Does anyone know another way to redirect without header(); giving me this error? wp_redirect doesn't work for me either...

This is the error I'm getting:

Warning: Cannot modify header information - headers already sent by (output started at /home/my_site/public_html/wp-content/themes/EHCC/page-secure.php:8) in /home/my_site/public_html/wp-content/themes/my_theme/template-parts/secure-form.php on line 8

if (!empty($_POST['password']))
  $redirect = ($_POST['password']);
  $redirect = str_replace(" ","-",$redirect);
  $redirect = strtolower($redirect);
    header("Location: /bids/$redirect");
  print '
    <div class=\'row secureform__container\'>
        <form id=\'securedownloads\' class=\'secureform\' method=\'post\' action=\'\'>
            <fieldset class=\'secureform__inner\'>
                <label for=\'password\' class=\'secureform__label\'>Password:</label>
                <input id=\'password\' type=\'text\' name=\'password\' maxlength=\'40\' class=\'secureform__input\'>
                <input type=\'submit\' value=\'login\' class=\'secureform__submit\'>
                <input type=\'hidden\' name=\'next\' value=\'\'>
  • Where do you put that code? Commented Feb 11, 2019 at 22:06
  • in a template file which already has header(); being called... i know that's why theres an error. Commented Feb 11, 2019 at 22:20
  • I'll add it to the OG post so you can see. Commented Feb 11, 2019 at 22:22

2 Answers 2


There is no way do perform a redirect, if you already printed anything to the browser. (To make a redirect you have to send proper header to the browser. And headers have to be sent before any output.)

So if you want to perform any redirects, you can't (and shouldn't) put such code directly in template. It should be placed in functions.php and run on some hook.

Also... It's not the best idea to send any form with no action set - it's a security problem. And there is already a mechanism built in WP, that you should use for such requests.

So if you want to do this properly, it may look something like this...

In functions.php file:

function process_my_form() {
    if ( ! empty($_POST['password']) ) {
        $redirect = ($_POST['password']);
        $redirect = str_replace(" ","-",$redirect);
        $redirect = strtolower($redirect);
        wp_redirect( "/bids/$redirect" );

    wp_redirect( '<URL OF YOUR FORM>' );  // redirect back to the form, so replace it with correct URL
add_action( 'admin_post_process_my_form', 'process_my_form' );
add_action( 'admin_post_nopriv_process_my_form', 'process_my_form' );

And in your template file:

<div class='row secureform__container'>
    <form id='securedownloads' class='secureform' method='post' action='<?php echo esc_attr( admin_url('admin-post.php') ); ?>'>
        <fieldset class='secureform__inner'>
            <label for='password' class='secureform__label'>Password:</label>
            <input id='password' type='text' name='password' maxlength='40' class='secureform__input'>
            <input type='submit' value='login' class='secureform__submit'>
            <input type='hidden' name='next' value=''>
            <input type='hidden' name='action' value='process_my_form'>
  • No problem. I'm glad I could help :) Commented Feb 11, 2019 at 22:32
  • Not a big fan of using POST variables without 'cleaning' them, so assume you are doing that. Also not a big fan of using a password in redirect. There should be a better way to do that without exposing the password - in my mind, that is a big security risk. Commented Feb 12, 2019 at 0:33
  • @RickHellewell see the original question. I've just modified original code. And to be honest - I'm not really sure if this is a password - just take a look how it is used... But yeah - I completely agree - never use passwords in plaintext. But regarding $_POST - if you process POST request, you have to process it ;) Commented Feb 12, 2019 at 0:35
  • Yes, Rick. It's a weird system. The idea isn't actually to secure the post - just to add another layer to getting there. The client requested this specifically, even though I recommended a different system. It was an odd one for sure... And yes, definitely sanitizing. Commented Feb 15, 2019 at 21:31
  • It's not a password. Just a phrase given to certain people that already know a bid page exists in the system. I don't like the word "password" for it, but that's what they requested... Commented Feb 15, 2019 at 21:32

Try javascript redirection instead.

echo "<script>location.href = '$redirect_url';</script>";


Literally saved my live without getting too dirty with WP screwed architecture.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.