Session ini settings cannot be changed after headers have already been sent in wp-config.php

Just the PHP 101 here explained by the error message in context:

PHP Fatal Error: ini_set(): Session ini settings cannot be changed after headers have already been sent in /home/moonlighok/www/wp-config.php on line 8

@ini_set('session.use_only_cookies', true);

The suggested duplicate question may give some insights about the WP session object, however as the context is the wp-config.php script that contains ini_set() calls to bootstrap the PHP runtime configuration, we already know that not the session in itself is the "object of desire" but the error is within the bootstrapping (early start) of the application.

We have a reference question on SO about PHP error messages in general (Reference - What does this error mean in PHP?). That reference then may give some more general guidance to you, I'll also include some of the references' instructions specifically to this error context in my own answer here so you can connect the dots later if you want.

However, we already know that configuring the application is broken, actually even a fatal error, so what we commonly then want to get into the know is about what already happened so far.

Luckily we already managed to bring the application down, so there is nothing that we can break more than that, or more correctly, if we intentionally want to, we know it needs to be before the line that caused the fatal error, e.g. at the very beginning of the wp-config.php script file is a nice spot.

1. What is the stack trace?
2. Which script/line caused sending the headers?
3. Context Matters!

Step by step, easy codes, have PHP error logging enabled, and if you're ready to follow the log, we can dive deeper now to get all the precious info and details.

1. What is the stack trace?

<?php # wp-config.php
throw new ErrorException(__FILE__);
// ...

This will provoke an error exception just with the message of the file where it is created (new) and thrown. Throwing an exception will in itself provoke a fatal error unless caught. We are aiming for the fatal error here.

Now within the error log we now see a fatal error of an uncaught exception (hopefully), when we reproduce the original error (and instead of it). But with that new fatal error of an uncaught error exception, there is also the stack trace, so we can see what the path to the fatal error is.

2. Which script/line caused sending the headers?

This is a question in context of these kind of errors that are about where headers are being sent earlier. Headers are sent when the standard output of the application reached over the pre-configured threshold (depends on configuration, commonly we can assume 4096 bytes, but it can be disabled (off) and/or zero or more bytes). This is related to the default output buffering.

To identify the file and line that provoked (by yielding standard output) the sending of the headers (those need to come before the yielded output) we have to specifically fetch that information from PHP.

This is on the level where the reference question linked above is useful for, because often it gives these extra tricks or guidance the pure PHP error message cannot (PHP needs to bail out quickly before anything else even more bad happens).

<?php # wp-config.php
headers_sent($headers_sent[0], $headers_sent[1]);
throw new ErrorException(vsprintf('Oputput started on %s:%d', $headers_sent));
// ...

Just a very small extension to the previous error exception, single line, and a little different message.

It may lead to a line of code like:

        $dompdf->render();

Now the rest is that you have to play detective a bit and inspect the point of output that provoked the headers, and how it relates to including the wp-config.php script within the applications flow.

3. Context Matters!

This is where context matters most, the fatal error is really just that (fatal) and the diagnostic message short and puzzling - because it is always ahead of the detective work. There still is a puzzle to solve.

Did I wrote context matters? The PDF you generate here is producing output above the threshold and is causing sending the headers. It is likely that you have arranged your scripts a bit out of order, as it is executing before the configuration is being loaded.

Now how did I know that from that error message? Context matters! But it is only my educated guess as you were cross posting and as so often one question leads to another while we learn more.

And at the end of the day, the only one who can find out what the actual error was is you; because the only thing I can tell you is what I see from the diagnostic message and what else you posted. And don't listen to strangers on the internet: Finding the right order, will most likely present you even more errors, e.g. from dompdf, but perhaps those diagnostics are what you were looking for or asking about in the first place. So the truth is, I cannot even really tell you what the error is. All I know is that $dompdf->render() should not output... .