PHP headers_list() Function: Everything You Need to Know

Every PHP response carries a set of HTTP headers — things like Content-Type, Set-Cookie, and any custom values you add. The headers_list() function lets you inspect that set from inside your script: it returns the headers PHP is about to send (or has already sent) to the client. This is invaluable for debugging redirects, content types, and cookies before the response goes out the door.

This page covers what headers_list() returns, when those headers actually exist, the difference between it and headers_sent(), and practical patterns for using it.

Syntax

headers_list(): array

headers_list() takes no parameters and returns an indexed array of strings. Each string is a single header line in the exact form it will be sent, for example Content-Type: text/html; charset=UTF-8. If no headers have been set yet, you get an empty array.

A basic example

The function reflects whatever headers PHP currently plans to send. Set a couple with header() first, then list them:

<?php

header('Content-Type: application/json');
header('X-Powered-By: w3docs');

$headers = headers_list();
foreach ($headers as $header) {
    echo $header, "\n";
}

A typical output (the exact set depends on your PHP/server configuration):

Content-Type: application/json
X-Powered-By: w3docs

PHP often adds default headers of its own (such as Content-Type and X-Powered-By) before your code runs, so the list may contain entries you never set explicitly.

When are the headers available?

headers_list() only reflects headers PHP holds in its internal buffer. Two consequences matter:

• It reports headers whether or not they have been sent yet. Use it together with headers_sent() when you need to know if the buffer was already flushed.
• It runs on the server side only. It does not return request headers the browser sent to you — for those use getallheaders() or the $_SERVER superglobal.

Checking for a specific header

A common task is verifying that a particular header was set — for example, confirming a redirect's Location is present before relying on it:

<?php

header('Location: /dashboard');

$hasLocation = false;
foreach (headers_list() as $header) {
    if (stripos($header, 'Location:') === 0) {
        $hasLocation = true;
        break;
    }
}

echo $hasLocation ? "Redirect header is set\n" : "No redirect header\n";

Output:

Redirect header is set

stripos(..., 'Location:') === 0 matches case-insensitively at the start of the line, since header names are not case-sensitive.

headers_list() vs. related functions

Because headers_list() is read-only, it is safe to call at any point — it never produces the "headers already sent" warning that header() can.

Common use cases

• Debugging: dump headers_list() while developing to see exactly what the server is sending, including cookies set by setcookie().
• Conditional logic: decide whether to add a header only if it is not already present.
• Testing: assert that a controller produced the expected Content-Type or Cache-Control.

Conclusion

headers_list() gives you a read-only snapshot of the HTTP response headers PHP intends to send. Pair it with headers_sent() to check timing, header() to set values, and header_remove() to clear them. Together these functions give you full control over the response head before it reaches the browser.

Practice