I'm maintaining some old Drupal 7 site (not created by me) and since couple of months ago it started acting strange (I didn't make any change on site):

Inside some content type there is a formatted text field that is edited with CKEditor.

If field contains just a plain text and I try to save it (when editing the node) it works well.

If I make some text bold at beginning of the whole text and try to save it works well also.

But if I try to make some text bold after first umlaut character (site contains German text) and try to save I get 403 error - forbidden?!?

In drupal's error log I see the error:

Warning: Cannot modify header information - headers already sent by (output started at /home/www/project_name/includes/common.inc:2776) in drupal_goto() (line 705 of /home/www/project_name/includes/common.inc).

I even suspected that site has been hacked but I don't see any suspicious new files there.

Any idea?

 * Performs end-of-request tasks.
 * This function sets the page cache if appropriate, and allows modules to
 * react to the closing of the page by calling hook_exit().
function drupal_page_footer() {
  global $user;


  // Commit the user session, if needed.

  if (variable_get('cache', 0) && ($cache = drupal_page_set_cache())) {
  else {


That 2776 row is ob_flush() call. 705 is header() function call inside drupal_goto() function.

1 Answer 1


Issue solved by server admin. It was about ModSecurity Apache2 settings. POSTs were rejected because they triggered new ModSecurity XSS alerts. So server admin excluded some rules. He found them in Apache2 error log and exluced them in Apache 2 conf file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.