HTTP Headers Reference
The HTTP request, response, caching, CORS and security headers you meet every day — what each one means, with a real-world example.
HTTP headers carry the metadata that makes requests and responses work — content types, caching, auth, CORS and security. This reference groups the headers you actually run into, each with a plain-English description and an example value.
Request headers
| Header | Description | Example |
|---|---|---|
Accept | Media types the client can understand | Accept: application/json |
Accept-Encoding | Content encodings the client accepts | Accept-Encoding: gzip, br |
Accept-Language | Preferred natural languages | Accept-Language: en-US,en;q=0.9 |
Authorization | Credentials for authenticating the request | Authorization: Bearer <token> |
Content-Type | Media type of the request body | Content-Type: application/json |
Content-Length | Size of the body in bytes | Content-Length: 348 |
Cookie | Cookies previously set by the server | Cookie: sid=abc123 |
Host | Domain of the server (required in HTTP/1.1) | Host: devutilsnow.com |
Origin | Origin that initiated the request (CORS) | Origin: https://devutilsnow.com |
Referer | Address of the page that made the request | Referer: https://google.com/ |
User-Agent | Identifier for the client software | User-Agent: Mozilla/5.0 … |
X-Forwarded-For | Original client IP address behind proxies and load balancers | X-Forwarded-For: 203.0.113.7, 198.51.100.23 |
If-None-Match | Conditional request based on an ETag | If-None-Match: "33a64df5" |
Range | Request only part of a resource | Range: bytes=0-1023 |
Response headers
| Header | Description | Example |
|---|---|---|
Content-Type | Media type of the response body | Content-Type: text/html; charset=utf-8 |
Content-Encoding | Compression applied to the body | Content-Encoding: gzip |
Content-Disposition | Show inline or download as a file | Content-Disposition: attachment; filename="a.pdf" |
ETag | Version identifier used for caching | ETag: "33a64df5" |
Last-Modified | When the resource last changed | Last-Modified: Tue, 18 Aug 2026 07:28:00 GMT |
Location | Target of a redirect or a created resource | Location: /new-path |
Set-Cookie | Send a cookie to the client | Set-Cookie: sid=abc; HttpOnly; Secure |
Server | Software handling the request | Server: nginx |
Retry-After | When to retry (with 429 or 503) | Retry-After: 120 |
WWW-Authenticate | Authentication scheme for a 401 | WWW-Authenticate: Bearer |
Caching
| Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching in browsers and proxies | Cache-Control: max-age=3600, public |
Age | Seconds the object has been in a proxy cache | Age: 24 |
Expires | Absolute date after which the response is stale | Expires: Wed, 19 Aug 2026 07:28:00 GMT |
Vary | Which request headers affect the cached response | Vary: Accept-Encoding |
CORS
| Header | Description | Example |
|---|---|---|
Access-Control-Allow-Origin | Origins allowed to read the response | Access-Control-Allow-Origin: * |
Access-Control-Allow-Methods | Methods allowed for the resource | Access-Control-Allow-Methods: GET, POST |
Access-Control-Allow-Headers | Headers allowed in the actual request | Access-Control-Allow-Headers: Content-Type |
Access-Control-Allow-Credentials | Whether credentials may be sent | Access-Control-Allow-Credentials: true |
Access-Control-Max-Age | How long a preflight result can be cached | Access-Control-Max-Age: 600 |
Security
| Header | Description | Example |
|---|---|---|
Strict-Transport-Security | Force HTTPS for future requests (HSTS) | max-age=63072000; includeSubDomains |
Content-Security-Policy | Restrict where resources may load from | Content-Security-Policy: default-src 'self' |
X-Content-Type-Options | Stop MIME-type sniffing | X-Content-Type-Options: nosniff |
X-Frame-Options | Control framing to prevent clickjacking | X-Frame-Options: DENY |
Referrer-Policy | How much referrer information to send | Referrer-Policy: no-referrer |
Permissions-Policy | Enable or disable browser features | Permissions-Policy: geolocation=() |
Commonly confused, explained
CORS: which header do I need?
Access-Control-Allow-Origin says who may read the response. For preflighted requests, Access-Control-Allow-Methods and Access-Control-Allow-Headers list the permitted methods and request headers, Access-Control-Max-Age caches that answer, and Access-Control-Allow-Credentials is required for cookies. With credentials, the origin must be named exactly and wildcards stop working.
Caching: who decides what?
Cache-Control sets the rules and the lifetime. ETag and Last-Modified are validators a client sends back (If-None-Match) so the server can answer 304 Not Modified. Age shows how long a shared cache has held a response, Expires is the older absolute-date form, and Vary tells caches which request headers change the response.
Content negotiation and formats
The client asks with Accept, Accept-Language and Accept-Encoding. The server answers with Content-Type for the format and Content-Encoding for compression. Mixing up the request and response sides is the most common source of 406 and 415 errors.
Security headers worth setting first
Strict-Transport-Security forces HTTPS, Content-Security-Policy limits what a page may load and run, X-Content-Type-Options stops MIME sniffing, X-Frame-Options or CSP frame-ancestors controls framing, and Referrer-Policy and Permissions-Policy limit what the browser shares and allows.
Put this to work
Go deeper
More developer references
Cheat sheets and lookups paired with 36+ free, private, browser-based tools.