diff --git a/core/authorize.php b/core/authorize.php
index 0188cf88e60..a676ee13785 100644
--- a/core/authorize.php
+++ b/core/authorize.php
@@ -23,6 +23,7 @@
 use Drupal\Core\DrupalKernel;
 use Drupal\Core\Url;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 use Drupal\Core\Site\Settings;
 use Drupal\Core\Page\DefaultHtmlPageRenderer;
 
@@ -71,6 +72,7 @@ drupal_maintenance_theme();
 $output = '';
 $show_messages = TRUE;
 
+$response = new Response();
 if (authorize_access_allowed()) {
   // Load both the Form API and Batch API.
   require_once __DIR__ . '/includes/form.inc';
@@ -140,15 +142,16 @@ if (authorize_access_allowed()) {
   $show_messages = !(($batch = batch_get()) && isset($batch['running']));
 }
 else {
-  drupal_add_http_header('Status', '403 Forbidden');
+  $response->setStatusCode(403);
   \Drupal::logger('access denied')->warning('authorize.php');
   $page_title = t('Access denied');
   $output = t('You are not allowed to access this page.');
 }
 
 if (!empty($output)) {
-  drupal_add_http_header('Content-Type', 'text/html; charset=utf-8');
-  print DefaultHtmlPageRenderer::renderPage($output, $page_title, 'maintenance', array(
+  $response->headers->set('Content-Type', 'text/html; charset=utf-8');
+  $response->setContent(DefaultHtmlPageRenderer::renderPage($output, $page_title, 'maintenance', array(
     '#show_messages' => $show_messages,
-  ));
+  )));
+  $response->send();
 }
diff --git a/core/includes/common.inc b/core/includes/common.inc
index 4a789c80eb0..ad795428911 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -668,8 +668,6 @@ function _url($path = NULL, array $options = array()) {
  * @return
  *   A ; separated string ready for insertion in a HTTP header. No escaping is
  *   performed for HTML entities, so this string is not safe to be printed.
- *
- * @see drupal_add_http_header()
  */
 function drupal_http_header_attributes(array $attributes = array()) {
   foreach ($attributes as $attribute => &$data) {
diff --git a/core/includes/install.core.inc b/core/includes/install.core.inc
index 3c8d1216306..d8dd3e9e1c3 100644
--- a/core/includes/install.core.inc
+++ b/core/includes/install.core.inc
@@ -890,8 +890,6 @@ function install_display_output($output, $install_state) {
   // reached in case of an early installer error.
   drupal_maintenance_theme();
 
-  drupal_page_header();
-
   // Prevent install.php from being indexed when installed in a sub folder.
   // robots.txt rules are not read if the site is within domain.com/subfolder
   // resulting in /subfolder/install.php being found through search engines.
@@ -922,7 +920,16 @@ function install_display_output($output, $install_state) {
     $regions['sidebar_first'] = $task_list;
   }
 
-  print DefaultHtmlPageRenderer::renderPage($output, $output['#title'], 'install', $regions);
+  $response = new Response();
+  $default_headers = array(
+    'Expires' => 'Sun, 19 Nov 1978 05:00:00 GMT',
+    'Last-Modified' => gmdate(DATE_RFC1123, REQUEST_TIME),
+    'Cache-Control' => 'no-cache, must-revalidate, post-check=0, pre-check=0',
+    'ETag' => '"' . REQUEST_TIME . '"',
+  );
+  $response->headers->add($default_headers);
+  $response->setContent(DefaultHtmlPageRenderer::renderPage($output, $output['#title'], 'install', $regions));
+  $response->send();
   exit;
 }
 
diff --git a/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php b/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
index 195bafd66d8..dd04e6c1cab 100644
--- a/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
+++ b/core/modules/system/tests/modules/system_test/src/Controller/SystemTestController.php
@@ -8,6 +8,8 @@
 namespace Drupal\system_test\Controller;
 
 use Drupal\Core\Controller\ControllerBase;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * Controller routines for system_test routes.
@@ -86,10 +88,15 @@ class SystemTestController extends ControllerBase {
   }
 
   /**
-   * @todo Remove system_test_set_header().
+   * Sets a header.
    */
-  public function setHeader() {
-    return system_test_set_header();
+  public function setHeader(Request $request) {
+    $query = $request->query->all();
+    $response = new Response();
+    $response->headers->set($query['name'], $query['value']);
+    $response->setContent($this->t('The following header was set: %name: %value', array('%name' => $query['name'], '%value' => $query['value'])));
+
+    return $response;
   }
 
   /**
diff --git a/core/modules/system/tests/modules/system_test/system_test.module b/core/modules/system/tests/modules/system_test/system_test.module
index fc86adc1f72..40da5d2e571 100644
--- a/core/modules/system/tests/modules/system_test/system_test.module
+++ b/core/modules/system/tests/modules/system_test/system_test.module
@@ -3,17 +3,6 @@
 use Drupal\Core\Extension\Extension;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 
-/**
- * Sets a header.
- *
- * @deprecated \Drupal\system_test\Controller\SystemTestController::setHeader()
- */
-function system_test_set_header() {
-  $query = \Drupal::request()->query->all();
-  drupal_add_http_header($query['name'], $query['value']);
-  return t('The following header was set: %name: %value', array('%name' => $query['name'], '%value' => $query['value']));
-}
-
 /**
  * Implements hook_modules_installed().
  */