// reference
HTTP Headers Reference
The HTTP request, response, caching, CORS and security headers you meet every day — what each one means, with a real-world example.
HTTP headers carry the metadata that makes requests and responses work — content types, caching, auth, CORS and security. This reference groups the headers you actually run into, each with a plain-English description and an example value.
Request headers
| Header | Description | Example |
|---|---|---|
Accept | Media types the client can understand | Accept: application/json |
Accept-Encoding | Content encodings the client accepts | Accept-Encoding: gzip, br |
Accept-Language | Preferred natural languages | Accept-Language: en-US,en;q=0.9 |
Authorization | Credentials for authenticating the request | Authorization: Bearer <token> |
Content-Type | Media type of the request body | Content-Type: application/json |
Content-Length | Size of the body in bytes | Content-Length: 348 |
Cookie | Cookies previously set by the server | Cookie: sid=abc123 |
Host | Domain of the server (required in HTTP/1.1) | Host: devutilsnow.com |
Origin | Origin that initiated the request (CORS) | Origin: https://devutilsnow.com |
Referer | Address of the page that made the request | Referer: https://google.com/ |
User-Agent | Identifier for the client software | User-Agent: Mozilla/5.0 … |
If-None-Match | Conditional request based on an ETag | If-None-Match: "33a64df5" |
Range | Request only part of a resource | Range: bytes=0-1023 |
Response headers
| Header | Description | Example |
|---|---|---|
Content-Type | Media type of the response body | Content-Type: text/html; charset=utf-8 |
Content-Encoding | Compression applied to the body | Content-Encoding: gzip |
Content-Disposition | Show inline or download as a file | Content-Disposition: attachment; filename="a.pdf" |
ETag | Version identifier used for caching | ETag: "33a64df5" |
Last-Modified | When the resource last changed | Last-Modified: Tue, 18 Aug 2026 07:28:00 GMT |
Location | Target of a redirect or a created resource | Location: /new-path |
Set-Cookie | Send a cookie to the client | Set-Cookie: sid=abc; HttpOnly; Secure |
Server | Software handling the request | Server: nginx |
Retry-After | When to retry (with 429 or 503) | Retry-After: 120 |
WWW-Authenticate | Authentication scheme for a 401 | WWW-Authenticate: Bearer |
Caching
| Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching in browsers and proxies | Cache-Control: max-age=3600, public |
Age | Seconds the object has been in a proxy cache | Age: 24 |
Expires | Absolute date after which the response is stale | Expires: Wed, 19 Aug 2026 07:28:00 GMT |
Vary | Which request headers affect the cached response | Vary: Accept-Encoding |
CORS
| Header | Description | Example |
|---|---|---|
Access-Control-Allow-Origin | Origins allowed to read the response | Access-Control-Allow-Origin: * |
Access-Control-Allow-Methods | Methods allowed for the resource | Access-Control-Allow-Methods: GET, POST |
Access-Control-Allow-Headers | Headers allowed in the actual request | Access-Control-Allow-Headers: Content-Type |
Access-Control-Allow-Credentials | Whether credentials may be sent | Access-Control-Allow-Credentials: true |
Access-Control-Max-Age | How long a preflight result can be cached | Access-Control-Max-Age: 600 |
Security
| Header | Description | Example |
|---|---|---|
Strict-Transport-Security | Force HTTPS for future requests (HSTS) | max-age=63072000; includeSubDomains |
Content-Security-Policy | Restrict where resources may load from | Content-Security-Policy: default-src 'self' |
X-Content-Type-Options | Stop MIME-type sniffing | X-Content-Type-Options: nosniff |
X-Frame-Options | Control framing to prevent clickjacking | X-Frame-Options: DENY |
Referrer-Policy | How much referrer information to send | Referrer-Policy: no-referrer |
Permissions-Policy | Enable or disable browser features | Permissions-Policy: geolocation=() |
// related tools
Put this to work
// related guides
Go deeper
Anatomy of an HTTP Request and Response A line-by-line breakdown of an HTTP request and response — the request line, status line, headers, and body — so raw HTTP stops looking like noise. HTTP Headers Parser The Complete Guide to HTTP for Developers HTTP end to end — what it is, the anatomy of a request and response, methods, status codes, and headers — with links to focused deep-dives and tools. HTTP Status Code Lookup How to Read and Parse HTTP Headers The anatomy of HTTP request and response headers, how to turn raw headers into JSON, and why duplicates become arrays. HTTP Headers Parser HTTP Status Codes Explained (1xx–5xx) What HTTP status code classes mean, the codes you'll actually hit, and how to tell a client error from a server error. HTTP Status Code Lookup
More developer references
Cheat sheets and lookups paired with 36+ free, private, browser-based tools.