From 4d744a603cfd5533bf4d08049d409f9846f385b9 Mon Sep 17 00:00:00 2001 From: mpeshev Date: Sun, 25 Oct 2026 12:54:48 +0200 Subject: [PATCH] Networks and Sites: Avoid a "headers already sent" warning when `wp-cron.php` is requested on a site that does not exist. `wp-cron.php` finishes the response with `fastcgi_finish_request()` or `litespeed_finish_request()` before loading WordPress. On a subdomain network, a request for a site that does not exist then reaches the redirect in `ms-settings.php` after the headers were sent, and every such request logs "Cannot modify header information - headers already sent". Bots that probe random subdomains fill error logs this way. Only send the redirect header when headers have not been sent. The request still ends at the same point. See #53244. Co-Authored-By: Claude Opus 5.5 --- src/wp-includes/ms-settings.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/ms-settings.php b/src/wp-includes/ms-settings.php index 2e3c3dcfa739a..4be890d6ea389 100644 --- a/src/wp-includes/ms-settings.php +++ b/src/wp-includes/ms-settings.php @@ -81,7 +81,10 @@ } elseif ( false === $bootstrap_result ) { ms_not_installed( $domain, $path ); } else { - header( 'Location: ' . $bootstrap_result ); + // Headers may already be sent, e.g. by wp-cron.php calling fastcgi_finish_request(). + if ( ! headers_sent() ) { + header( 'Location: ' . $bootstrap_result ); + } exit; } unset( $bootstrap_result );