diff --git a/core/authorize.php b/core/authorize.php
index 0188cf8..71dd52e 100644
--- a/core/authorize.php
+++ b/core/authorize.php
@@ -140,14 +140,14 @@ function authorize_access_allowed() {
   $show_messages = !(($batch = batch_get()) && isset($batch['running']));
 }
 else {
-  drupal_add_http_header('Status', '403 Forbidden');
+  _drupal_add_http_header('Status', '403 Forbidden');
   \Drupal::logger('access denied')->warning('authorize.php');
   $page_title = t('Access denied');
   $output = t('You are not allowed to access this page.');
 }
 
 if (!empty($output)) {
-  drupal_add_http_header('Content-Type', 'text/html; charset=utf-8');
+  _drupal_add_http_header('Content-Type', 'text/html; charset=utf-8');
   print DefaultHtmlPageRenderer::renderPage($output, $page_title, 'maintenance', array(
     '#show_messages' => $show_messages,
   ));
diff --git a/core/includes/bootstrap.inc b/core/includes/bootstrap.inc
index 78c4a32..ea2a742 100644
--- a/core/includes/bootstrap.inc
+++ b/core/includes/bootstrap.inc
@@ -414,7 +414,7 @@ function drupal_page_get_cache(Request $request) {
  *   Use \Symfony\Component\HttpFoundation\Response->headers->set().
  *   See https://drupal.org/node/2181523.
  */
-function drupal_add_http_header($name, $value, $append = FALSE) {
+function _drupal_add_http_header($name, $value, $append = FALSE) {
   // The headers as name/value pairs.
   $headers = &drupal_static('drupal_http_headers', array());
 
@@ -481,8 +481,8 @@ function _drupal_set_preferred_header_name($name = NULL) {
 /**
  * Sends the HTTP response headers that were previously set, adding defaults.
  *
- * Headers are set in drupal_add_http_header(). Default headers are not set
- * if they have been replaced or unset using drupal_add_http_header().
+ * Headers are set in _drupal_add_http_header(). Default headers are not set
+ * if they have been replaced or unset using _drupal_add_http_header().
  *
  * @param array $default_headers
  *   (optional) An array of headers as name/value pairs.
@@ -571,7 +571,7 @@ function drupal_page_header() {
  *
  * The headers allow as much as possible in proxies and browsers without any
  * particular knowledge about the pages. Modules can override these headers
- * using drupal_add_http_header().
+ * using _drupal_add_http_header().
  *
  * If the request is conditional (using If-Modified-Since and If-None-Match),
  * and the conditions match those currently in the cache, a 304 Not Modified
diff --git a/core/includes/common.inc b/core/includes/common.inc
index e2ef676..a5756f7 100644
--- a/core/includes/common.inc
+++ b/core/includes/common.inc
@@ -638,7 +638,7 @@ function _url($path = NULL, array $options = array()) {
  *   A ; separated string ready for insertion in a HTTP header. No escaping is
  *   performed for HTML entities, so this string is not safe to be printed.
  *
- * @see drupal_add_http_header()
+ * @see _drupal_add_http_header()
  */
 function drupal_http_header_attributes(array $attributes = array()) {
   foreach ($attributes as $attribute => &$data) {
@@ -1790,7 +1790,7 @@ function drupal_merge_attached(array $a, array $b) {
  * other kind of attached data, the array key must be the full name of the
  * callback function and each value an array of arguments. For example:
  * @code
- * $build['#attached']['drupal_add_http_header'] = array(
+ * $build['#attached']['_drupal_add_http_header'] = array(
  *   array('Content-Type', 'application/rss+xml; charset=utf-8'),
  * );
  * @endcode
@@ -1882,9 +1882,9 @@ function drupal_process_attached($elements, $dependency_check = FALSE) {
         case 'html_head_link':
           call_user_func_array('_drupal_add_html_head_link', $args);
           break;
-        case 'drupal_add_http_header':
+        case '_drupal_add_http_header':
         case 'http_header':
-          call_user_func_array('drupal_add_http_header', $args);
+          call_user_func_array('_drupal_add_http_header', $args);
           break;
         default:
           throw new \LogicException(sprintf('You are not allowed to use %s in #attached', $callback));
diff --git a/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php b/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
index c5a7be1..5533091 100644
--- a/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
+++ b/core/lib/Drupal/Core/EventSubscriber/FinishResponseSubscriber.php
@@ -98,7 +98,7 @@ public function onRespond(FilterResponseEvent $event) {
 
     // Attach globally-declared headers to the response object so that Symfony
     // can send them for us correctly.
-    // @todo remove this once we have removed all drupal_add_http_header()
+    // @todo remove this once we have removed all _drupal_add_http_header()
     //   calls.
     $headers = drupal_get_http_header();
     foreach ($headers as $name => $value) {
diff --git a/core/modules/system/tests/modules/system_test/system_test.module b/core/modules/system/tests/modules/system_test/system_test.module
index fc86adc..14f0121 100644
--- a/core/modules/system/tests/modules/system_test/system_test.module
+++ b/core/modules/system/tests/modules/system_test/system_test.module
@@ -10,7 +10,7 @@
  */
 function system_test_set_header() {
   $query = \Drupal::request()->query->all();
-  drupal_add_http_header($query['name'], $query['value']);
+  _drupal_add_http_header($query['name'], $query['value']);
   return t('The following header was set: %name: %value', array('%name' => $query['name'], '%value' => $query['value']));
 }