Host: which site the request is for
Host names the site the request is addressed to, which is how one IP address serves many domains. It is required on every HTTP/1.1 request.
At a glance
- Direction
- Request only. It is required, and a missing or duplicated value is a 400.
- Defined in
- RFC 9110, with the HTTP/1.1 requirement in RFC 9112
- When absent
- An HTTP/1.1 request without it is malformed and servers must reject it with 400 Bad Request.
- Value
- The host, and the port when it is not the default: example.com:8443
- In HTTP/2 and HTTP/3
- Carried as the :authority pseudo-header instead
- Selects
- The virtual host, which is how one address serves many sites
- Attacker controlled
- Yes. Anything built from it must be validated against an allowlist.
In detail
Before HTTP/1.1 a server could only infer the site from the address it was listening on, which meant one certificate and one site per address. Making the header mandatory is what allowed shared hosting and, later, everything built on it. A request that omits it cannot be routed, so the specification requires a 400 rather than a guess.
In HTTP/2 and HTTP/3 the same information travels as the :authority pseudo-header, and a Host header may still appear alongside it. They must agree, and servers reject a message where they do not, because a mismatch is another way to make two layers of your stack disagree about which site a request was for.
The security consequence is that this value comes from the client. A password reset email that builds its link from the incoming host, or a cache key that includes it without validation, can be steered by whoever sends the request. The fix is an allowlist of hostnames you actually serve, applied at the edge, and a configured canonical host for anything you generate.
It also matters for TLS. The name in the certificate is chosen from the Server Name Indication field during the handshake, before this header exists, so a request whose Host disagrees with the name that was negotiated is worth rejecting. Some proxies check that pairing and some do not, which is exactly the sort of gap host based routing attacks look for.
Examples
GET /pricing HTTP/1.1
Host: example.com
User-Agent: curl/8.4.0curl -s -H 'Host: example.com' http://203.0.113.10/pricingThe connection goes to the address, and the header tells the server which site to serve.
Things that catch people out
- Building absolute URLs from this header lets an attacker choose the domain in your password reset links. Use a configured canonical host instead.
- The port belongs in the value when it is not the default, and code that splits on a colon without handling IPv6 addresses in brackets gets it wrong.
- A duplicate Host header is malformed. Some proxies pass both through, and the two layers may pick different ones.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →X-Forwarded-For: the client address behind a proxy
How the X-Forwarded-For list is built, why the leftmost address is not trustworthy, how to count trusted hops, and what breaks rate limiting behind a proxy.
Forwarded: the standardised proxy header
The syntax of the standard Forwarded header, how it replaces the X-Forwarded set, how to quote IPv6 addresses and ports, and how far to trust it.
Location: where the client should go next
How Location works on each 3xx status, why it also appears on a 201 Created, whether relative URLs are allowed, and how to avoid an open redirect.
Origin: where a request was initiated from
When browsers send Origin, why it is only scheme, host and port, when the value is null, and how to use it for cross-site request forgery defence.
Retry-After: when to try the request again
The two formats Retry-After accepts, which statuses it belongs on, why a fixed value causes synchronised retries, and how clients should treat it.
Server: what software answered the request
What the Server header conveys, why exposing a version number helps attackers narrow their targets, and what to put there instead of removing it entirely.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL