HTTP Headers Explained: Every Header, With Examples
One page per HTTP request and response header that developers actually look up. Each page states the direction, the specification that defines the header today, what happens when it is absent, and the mistakes it causes, with literal header lines you can copy. The checker on every page grades the six core security headers on any URL and shows you the full raw header table for everything else.
Every page here embeds the HTTP Headers Checker. Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
69 pages in this section.
Category Security
Strict-Transport-Security: the HSTS response header
What Strict-Transport-Security does, what max-age and includeSubDomains change, why preload is close to permanent, and how to withdraw the policy safely.
Content-Security-Policy: directives, sources and reporting
How CSP directives are matched, what default-src actually falls back to, why unsafe-inline defeats the point of a policy, and how nonces and hashes work.
Content-Security-Policy-Report-Only: testing a policy safely
How the report-only CSP header measures a policy without blocking anything, where the violation reports go, and when to run it alongside an enforcing policy.
X-Content-Type-Options: nosniff and MIME sniffing
What nosniff stops a browser doing, why it is the safest security header to add, and the two kinds of resource it starts rejecting once you turn it on.
X-Frame-Options: DENY, SAMEORIGIN and clickjacking
What DENY and SAMEORIGIN do, why ALLOW-FROM never worked, and how CSP frame-ancestors supersedes this header while it is still worth sending.
Referrer-Policy: controlling what the Referer header leaks
Every Referrer-Policy value compared, what modern browsers do when the header is missing, and why URLs with tokens in them leak to third parties without it.
Permissions-Policy: turning browser features off by default
How Permissions-Policy allowlists are written, the empty parentheses that disable a feature, and how the syntax differs from the Feature-Policy header.
X-XSS-Protection: a legacy header and why it is off
What the browser XSS auditor did, why Chrome and Edge removed it, why 0 is now the recommended value, and what to send in its place.
Cross-Origin-Opener-Policy: isolating your browsing context
What COOP severs between your page and the windows it opens, how same-origin differs from same-origin-allow-popups, and its part in cross-origin isolation.
Cross-Origin-Embedder-Policy: require-corp and credentialless
What require-corp demands from every subresource, how credentialless relaxes it, and why enabling COEP is what breaks third party images and embeds.
Cross-Origin-Resource-Policy: who may embed this response
How CORP lets a response refuse to be embedded by other sites, how same-site differs from same-origin, and why asset hosts have to send cross-origin.
Clear-Site-Data: wiping browser state on logout
How Clear-Site-Data clears cookies, storage and caches for your origin, which directives are safe on a logout response, and where support is uneven.
Reporting-Endpoints: where browser reports are sent
How Reporting-Endpoints names collectors for CSP violations and deprecation warnings, how it differs from the older Report-To header, and what arrives.
Sec-Fetch-Site and the Fetch Metadata request headers
What the browser tells your server about where a request came from and what it is for, and how to use Fetch Metadata headers to reject cross-site requests.
Category Caching
Cache-Control: directives for browsers and shared caches
Every Cache-Control directive that matters, the difference between no-cache and no-store, and how to cache immutable assets forever without breaking deploys.
ETag: version identifiers for conditional requests
How an ETag is compared, when to use a weak tag, how it drives 304 responses and 412 conflicts, and why compression changes the tag a server sends.
Last-Modified: timestamps as a weak validator
The exact date format Last-Modified requires, why one second resolution makes it a weak validator, and how caches use it to guess freshness.
Expires: the older way to set a freshness lifetime
What Expires does, why Cache-Control max-age overrides it, what an invalid date such as 0 means to a cache, and whether it is still worth sending.
Age: how long a cached response has been sitting there
What the Age header counts, how it combines with max-age to give remaining freshness, and how to use it to tell a cache hit from a miss at the edge.
Vary: which request headers change the response
How Vary extends a cache key, why Vary: User-Agent destroys hit rates, what Vary: * means, and the CORS case where forgetting Vary: Origin causes real bugs.
If-None-Match: asking whether anything changed
How If-None-Match produces a 304, why it uses weak comparison, how it overrides If-Modified-Since, and its second job preventing duplicate creates.
If-Modified-Since: date based conditional requests
How If-Modified-Since produces a 304, why it only applies to GET and HEAD, when servers must ignore it, and why entity tags are preferred where both exist.
If-Match: safe updates and the lost update problem
How If-Match turns a PUT or PATCH into a conditional write, why it uses strong comparison, and how 412 Precondition Failed prevents silent overwrites.
If-Unmodified-Since: a date based conditional write
How If-Unmodified-Since guards a write with a timestamp instead of an entity tag, when servers ignore it, and why an ETag is the stronger guarantee.
Pragma: a deprecated header still copied everywhere
What Pragma: no-cache ever did, why it only applied to requests, why it is deprecated in RFC 9111, and whether there is any reason to keep sending it.
Date: when the response was generated
What the Date header records, the exact GMT format required, how caches use it with Age and max-age, and the one case where a server may omit it.
Category Content
Accept: asking for a media type, with preferences
How the Accept header expresses preferences with q values, how servers pick a representation, and what to return when nothing on the list can be produced.
Accept-Encoding: negotiating gzip, br and zstd
Which compression tokens clients send, how identity and the wildcard behave, why the response needs Vary, and how to test whether compression is really on.
Accept-Language: language negotiation and its limits
How Accept-Language ranks languages, why matching should fall back from a region to a base tag, and why it is a poor way to pick a currency or a country.
Content-Type: media type, charset and boundary
How Content-Type is structured, why the charset parameter still matters, what boundary does on a multipart upload, and how a wrong type breaks a page.
Content-Length: the size of the body in octets
What Content-Length counts, why it must never accompany Transfer-Encoding, what happens when it disagrees with the body, and when it may be omitted.
Content-Encoding: what compression was applied
What Content-Encoding declares, how it differs from Transfer-Encoding, why it changes the ETag, and how double compression happens in a proxy chain.
Content-Language: the audience a document is for
What Content-Language actually states, how it differs from the lang attribute in markup, when to list several tags, and how it pairs with Accept-Language.
Content-Disposition: download prompts and file names
How to force a download instead of inline display, how filename and filename* differ, and how to send a non-ASCII file name that survives every browser.
Content-Range: which bytes this partial response holds
How Content-Range describes a byte range, what the total size field means, the unsatisfied form sent with 416, and how multipart ranges are framed.
Range: asking for part of a resource
How to request a byte range, what a suffix range does, why a server may ignore the header and return 200, and how to resume a download safely.
Accept-Ranges: advertising support for partial requests
What Accept-Ranges advertises, why the value none is a deliberate statement, and how a missing header breaks resumable downloads and video seeking.
Transfer-Encoding: chunked framing on the connection
What chunked transfer encoding does, why it is a hop by hop property, why it must never accompany Content-Length, and why HTTP/2 forbids it entirely.
User-Agent: what the client says it is
Why User-Agent strings look the way they do, why browsers are freezing and reducing them, and what to use instead of parsing one for feature decisions.
Category CORS
Access-Control-Allow-Origin: who may read this response
How the allow origin header is matched, why a wildcard fails with credentials, why it takes only one origin, and why Vary: Origin is mandatory when you echo.
Access-Control-Allow-Methods: permitted methods on preflight
Where the allow methods header belongs, why it appears only on the preflight response, which methods never need it, and how it interacts with caching.
Access-Control-Allow-Headers: permitted request headers
Which request headers trigger a preflight, how to answer with the right allow list, and the one header a wildcard never covers.
Access-Control-Allow-Credentials: cookies across origins
What credentials mode means, the three wildcards it disables, what the client must also do, and why this header needs an exact origin in the response.
Access-Control-Expose-Headers: reading response headers
Which response headers page code can read cross-origin by default, how to expose more, and why a pagination or request id header appears empty without it.
Access-Control-Max-Age: caching the preflight result
How long a browser may reuse a preflight result, the caps Chrome and Firefox apply, what minus one means, and why a doubled request count is normal.
Origin: where a request was initiated from
When browsers send Origin, why it is only scheme, host and port, when the value is null, and how to use it for cross-site request forgery defence.
Access-Control-Request-Method: the preflight question
What the browser sends on a preflight, which methods trigger one, why the server must answer with an exact match, and how to reproduce a preflight by hand.
Access-Control-Request-Headers: declaring custom headers
What the browser declares on a preflight, why the names arrive lowercase and sorted, which headers are omitted, and how to answer without guessing.
Timing-Allow-Origin: exposing detailed resource timings
Why cross-origin resources show zeroed timings, what Timing-Allow-Origin unlocks in the Resource Timing API, and how it differs from a CORS allow header.
Category Authentication
Authorization: credentials on a request
How the Authorization header is structured, how Basic and Bearer differ, why it is dropped across a cross-host redirect, and how it interacts with caching.
WWW-Authenticate: the challenge that comes with a 401
What a 401 challenge must contain, what realm means to a browser, how Bearer error codes are reported, and why a 401 without this header is malformed.
Proxy-Authorization: credentials for the proxy itself
How proxy authentication differs from origin authentication, why the header is hop by hop, what a 407 means, and how tunnelled connections handle it.
Cookie: what the browser sends back
How the Cookie header is formatted, why attributes never come back, how the browser decides which cookies to include, and what the size limits are.
Set-Cookie: attributes, SameSite and cookie prefixes
Every Set-Cookie attribute explained, why SameSite=None needs Secure, what the __Host- prefix guarantees, and how Max-Age and Expires interact.
Category Connection and routing
Host: which site the request is for
Why Host is mandatory in HTTP/1.1, how it maps to the authority in HTTP/2 and HTTP/3, and why trusting it to build URLs creates a real vulnerability.
Location: where the client should go next
How Location works on each 3xx status, why it also appears on a 201 Created, whether relative URLs are allowed, and how to avoid an open redirect.
Retry-After: when to try the request again
The two formats Retry-After accepts, which statuses it belongs on, why a fixed value causes synchronised retries, and how clients should treat it.
Server: what software answered the request
What the Server header conveys, why exposing a version number helps attackers narrow their targets, and what to put there instead of removing it entirely.
Via: the proxies a message passed through
How Via records each intermediary, what the protocol and pseudonym fields mean, how it detects request loops, and why it is useful when debugging a cache.
Forwarded: the standardised proxy header
The syntax of the standard Forwarded header, how it replaces the X-Forwarded set, how to quote IPv6 addresses and ports, and how far to trust it.
X-Forwarded-For: the client address behind a proxy
How the X-Forwarded-For list is built, why the leftmost address is not trustworthy, how to count trusted hops, and what breaks rate limiting behind a proxy.
X-Forwarded-Proto: the scheme the client actually used
Why an application behind a proxy cannot see the client scheme, how X-Forwarded-Proto restores it, and the redirect loop that follows from ignoring it.
Connection: keep-alive, close and hop by hop headers
What the Connection header controls, how it lists hop by hop headers, why HTTP/1.1 keeps connections open by default, and why HTTP/2 forbids it.
Upgrade: switching protocols on an open connection
How the Upgrade header negotiates a protocol switch, what a 101 response means, why proxies break WebSocket handshakes, and what HTTP/2 does instead.
Alt-Svc: advertising an alternative endpoint
How Alt-Svc advertises another protocol or endpoint for the same origin, what ma and persist do, and why it is how most sites move clients to HTTP/3.
Link: relationships expressed in a header
How the Link header carries relationships that markup cannot, its use for preload with early hints, and the pagination pattern that APIs build on it.
Server-Timing: server side metrics in the response
How to report server side durations to the browser, the dur and desc parameters, what it costs to expose them, and how to read them cross-origin.
Early-Data: requests sent before the handshake finished
What TLS early data is, why a request sent in it can be replayed, what the Early-Data header signals, and when a server should answer 425 Too Early.
X-Powered-By: a header worth removing
What X-Powered-By discloses, why frameworks add it by default, what removing it actually buys you, and which related headers leak the same information.