How to Redirect in PHP

To redirect a request in PHP, send a Location response header with header() before the script outputs HTML or other content, then stop the script. The example below sends the browser to a destination URL. Put the PHP file on a local web server and open it in a browser to see the navigation.

Redirect to a URL with PHP’s header() function

The header() function sends an HTTP response header. For a redirect, the header field is Location, and its value is the destination URL. PHP must send this header before any response body content, including whitespace outside PHP tags. Keep the redirect code near the beginning of the request handler, before templates or page output.

This standalone example uses a destination URL in a variable. The exit call ends the current request after the response is prepared, so the rest of the page does not continue as though the redirect had not happened. The supplied runtime check executed this example successfully and produced no standard output; a redirect is carried in the HTTP response rather than printed as text. In a browser, opening the PHP file through your local web server should navigate to the example destination.

<?php
$url = 'https://example.com/';
header('Location: ' . $url);
exit;
?>

Use a URL that your application is allowed to send users to. If the destination comes from request data, validate it against an allowlist or construct it from trusted application routes; passing arbitrary user input to a redirect can send visitors to an unintended site. For a route within the same application, a path such as /account/ is often sufficient.

Create a PHP redirect helper with an HTTP status code

A reusable redirect helper can accept both the destination and the response status. The third argument to header() is the status code; its second argument controls whether a header with the same name replaces an earlier one. The helper below defaults to 302, which is commonly used for a temporary redirect, and accepts another status when the route requires it.

<?php
function redirect(string $url, int $statusCode = 302): void
{
    header('Location: ' . $url, true, $statusCode);
    exit;
}

redirect('https://example.com/', 301);
?>

The example passes 301 to mark this destination as permanent. Use that status only when the move is intended to persist; browsers and other clients may remember permanent redirects. A 302 is a temporary redirect and is a better default when the destination may change. The PHP manual for header() documents the function parameters, and MDN’s 301 reference describes the permanent status.

The supplied runtime check executed this helper example successfully and produced no standard output; the redirect status and Location header are part of the HTTP response, not printed text. Run the PHP file through a local web server to observe the browser navigation. The function terminates the request after setting the response header. In a real application, validate the URL before calling the helper, and choose a status that matches whether the move is temporary or permanent. The Location header and status are part of the HTTP response, so this approach works before the browser receives the page body.

Use JavaScript as a client-side redirect fallback

When a server-side redirect is unavailable, a page can ask the browser to navigate with window.location. This is client-side navigation: PHP sends page content, and the browser runs the script. It is not PHP output buffering and does not change the HTTP response into a server redirect. It also depends on JavaScript being enabled, so use the PHP header() approach when the server can decide the destination before sending the page.

The following browser-page snippet shows the fallback. Add it to a page that the local web server can serve, then open that page in a browser with JavaScript enabled to see navigation to the destination. The snippet is presented as browser source and has not been executed for this article.

<script>
  window.location = "https://example.com/";
</script>

Because this code runs in the browser, it cannot send an HTTP redirect status such as 301 as part of the response already received. Keep the destination fixed or validate any value used to build it, just as you would for a server-side redirect. Use this fallback only when client-side navigation fits the page; visitors with JavaScript disabled will remain on the original page.