is there any way to know if the status code in a response header was generated by Apache itself, or if it was directed by a PHP script?
I assume you are inspecting traffic on the client side with no real access to the server besides HTTP(S). Your best bet is indeed to check for the presence of the non-standard X-Powered-By header and see if its value starts with PHP/. However, this is only an indicator the status code in question may have been generated by PHP; it is not a guarantee. In fact, this header may have been forged in multiple ways. So in summary: there is no way to be sure.