// reference

HTTP Headers Reference

The HTTP request, response, caching, CORS and security headers you meet every day — what each one means, with a real-world example.

HTTP headers carry the metadata that makes requests and responses work — content types, caching, auth, CORS and security. This reference groups the headers you actually run into, each with a plain-English description and an example value.

Request headers

HeaderDescriptionExample
AcceptMedia types the client can understandAccept: application/json
Accept-EncodingContent encodings the client acceptsAccept-Encoding: gzip, br
Accept-LanguagePreferred natural languagesAccept-Language: en-US,en;q=0.9
AuthorizationCredentials for authenticating the requestAuthorization: Bearer <token>
Content-TypeMedia type of the request bodyContent-Type: application/json
Content-LengthSize of the body in bytesContent-Length: 348
CookieCookies previously set by the serverCookie: sid=abc123
HostDomain of the server (required in HTTP/1.1)Host: devutilsnow.com
OriginOrigin that initiated the request (CORS)Origin: https://devutilsnow.com
RefererAddress of the page that made the requestReferer: https://google.com/
User-AgentIdentifier for the client softwareUser-Agent: Mozilla/5.0 …
If-None-MatchConditional request based on an ETagIf-None-Match: "33a64df5"
RangeRequest only part of a resourceRange: bytes=0-1023

Response headers

HeaderDescriptionExample
Content-TypeMedia type of the response bodyContent-Type: text/html; charset=utf-8
Content-EncodingCompression applied to the bodyContent-Encoding: gzip
Content-DispositionShow inline or download as a fileContent-Disposition: attachment; filename="a.pdf"
ETagVersion identifier used for cachingETag: "33a64df5"
Last-ModifiedWhen the resource last changedLast-Modified: Tue, 18 Aug 2026 07:28:00 GMT
LocationTarget of a redirect or a created resourceLocation: /new-path
Set-CookieSend a cookie to the clientSet-Cookie: sid=abc; HttpOnly; Secure
ServerSoftware handling the requestServer: nginx
Retry-AfterWhen to retry (with 429 or 503)Retry-After: 120
WWW-AuthenticateAuthentication scheme for a 401WWW-Authenticate: Bearer

Caching

HeaderDescriptionExample
Cache-ControlDirectives for caching in browsers and proxiesCache-Control: max-age=3600, public
AgeSeconds the object has been in a proxy cacheAge: 24
ExpiresAbsolute date after which the response is staleExpires: Wed, 19 Aug 2026 07:28:00 GMT
VaryWhich request headers affect the cached responseVary: Accept-Encoding

CORS

HeaderDescriptionExample
Access-Control-Allow-OriginOrigins allowed to read the responseAccess-Control-Allow-Origin: *
Access-Control-Allow-MethodsMethods allowed for the resourceAccess-Control-Allow-Methods: GET, POST
Access-Control-Allow-HeadersHeaders allowed in the actual requestAccess-Control-Allow-Headers: Content-Type
Access-Control-Allow-CredentialsWhether credentials may be sentAccess-Control-Allow-Credentials: true
Access-Control-Max-AgeHow long a preflight result can be cachedAccess-Control-Max-Age: 600

Security

HeaderDescriptionExample
Strict-Transport-SecurityForce HTTPS for future requests (HSTS)max-age=63072000; includeSubDomains
Content-Security-PolicyRestrict where resources may load fromContent-Security-Policy: default-src 'self'
X-Content-Type-OptionsStop MIME-type sniffingX-Content-Type-Options: nosniff
X-Frame-OptionsControl framing to prevent clickjackingX-Frame-Options: DENY
Referrer-PolicyHow much referrer information to sendReferrer-Policy: no-referrer
Permissions-PolicyEnable or disable browser featuresPermissions-Policy: geolocation=()

More developer references

Cheat sheets and lookups paired with 36+ free, private, browser-based tools.

Browse references →
Last updated: Aug 18, 2026