PHP HTTP Requests and Responses: Methods, Headers, Status Codes, and Redirects

HTTP Exchange

PHP runs inside an HTTP exchange: a client sends a method, target, headers, and optional body; the application returns a status, headers, and body. Treat those response parts as deliberate application output rather than relying on the default 200 HTML response.

After this lesson, you can enforce an allowed request method, select a meaningful status code, send a content type before output, redirect safely, and recognize the headers-already-sent failure.

PHP Request and Response Path

The web server invokes PHP for a matching request. Application code validates the boundary before choosing one explicit response.

HTTP Request Method, target, headers, cookies, and optional body
Web Server Routes the request to the PHP runtime
Bootstrap Loads configuration, dependencies, and routing
Application Authenticates, validates, and executes the use case
Response Sets status and headers before emitting the body

Request Intent

Use the method to understand the requested operation, but still validate authorization, content type, and body data. $_SERVER values originate at the server boundary and some header-derived entries remain client-controlled.

Allow POST Only

<?php
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';

if ($method !== 'POST') {
    header('Allow: POST');
    http_response_code(405);
    echo 'Method not allowed';
    exit;
}

A 405 response identifies the rejected method and the Allow header tells the client which method is supported.

Response Parts

Set status and headers before writing the body. Output from a template, included file, debug statement, or stray whitespace can make later header changes fail.

Part	Purpose	Example
Status	Overall result of the request	201 Created
Headers	Metadata and client instructions	Content-Type: application/json
Body	Representation or error details	{"id":42}

Status Selection

200: a successful response with a representation.
201: a resource was created; include its identifier or location.
204: success with no response body.
400: malformed request syntax or unreadable payload.
401: authentication is required; 403: identity is known but the action is forbidden.
404: the requested resource is not available to the client.
422: syntactically readable input fails domain validation.

Redirect Completion

A Location header does not stop PHP execution. Set an intentional redirect status and exit immediately so no protected or expensive work runs afterward.

Redirect after POST

<?php
header('Location: /account.php', true, 303);
exit;

A 303 tells the client to retrieve the destination with GET, which avoids resubmitting the original POST on refresh.

Outbound Requests

For production HTTP clients, prefer a maintained library or cURL with explicit timeouts, TLS verification, accepted status handling, and bounded response sizes. A remote 404 or 500 is an HTTP result, not necessarily a transport exception.

Never disable TLS verification to make a certificate problem disappear.
Do not place credentials in logged URLs.
Separate connection timeout, total timeout, transport failure, and non-success response handling.

Choose the Response

0 of 2 checked

Q1. Which response fits a successfully created record?

201 204 with a body 404

Q2. What must follow a redirect in a PHP script?

exit Another echo session_start

Try this next

Design Three Responses

0 of 2 completed

Map an endpoint
Specify status, headers, and body for a successful create, invalid field, and missing record.
Diagnose an early output
Create a headers-already-sent failure, identify the first output location, and remove the cause.

Previous Next