which you called a bogus line. Any other reason for calling it bogus ? – Naresh Devineni Jul 27 '16 at 16:43
  • Because it repeats the functionality of the first line @NareshDevineni – Andy Macaulay-Brook Jul 27 '16 at 19:38
  • Got it! So both of them are same. Since plugin was written by one of the best wordpress plugin authors, I thought there must be some hacky reason behind it !! – Naresh Devineni Jul 27 '16 at 19:42
  • 1
    @NareshDevineni See my update for an explanation. I won't comment on "best plugin author" … :) – fuxia Jul 27 '16 at 20:08
  • Now it makes sense. Thank you for the detailed explaination :) – Naresh Devineni Jul 27 '16 at 20:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.