HTTP Headers Reference

Search and filter 45+ HTTP headers across request, response, and security categories. Click any header name to copy it.

Showing 45 of 45 headers — click header name to copy

Request

Media types the client can process.

e.g.application/json, text/html
Request

Supported compression algorithms.

e.g.gzip, deflate, br
Request

Preferred languages.

e.g.en-US,en;q=0.9
Request

Authentication credentials.

e.g.Bearer eyJhbGc...
Request

Caching directives.

e.g.no-cache
Request

Connection persistence.

e.g.keep-alive
Request

Size of request body in bytes.

e.g.348
Request

Media type of the request body.

e.g.application/json
Request

HTTP cookies for the server.

e.g.session=abc123; theme=dark
Request

Target host and port.

e.g.api.example.com:443
Request

Conditional GET timestamp.

e.g.Wed, 21 Oct 2015 07:28:00 GMT
Request

Conditional GET with ETag.

e.g."686897696a7c876b7e"
Request

Origin of a cross-site request.

e.g.https://example.com
Request

URL of referring page.

e.g.https://example.com/page
Request

Client software identifier.

e.g.Mozilla/5.0 (Macintosh; ...)
Request

Identifies AJAX requests.

e.g.XMLHttpRequest
Request

Originating IP through proxies.

e.g.203.0.113.1, 10.0.0.1
Response

CORS allowed origins.

e.g.* or https://example.com
Response

CORS allowed methods.

e.g.GET, POST, OPTIONS
Response

Time in seconds object was in cache.

e.g.2397
Response

HTTP methods supported by resource.

e.g.GET, POST, HEAD
Response

Caching directives for response.

e.g.max-age=3600, public
Response

Attachment or inline.

e.g.attachment; filename="report.pdf"
Response

Applied encoding.

e.g.gzip
Response

Language of content.

e.g.en-US
Response

Response body size in bytes.

e.g.1234
Response

Media type of response.

e.g.application/json; charset=utf-8
Response

Entity tag for caching.

e.g."33a64df5"
Response

Date/time after which response is stale.

e.g.Thu, 01 Dec 2030 16:00:00 GMT
Response

Last modification date.

e.g.Tue, 15 Nov 2024 12:45:26 GMT
Response

URL for redirects.

e.g.https://example.com/new-page
Response

Time to wait before retry.

e.g.120
Response

Server software info.

e.g.nginx/1.18.0
Response

Set a cookie.

e.g.id=a3fWa; Max-Age=2592000; Secure; HttpOnly
Response

Fields that affect response caching.

e.g.Accept-Encoding, Accept-Language
Response

Authentication challenge.

e.g.Bearer realm="api"
Response

Prevent MIME sniffing.

e.g.nosniff
Response

Clickjacking protection.

e.g.DENY or SAMEORIGIN
Response

Max requests per window.

e.g.100
Response

Remaining requests.

e.g.74
Response

Unique request identifier.

e.g.f058ebd6-02f7-4d3f-942e-904344e8cde3
Security

Controls resource loading.

e.g.default-src 'self'
Security

Force HTTPS.

e.g.max-age=31536000; includeSubDomains
Security

Browser feature policy.

e.g.geolocation=(), microphone=()
Security

Controls referrer info.

e.g.strict-origin-when-cross-origin

Frequently Asked Questions

What are HTTP headers?

HTTP headers are key-value pairs sent at the start of every HTTP request and response. They carry metadata about the message — such as the content type, encoding, authentication credentials, caching rules, and security policies — without being part of the body. Both the client (browser or API consumer) and the server use headers to communicate how the data should be handled.

What do CORS headers do?

CORS (Cross-Origin Resource Sharing) headers allow servers to declare which external origins are permitted to read their responses in a browser. When a browser makes a cross-origin request, it checks the Access-Control-Allow-Origin response header. If the requesting origin is listed (or the value is *), the browser allows the response to be read by JavaScript. Without CORS headers, browsers block cross-origin responses by default to prevent malicious sites from reading sensitive data.

What is the difference between request headers and response headers?

Request headers are sent by the client (browser, mobile app, or API consumer) to the server and describe the request — for example, what content types the client accepts, what credentials it holds, or caching preferences. Response headers are sent back by the server and describe the response — for example, the content type returned, caching rules, cookies to set, or CORS permissions. Some header names (like Cache-Control and Content-Type) can appear in both directions with slightly different meanings.

Which security headers matter most?

The four most impactful security headers are: Content-Security-Policy (CSP), which restricts what resources a page can load and is the strongest defense against XSS attacks; Strict-Transport-Security (HSTS), which forces browsers to use HTTPS for your domain; X-Frame-Options or the frame-ancestors CSP directive, which prevents clickjacking by blocking your page from being embedded in iframes; and Referrer-Policy, which controls how much referrer information is sent to other origins. X-Content-Type-Options: nosniff is also worth adding to prevent MIME-type sniffing attacks.

Related Tools

HTTP Status Code ReferenceJWT DecoderURL Encode / Decode