header can’t be used once the headers have been sent, the moment you output anything such as a tag, or even a blank space, PHP will send out the headers telling the browser to expect a HTML document.
In order to send a HTTP header to redirect, you need to do it before this happens. This means you cannot do this after get_header() is called, you have to do it before that call, and before any other HTML output. Generally, this is not something that works well inside templates.
Other notes:
- you should be using the WordPress function to do this
wp_safe_redirect - if you’re redirecting to the homepage you shouldn’t be using
home, pass/hometo go toexample.com/homeor usehome_url()instead to retrieve the URL of the homepage - PHP sessions will not work on many WordPress hosts, and there are major security issues that require special handling. They’re also incompatible with many caching systems. You also can’t use it to bypass cookie legislation as PHP sessions use a cookie to identify which session belongs to the visitor. So use cookie based logins instead.
- You should use the built in user management instead of reinventing it