PHP header_remove() Function: Everything You Need to Know

Every PHP response carries a set of HTTP headers — the metadata the browser reads before it ever sees your page content (content type, caching rules, cookies, redirects, and so on). Sometimes you set a header earlier in a script and later decide it should not go out. header_remove() is the built-in function that takes a header back off the outgoing response before it is sent to the client.

This chapter covers the syntax, the optional parameter, when removal actually works, and the common reasons you would reach for it.

What header_remove() Does

header_remove() deletes a header that was previously queued with header() (or set automatically by PHP) from the list of headers that will be sent with the response. Because PHP buffers headers until the body starts streaming, you can add and remove them freely up to that point.

The function works on the outgoing header list, not on the request headers your script received from the browser.

Syntax

header_remove(?string $name = null): void

• $name — the name of the header to remove (case-insensitive, without the colon or value), for example "X-Powered-By". The parameter is optional. If you omit it (or pass null), all headers set so far are removed.
• Return value — none (void).

Removing a Single Header

<?php

header("X-MyHeader: Hello World!");
header_remove("X-MyHeader");

Here the X-MyHeader header is queued and then removed, so it never reaches the browser. The header name is matched case-insensitively, so header_remove("x-myheader") would remove the same header.

Removing All Headers

Call the function with no argument to clear every header you have queued:

<?php

header("X-First: 1");
header("X-Second: 2");

header_remove(); // both X-First and X-Second are dropped

This also clears headers PHP would otherwise add (such as X-Powered-By, if it is enabled), which is one of the more common real-world uses — stripping the server fingerprint before output begins.

When Removal Works

Headers can only be modified before any output is sent. Once the first byte of the body leaves the script — via echo, print, whitespace before <?php, or a closing ?> followed by a blank line — the headers are flushed and locked.

Use headers_sent() to check whether it is still safe to change headers, and headers_list() to inspect the headers currently queued:

<?php

header("X-Debug: on");

if (!headers_sent()) {
    header_remove("X-Debug");
}

print_r(headers_list()); // X-Debug is no longer in the list

If output has already started, header_remove() does nothing and PHP emits a "headers already sent" warning, just as header() would.

Common Use Cases

• Hiding the server fingerprint. Remove X-Powered-By so responses do not advertise your PHP version.
• Undoing a conditional header. Queue a caching or redirect header early, then drop it if a later condition changes your mind.
• Resetting before a clean redirect. Clear stray headers before issuing a new header("Location: ...").

Conclusion

header_remove() gives you precise control over the outgoing HTTP response: pass a name to drop one header, or call it with no argument to clear them all. Pair it with headers_sent() and headers_list() so you only modify headers while it is still allowed, and you can confidently shape exactly what the browser receives.

Practice