Link: relationships expressed in a header
Link expresses a typed relationship between this resource and another URL, doing in a header what a link element does in markup, including for non-HTML responses.
At a glance
- Direction
- Response mostly, and permitted on requests though rarely used there.
- Defined in
- RFC 8288
- When absent
- Relationships have to be expressed in the body, which is impossible for a PDF, an image or an API response.
- Syntax
- An angle bracketed URL, then parameters: </next>; rel="next"
- Common relations
- preload, canonical, alternate, next, prev, describedby
- Used by
- 103 Early Hints, which carries preload links before the real response
- Cross-origin
- Not readable by page code unless it is named in Access-Control-Expose-Headers
In detail
The header does what a link element does, without needing a document to put it in. That is the whole reason it exists: a PDF, a generated image or a JSON response has no head section, so the only place to express a relationship such as a canonical URL or a licence is in the headers.
For performance the interesting relation is preload, because a header is available to the browser before any of the body has been parsed. Pairing it with a 103 Early Hints response sends the preloads while the server is still assembling the real response, so the browser can start fetching stylesheets and fonts during time that would otherwise be idle.
API pagination is the other established pattern. Returning first, prev, next and last relations in this header keeps the page body free of navigation metadata and gives clients complete URLs to follow rather than parameters to assemble. Remember to expose the header for cross-origin callers, or the client sees nothing.
Several relations can be sent, either comma separated in one header or as repeated header lines. Both are valid, and a large preload list is usually easier to read as separate lines, though every line adds to the response header size on a path where that cost is paid before anything is rendered.
Examples
Link: </css/app.css>; rel=preload; as=style
Link: </fonts/inter.woff2>; rel=preload; as=font; crossoriginThe as parameter is required, and a font preload needs the crossorigin flag even from your own origin.
Link: </items?page=4>; rel="next", </items?page=1>; rel="first", </items?page=9>; rel="last"
Access-Control-Expose-Headers: LinkLink: <https://example.com/reports/2025.pdf>; rel="canonical"Things that catch people out
- Preloading something the page does not use costs bandwidth and delays what it does use, and browsers report the waste in the console.
- A preload without the as parameter is ignored, and the resource is often fetched twice as a result.
- Cross-origin clients cannot read this header unless it is exposed, which is why so many paginated APIs appear to return no navigation links.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Content-Language: the audience a document is for
What Content-Language actually states, how it differs from the lang attribute in markup, when to list several tags, and how it pairs with Accept-Language.
Location: where the client should go next
How Location works on each 3xx status, why it also appears on a 201 Created, whether relative URLs are allowed, and how to avoid an open redirect.
Access-Control-Expose-Headers: reading response headers
Which response headers page code can read cross-origin by default, how to expose more, and why a pagination or request id header appears empty without it.
Server-Timing: server side metrics in the response
How to report server side durations to the browser, the dur and desc parameters, what it costs to expose them, and how to read them cross-origin.
Early-Data: requests sent before the handshake finished
What TLS early data is, why a request sent in it can be replayed, what the Early-Data header signals, and when a server should answer 425 Too Early.
X-Powered-By: a header worth removing
What X-Powered-By discloses, why frameworks add it by default, what removing it actually buys you, and which related headers leak the same information.
Tools for this
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL
- SEO Analyzer Free online SEO analyzer - analyze any website's SEO score and get actionable improvement tips