HTTP Headers
HTTP headers carry metadata about requests and responses – authentication, caching, content negotiation, security policies, and more. Defined in RFC 9110 and RFC 9111.
71
Documented Headers
| Header | Type | Description | Spec |
|---|---|---|---|
| Accept | Request | The Accept header tells the server which content types the client can process. | RFC 9110 |
| Accept-Encoding | Request | The Accept-Encoding header tells the server which compression algorithms the client supports. | RFC 9110 |
| Authorization | Request | The Authorization header sends client credentials to authenticate with a server. | RFC 9110 |
| Cache-Control | Both | Cache-Control directives control caching behavior in both requests and responses. | RFC 9111 |
| Content-Type | Both | The Content-Type header describes the media type and encoding of the message body. | RFC 9110 |
| ETag | Response | An ETag is an opaque identifier assigned to a specific version of a resource. | RFC 9110 |
| Host | Request | The Host header is the only mandatory HTTP/1. | RFC 9110 |
| Location | Response | The Location response header tells the client to redirect to a different URL. | RFC 9110 |
| Strict-Transport-Security | Security | The Strict-Transport-Security (HSTS) header tells browsers to only access the site over HTTPS for a specified duration. | RFC 6797 |
| Content-Security-Policy | Security | The Content-Security-Policy (CSP) header controls which resources a browser is allowed to load for a page. | W3C Recommendation |
| X-Content-Type-Options | Security | The X-Content-Type-Options header with value 'nosniff' prevents browsers from MIME-type sniffing – guessing the content type from the response body instead of using the declared Content-Type. | WHATWG Fetch Standard |
| X-Frame-Options | Security | The X-Frame-Options header prevents a page from being embedded in iframes, frames, or objects on other origins – defending against clickjacking attacks. | RFC 7034 |
| Vary | Response | The Vary header tells caches which request headers affect the response content – instructing them to store separate cached versions for different values. | RFC 9110 |
| Retry-After | Response | The Retry-After header tells the client how long to wait before making another request. | RFC 9110 |
| X-Request-ID | Both | X-Request-ID is a custom header (not standardized) that carries a unique identifier for each HTTP request, enabling request tracing across distributed systems. | Custom header (no RFC) |
| Set-Cookie | Response | The Set-Cookie header instructs the browser to store a cookie. | RFC 6265 |
| Last-Modified | Response | The Last-Modified header provides the date and time when the server last modified the resource. | RFC 9110 |
| Content-Encoding | Response | The Content-Encoding header indicates what compression has been applied to the response body. | RFC 9110 |
| User-Agent | Request | The User-Agent header identifies the client software making the request. | RFC 9110 |
| WWW-Authenticate | Response | The WWW-Authenticate header is sent with a 401 Unauthorized response. | RFC 9110 |
| If-None-Match | Request | The If-None-Match header sends a previously received ETag value back to the server on a conditional GET request. | RFC 9110 |
| If-Modified-Since | Request | The If-Modified-Since header sends a date to the server on a conditional GET – the server returns 304 Not Modified if the resource hasn't changed since that date, or 200 with fresh content if it has. | RFC 9110 |
| Transfer-Encoding | Response | The Transfer-Encoding header specifies how the response body is encoded for transfer between nodes. | RFC 9112 |
| Connection | Both | The Connection header controls whether the TCP connection stays open after the current request completes. | RFC 9110 |
| Upgrade | Both | The Upgrade header allows the client to request a protocol switch on an existing connection – most commonly used to upgrade HTTP/1. | RFC 9110 |
| Accept-Language | Request | The Accept-Language header tells the server which natural languages the client prefers, in priority order. | RFC 9110 |
| Origin | Request | The Origin header is sent on cross-origin requests (CORS) and WebSocket handshakes. | RFC 6454 |
| Referer | Request | The Referer header contains the URL of the page that linked to the current request. | RFC 9110 |
| X-Forwarded-For | Request | X-Forwarded-For carries the originating client IP address through a chain of proxies and load balancers. | RFC 7239 |
| Access-Control-Allow-Origin | Response | Access-Control-Allow-Origin is the primary CORS response header. | W3C CORS |
| Access-Control-Allow-Methods | Response | Access-Control-Allow-Methods is returned in CORS preflight responses (OPTIONS requests) to tell the browser which HTTP methods are allowed for cross-origin requests. | W3C CORS |
| If-Match | Request | If-Match makes a request conditional on the resource's current ETag matching the value the client last saw. | RFC 9110 |
| Range | Request | The Range header requests only a specific portion of a resource – a byte range. | RFC 9110 |
| Content-Range | Response | The Content-Range header is sent with 206 Partial Content responses. | RFC 9110 |
| If-Range | Request | The If-Range header makes a Range request conditional. | RFC 9110 |
| Link | Response | The Link header is the HTTP equivalent of the HTML <link> tag. | RFC 8288 |
| Age | Response | The Age header tells the client how many seconds the response has been in a proxy cache. | RFC 9111 |
| Expires | Response | The Expires header gives an explicit date/time after which the response is considered stale. | RFC 9111 |
| Pragma | Both | Pragma is an HTTP/1. | RFC 9111 |
| Date | Response | The Date header contains the date and time at which the message was originated, in RFC 1123 format. | RFC 9110 |
| Server | Response | The Server header identifies the software handling the request. | RFC 9110 |
| Content-Disposition | Response | Content-Disposition controls whether a response is displayed inline in the browser or downloaded as a file attachment. | RFC 6266 |
| Cross-Origin-Opener-Policy | Response | Cross-Origin-Opener-Policy (COOP) isolates the browsing context from cross-origin documents. | HTML Living Standard |
| Cross-Origin-Embedder-Policy | Response | Cross-Origin-Embedder-Policy (COEP) controls which cross-origin resources can be loaded by a document. | HTML Living Standard |
| Permissions-Policy | Response | Permissions-Policy (formerly Feature-Policy) controls which browser features and APIs a page and its iframes can use – camera, microphone, geolocation, payment, autoplay, fullscreen, and more. | W3C Permissions Policy |
| Timing-Allow-Origin | Response | Timing-Allow-Origin controls which origins can access detailed resource timing data for a response via the PerformanceResourceTiming API. | W3C Resource Timing |
| NEL | Response | NEL (Network Error Logging) configures the browser to report network-level errors – DNS failures, TCP connection errors, TLS handshake failures, and HTTP protocol errors – to a reporting endpoint. | W3C Network Error Logging |
| Report-To | Response | Report-To defines one or more reporting endpoints where the browser sends violation reports – CSP violations, NEL errors, deprecation warnings, and intervention reports. | W3C Reporting API |
| Clear-Site-Data | Response | Clear-Site-Data instructs the browser to clear stored data for the origin – cookies, localStorage, sessionStorage, indexedDB, cache, and service workers. | W3C Clear Site Data |
| X-DNS-Prefetch-Control | Response | X-DNS-Prefetch-Control controls whether the browser proactively resolves DNS for links on the page. | Non-standard |
| Forwarded | Request | The Forwarded header is the RFC 7239 standardized replacement for X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Proto. | RFC 7239 |
| If-Unmodified-Since | Request | If-Unmodified-Since makes a request conditional – the server only processes it if the resource has NOT been modified since the given date. | RFC 9110 |
| Accept-CH | Response | Accept-CH (Client Hints) tells the browser which Client Hints headers the server wants on subsequent requests – device memory, viewport width, DPR (device pixel ratio), network conditions, etc. | RFC 8942 |
| Alt-Svc | Response | Alt-Svc (Alternative Services) advertises alternative endpoints for the current service – different protocols (h3, h2), ports, or hostnames. | RFC 7838 |
| Expect | Request | The Expect header allows a client to indicate that it requires certain server behaviors before sending a large request body. | RFC 9110 |
| TE | Request | TE (Transfer Encodings) tells the server which transfer encodings the client can accept in the response, and whether the client can handle trailers. | RFC 9110 |
| Trailer | Both | The Trailer header lists which fields will appear in the trailer section of a chunked transfer-encoded message – headers sent after the body. | RFC 9110 |
| Priority | Both | The Priority header (RFC 9218) provides a standardized way for clients to signal request priority to servers and intermediaries. | RFC 9218 |
| Sec-Fetch-Site | Request | Sec-Fetch-Site is a Fetch metadata header that indicates the relationship between the origin that initiated the request and the request's target origin. | W3C Fetch Metadata |
| Sec-Fetch-Mode | Request | Sec-Fetch-Mode indicates how the request was initiated – navigate (top-level navigation), cors (CORS request), no-cors (non-CORS cross-origin), same-origin, or websocket. | W3C Fetch Metadata |
| Sec-Fetch-Dest | Request | Sec-Fetch-Dest indicates the destination of a fetch request – the type of content being requested. | W3C Fetch Metadata |
| Sec-CH-UA | Request | Sec-CH-UA is a Client Hints header that provides a structured representation of the browser's brand and version. | RFC 8942 |
| Save-Data | Request | Save-Data is a Client Hints header indicating the user has enabled a data-saving mode (e. | W3C Client Hints |
| DNT | Request | DNT (Do Not Track) was a browser header that signaled the user's preference not to be tracked for behavioral advertising. | W3C DNT (deprecated) |
| Cross-Origin-Resource-Policy | Response | Cross-Origin-Resource-Policy (CORP) controls which origins can load a resource via no-cors requests – <img>, <script>, <link>, CSS url(). | Fetch Standard |
| Keep-Alive | Both | Keep-Alive provides parameters for persistent HTTP connections – timeout (seconds to keep idle connection open) and max (maximum requests on this connection). | RFC 9110 |
| Max-Forwards | Request | Max-Forwards limits the number of times a TRACE or OPTIONS request can be forwarded by proxies. | RFC 9110 |
| From | Request | The From header contains the email address of the human user controlling the requesting agent. | RFC 9110 |
| Accept-Ranges | Response | Accept-Ranges advertises whether the server supports range requests for a resource. | RFC 9110 |
| Content-Location | Response | Content-Location gives a URL for the specific representation returned in the response body. | RFC 9110 |
| Referrer-Policy | Security | Referrer-Policy controls how much referrer information is included in the Referer request header when following links or loading resources. | W3C Recommendation |