PHP error guide

Cannot send session cache limiter or cookie: meaning and fix

warning warning Affects: PHP 7.4–8.4 Last verified:

Error summary

Move session and cookie configuration ahead of output, using the reported output-start file and line to remove the first write.

What it means

Move session and cookie configuration ahead of output, using the reported output-start file and line to remove the first write.

What the error means

PHP opened or attempted a session but could not send its cache-limiter or Set-Cookie header because response output had already begun.

Why PHP produces it

The response header section was finalized before the session module attempted to add cookie or cache-control metadata.

PHP version notes

The behavior described for Cannot send session cache limiter or cookie applies to PHP 7.4–8.4 unless a narrower version is stated; exact wording can vary by SAPI and patch release.

Most common causes

  • An included file outputs markup during bootstrap.
  • A warning is displayed before session_start.
  • Session middleware runs after streaming output begins.

Minimal examples

BAD — reproduces the problem

php 
renderPage(); session_start();

FIXED — safer pattern

php 
session_start(); renderPage();

Step-by-step diagnosis

  1. Read the “output started at” path and line in the complete warning.
  2. Call headers_sent($file, $line) before session initialization.
  3. Check both intended output and displayed PHP diagnostics.

Fixes

Order response work correctly

Configure cookie parameters, start the session, and only then render.

php 
session_set_cookie_params(["httponly" => true, "samesite" => "Lax"]);
session_start();
renderPage();

Common mistakes when fixing it

  • Ignoring the output-start location.
  • Clearing browser cookies without correcting server output.
  • Suppressing the warning while authentication state remains broken.

How to prevent it

  • Initialize sessions in one early middleware.
  • Disable public error display while retaining logs.
  • Avoid output in configuration and class files.

Web server / environment notes

fpm, apache, shared-hosting. This is an HTTP response-ordering problem rather than a session-storage failure.

Tags: fpm,apache,shared-hosting

Categories