HTTP headers reference

Updated October 18, 2026Free mock REST & WebSocket APIs

A quick reference for the HTTP headers you'll meet while building and debugging websites and APIs — what each one does, whether it's sent by the client or the server, and a real example.

Search headers

Content-TypeRequest & responseContent
Media type of the body, plus parameters such as charset or the multipart boundary.
Content-Type: application/json; charset=utf-8
Content-LengthRequest & responseContent
Size of the body in bytes. Omitted with chunked transfer encoding.
Content-Length: 348
Content-EncodingRequest & responseContent
Compression applied to the body (gzip, br, zstd).
Content-Encoding: br
Content-DispositionResponseContent
Display inline or download as an attachment, with a suggested filename.
Content-Disposition: attachment; filename="report.pdf"
Content-LanguageResponseContent
Natural language(s) of the content.
Content-Language: en-US
Content-RangeResponseContent
Which part of the resource a 206 partial response contains.
Content-Range: bytes 0-1023/146515
Transfer-EncodingRequest & responseContent
HTTP/1.1 transfer coding, usually chunked when the length isn't known up front.
Transfer-Encoding: chunked
AcceptRequestContent
Media types the client can handle, with optional q-value preferences.
Accept: application/json, text/plain;q=0.9
Accept-EncodingRequestContent
Compression algorithms the client supports.
Accept-Encoding: gzip, deflate, br, zstd
Accept-LanguageRequestContent
Preferred languages for the response.
Accept-Language: en-GB,en;q=0.8,fr;q=0.5
RangeRequestContent
Ask for part of a resource (resumable downloads, video seeking).
Range: bytes=1024-
Accept-RangesResponseContent
Whether the server supports range requests.
Accept-Ranges: bytes
Cache-ControlRequest & responseCaching
Caching directives: max-age, no-cache, no-store, private, public, immutable, s-maxage, stale-while-revalidate.
Cache-Control: public, max-age=31536000, immutable
ExpiresResponseCaching
Legacy absolute expiry date; ignored when Cache-Control max-age is present.
Expires: Wed, 21 Oct 2026 07:28:00 GMT
AgeResponseCaching
Seconds the response has been in a shared cache (CDN).
Age: 1840
VaryResponseCaching
Request headers that change the response, so caches key on them.
Vary: Accept-Encoding, Accept-Language
ETagResponseCaching
Opaque version identifier of the resource, used for revalidation and concurrency.
ETag: "33a64df5514"
Last-ModifiedResponseCaching
When the resource last changed.
Last-Modified: Tue, 15 Sep 2026 12:45:26 GMT
If-None-MatchRequestConditionals
Return 304 if the ETag still matches (cache revalidation).
If-None-Match: "33a64df5514"
If-Modified-SinceRequestConditionals
Return 304 if unchanged since this date.
If-Modified-Since: Tue, 15 Sep 2026 12:45:26 GMT
If-MatchRequestConditionals
Only apply the write if the ETag matches, else 412 (prevents lost updates).
If-Match: "v7"
If-Unmodified-SinceRequestConditionals
Only proceed if the resource hasn't changed since this date, else 412.
If-Unmodified-Since: Tue, 15 Sep 2026 12:45:26 GMT
AuthorizationRequestAuth
Credentials for the server: Bearer tokens, Basic (base64 user:pass), AWS SigV4…
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9…
WWW-AuthenticateResponseAuth
Challenge sent with 401 describing how to authenticate.
WWW-Authenticate: Bearer realm="api", error="invalid_token"
Proxy-AuthorizationRequestAuth
Credentials for an intermediate proxy.
Proxy-Authorization: Basic dXNlcjpwYXNz
Proxy-AuthenticateResponseAuth
Proxy's challenge sent with 407.
Proxy-Authenticate: Basic realm="corp"
OriginRequestCORS
Origin (scheme://host:port) that initiated a cross-origin or POST request.
Origin: https://app.example.com
Access-Control-Allow-OriginResponseCORS
Which origin may read the response: one origin or * (not * with credentials).
Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-MethodsResponseCORS
Methods allowed for the actual request (preflight response).
Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-HeadersResponseCORS
Request headers allowed for the actual request (preflight response).
Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Allow-CredentialsResponseCORS
Allow cookies/auth on cross-origin requests (requires a specific origin).
Access-Control-Allow-Credentials: true
Access-Control-Expose-HeadersResponseCORS
Response headers scripts may read beyond the safelisted ones.
Access-Control-Expose-Headers: X-Total-Count
Access-Control-Max-AgeResponseCORS
Seconds a preflight result may be cached (Chrome caps at 7200).
Access-Control-Max-Age: 7200
Access-Control-Request-MethodRequestCORS
Sent in a preflight: the method of the upcoming request.
Access-Control-Request-Method: PUT
Access-Control-Request-HeadersRequestCORS
Sent in a preflight: non-safelisted headers of the upcoming request.
Access-Control-Request-Headers: content-type, authorization
Strict-Transport-SecurityResponseSecurity
HSTS: force HTTPS for this host for max-age seconds.
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-PolicyResponseSecurity
Allow-list of sources for scripts, styles, frames and more; mitigates XSS.
Content-Security-Policy: default-src 'self'; img-src * data:
X-Content-Type-OptionsResponseSecurity
nosniff stops browsers guessing a different MIME type.
X-Content-Type-Options: nosniff
X-Frame-OptionsResponseSecurity
Legacy clickjacking protection; superseded by CSP frame-ancestors.
X-Frame-Options: DENY
Referrer-PolicyResponseSecurity
How much of the URL is sent in Referer on navigation and requests.
Referrer-Policy: strict-origin-when-cross-origin
Permissions-PolicyResponseSecurity
Enable or disable browser features (camera, geolocation…) for the page and iframes.
Permissions-Policy: camera=(), geolocation=(self)
Cross-Origin-Opener-PolicyResponseSecurity
Isolate the browsing context group from cross-origin windows.
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-PolicyResponseSecurity
Which origins may embed this resource.
Cross-Origin-Resource-Policy: same-site
CookieRequestCookies
Cookies previously set by the server for this host and path.
Cookie: session=abc123; theme=dark
Set-CookieResponseCookies
Store a cookie, with attributes Expires/Max-Age, Domain, Path, Secure, HttpOnly, SameSite.
Set-Cookie: session=abc123; Path=/; Secure; HttpOnly; SameSite=Lax
ConnectionRequest & responseConnection
HTTP/1.1 connection options (keep-alive, close, upgrade). Forbidden in HTTP/2.
Connection: keep-alive
Keep-AliveRequest & responseConnection
Hints for persistent HTTP/1.1 connections.
Keep-Alive: timeout=5, max=1000
UpgradeRequest & responseConnection
Switch protocols on the same connection (WebSocket).
Upgrade: websocket
HostRequestConnection
Host name and port of the target server; required in HTTP/1.1.
Host: api.example.com
ExpectRequestConnection
Ask for 100 Continue before sending a large body.
Expect: 100-continue
LocationResponseRedirects
Target URL of a redirect (3xx) or of a newly created resource (201).
Location: https://example.com/new-page
RefreshResponseRedirects
Non-standard redirect after a delay (like the meta refresh tag).
Refresh: 5; url=https://example.com/
Retry-AfterResponseRate limiting
Seconds (or a date) to wait before retrying, with 429, 503 or 3xx.
Retry-After: 120
RateLimitResponseRate limiting
IETF draft rate-limit status (successor of X-RateLimit-*).
RateLimit: limit=100, remaining=37, reset=30
X-RateLimit-RemainingResponseRate limiting
De-facto header (GitHub, many APIs): requests left in the window.
X-RateLimit-Remaining: 4999
User-AgentRequestClient info
Identifies the client software: browser, OS, bot or HTTP library.
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) … Chrome/141.0.0.0 Safari/537.36
RefererRequestClient info
The page the request came from (misspelling kept from the original spec).
Referer: https://www.google.com/
Sec-CH-UARequestClient info
Client Hint: browser brands and major versions (Chromium).
Sec-CH-UA: "Chromium";v="141", "Google Chrome";v="141"
Sec-CH-UA-MobileRequestClient info
Client Hint: ?1 on mobile devices.
Sec-CH-UA-Mobile: ?0
Sec-CH-UA-PlatformRequestClient info
Client Hint: operating system name.
Sec-CH-UA-Platform: "Windows"
Accept-CHResponseClient info
Server asks the browser to send high-entropy Client Hints on later requests.
Accept-CH: Sec-CH-UA-Platform-Version, Sec-CH-UA-Model
Sec-Fetch-SiteRequestClient info
Fetch metadata: relation of the requester to the target (same-origin, cross-site…).
Sec-Fetch-Site: same-origin
Sec-Fetch-ModeRequestClient info
Fetch metadata: navigate, cors, no-cors, websocket…
Sec-Fetch-Mode: cors
Sec-GPCRequestClient info
Global Privacy Control: the user opts out of sale/sharing of personal data (successor of the deprecated DNT header).
Sec-GPC: 1
X-Forwarded-ForRequestProxies
Client IP chain added by proxies and load balancers (spoofable — trust only your own proxies).
X-Forwarded-For: 203.0.113.7, 10.0.0.2
X-Forwarded-ProtoRequestProxies
Original protocol (http/https) seen by the proxy.
X-Forwarded-Proto: https
X-Forwarded-HostRequestProxies
Original Host header seen by the proxy.
X-Forwarded-Host: www.example.com
ForwardedRequestProxies
Standard (RFC 7239) replacement for the X-Forwarded-* headers.
Forwarded: for=203.0.113.7;proto=https;host=example.com
ViaRequest & responseProxies
Proxies the message passed through.
Via: 1.1 varnish, 2.0 cloudfront
ServerResponseProxies
Software that generated the response.
Server: nginx
CF-Connecting-IPRequestProxies
Cloudflare: the visitor's real IP address.
CF-Connecting-IP: 203.0.113.7
CF-RayResponseProxies
Cloudflare request ID — include it in support tickets for 52x errors.
CF-Ray: 8d2f1a3b4c5d6e7f-AMS

How to see the headers of a request

In the browser, open DevTools → Network, click a request and open the Headers tab.
From a terminal, run curl -I https://example.com for response headers, or curl -v to see both directions.
To inspect exactly what a client or webhook sends, point it at a webhook tester URL.

A sensible set of security headers

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
Content-Security-Policy: default-src 'self'; frame-ancestors 'none'
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: camera=(), microphone=(), geolocation=()

Caching headers cheat sheet

Goal	Header
Fingerprinted assets	`Cache-Control: public, max-age=31536000, immutable`
HTML that must stay fresh	`Cache-Control: no-cache` + `ETag`
Private, never stored	`Cache-Control: no-store`
CDN caches, browsers revalidate	`Cache-Control: public, max-age=0, s-maxage=600`

Related tools

Frequently asked questions

Are HTTP header names case-sensitive?

No. Header names are case-insensitive (Content-Type equals content-type). HTTP/2 and HTTP/3 always send them in lowercase.

What's the difference between request and response headers?

Request headers are sent by the client (Accept, Authorization, Cookie); response headers by the server (Content-Type, Set-Cookie, Cache-Control). Some, like Content-Type, appear in both.

Should I still use X- prefixed headers?

RFC 6648 deprecated the X- convention for new headers. Existing ones like X-Forwarded-For remain in wide use, but name new custom headers without the prefix.

Which security headers should every site send?

At minimum Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options: nosniff and Referrer-Policy; add Permissions-Policy and Cross-Origin-Opener-Policy where they fit.

Your business here? Sponsor this tool from $16/week. See placements