Does anyone know another way to redirect without header(); giving me this error? wp_redirect doesn't work for me either...

This is the error I'm getting:

Warning: Cannot modify header information - headers already sent by (output started at /home/my_site/public_html/wp-content/themes/EHCC/page-secure.php:8) in /home/my_site/public_html/wp-content/themes/my_theme/template-parts/secure-form.php on line 8

if (!empty($_POST['password']))
  $redirect = ($_POST['password']);
  $redirect = str_replace(" ","-",$redirect);
  $redirect = strtolower($redirect);
    header("Location: /bids/$redirect");
  print '
    <div class=\'row secureform__container\'>
        <form id=\'securedownloads\' class=\'secureform\' method=\'post\' action=\'\'>
            <fieldset class=\'secureform__inner\'>
                <label for=\'password\' class=\'secureform__label\'>Password:</label>
                <input id=\'password\' type=\'text\' name=\'password\' maxlength=\'40\' class=\'secureform__input\'>
                <input type=\'submit\' value=\'login\' class=\'secureform__submit\'>
                <input type=\'hidden\' name=\'next\' value=\'\'>
  • Where do you put that code? – Krzysiek Dróżdż Feb 11 '19 at 22:06
  • in a template file which already has header(); being called... i know that's why theres an error. – Emily Childers Feb 11 '19 at 22:20
  • I'll add it to the OG post so you can see. – Emily Childers Feb 11 '19 at 22:22

There is no way do perform a redirect, if you already printed anything to the browser. (To make a redirect you have to send proper header to the browser. And headers have to be sent before any output.)

So if you want to perform any redirects, you can't (and shouldn't) put such code directly in template. It should be placed in functions.php and run on some hook.

Also... It's not the best idea to send any form with no action set - it's a security problem. And there is already a mechanism built in WP, that you should use for such requests.

So if you want to do this properly, it may look something like this...

In functions.php file:

function process_my_form() {
    if ( ! empty($_POST['password']) ) {
        $redirect = ($_POST['password']);
        $redirect = str_replace(" ","-",$redirect);
        $redirect = strtolower($redirect);
        wp_redirect( "/bids/$redirect" );

    wp_redirect( '<URL OF YOUR FORM>' );  // redirect back to the form, so replace it with correct URL
add_action( 'admin_post_process_my_form', 'process_my_form' );
add_action( 'admin_post_nopriv_process_my_form', 'process_my_form' );

And in your template file:

<div class='row secureform__container'>
    <form id='securedownloads' class='secureform' method='post' action='<?php echo esc_attr( admin_url('admin-post.php') ); ?>'>
        <fieldset class='secureform__inner'>
            <label for='password' class='secureform__label'>Password:</label>
            <input id='password' type='text' name='password' maxlength='40' class='secureform__input'>
            <input type='submit' value='login' class='secureform__submit'>
            <input type='hidden' name='next' value=''>
            <input type='hidden' name='action' value='process_my_form'>
  • No problem. I'm glad I could help :) – Krzysiek Dróżdż Feb 11 '19 at 22:32
  • Not a big fan of using POST variables without 'cleaning' them, so assume you are doing that. Also not a big fan of using a password in redirect. There should be a better way to do that without exposing the password - in my mind, that is a big security risk. – Rick Hellewell Feb 12 '19 at 0:33
  • @RickHellewell see the original question. I've just modified original code. And to be honest - I'm not really sure if this is a password - just take a look how it is used... But yeah - I completely agree - never use passwords in plaintext. But regarding $_POST - if you process POST request, you have to process it ;) – Krzysiek Dróżdż Feb 12 '19 at 0:35
  • Yes, Rick. It's a weird system. The idea isn't actually to secure the post - just to add another layer to getting there. The client requested this specifically, even though I recommended a different system. It was an odd one for sure... And yes, definitely sanitizing. – Emily Childers Feb 15 '19 at 21:31
  • It's not a password. Just a phrase given to certain people that already know a bid page exists in the system. I don't like the word "password" for it, but that's what they requested... – Emily Childers Feb 15 '19 at 21:32

Try javascript redirection instead.

echo "<script>location.href = '$redirect_url';</script>";


Literally saved my live without getting too dirty with WP screwed architecture.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.