What does HTTP Headers Reference actually do?

The HTTP headers reference explains common request and response headers. It does not send them. A header’s real effect depends on the server and the browser. CORS, caching, and cookies are easy to misread from a one-line definition.

When should I use HTTP Headers Reference?

Use it to recall what a header is for while reading a trace.

When should I not use HTTP Headers Reference?

Do not copy a CORS header recipe from memory without testing the browser.

What does HTTP Headers Reference not do?

Not an interactive request. Deprecated headers may still appear in the wild.

HTTP Headers Reference

Searchable reference of 70+ HTTP headers (request, response, general). Includes examples and RFC specs. Free online — runs locally, no upload.

74 of 74 HTTP headers

General Headers (9)

Cache-ControlGeneral

Directives for caching mechanisms

no-cache, no-store, must-revalidateRFC 7234

ConnectionGeneral

Control whether the network connection stays open

keep-aliveRFC 7230

DateGeneral

Date and time the message was sent

Wed, 21 Oct 2026 07:28:00 GMTRFC 7231

PragmaGeneral

HTTP/1.0 cache control (legacy)

no-cache

TrailerGeneral

Fields in the trailer of a chunked message

Expires

Transfer-EncodingGeneral

Form of encoding used to safely transfer the body

chunkedRFC 7230

UpgradeGeneral

Ask the server to upgrade to another protocol

websocket

ViaGeneral

Intermediate proxies and gateways

1.1 varnish

WarningGeneral

Additional info about the message's status

199 Miscellaneous warning

Request Headers (29)

AcceptRequest

Media types the client can accept

application/json, text/htmlRFC 7231

Accept-CharsetRequest

Character sets the client accepts

utf-8, iso-8859-1

Accept-EncodingRequest

Content encodings the client accepts

gzip, deflate, brRFC 7231

Accept-LanguageRequest

Preferred natural languages

en-US,en;q=0.9,es;q=0.8RFC 7231

AuthorizationRequest

Credentials for HTTP authentication

Bearer eyJhbGciOi...RFC 7235

CookieRequest

Stored HTTP cookies

session=abc123; theme=darkRFC 6265

DNTRequest

Do Not Track preference

1

ExpectRequest

Expectations the server needs to meet

100-continue

ForwardedRequest

Client info altered by proxies

for=192.0.2.60;proto=https

FromRequest

Email address of the user

user@example.com

HostRequest

Domain name of the server (required in HTTP/1.1)

api.example.comRFC 7230

If-MatchRequest

Make the request conditional on the ETag

"33a64df551425fcc55e4d42a148795d9f25f89d4"

If-Modified-SinceRequest

Make request conditional on modification date

Wed, 21 Oct 2026 07:28:00 GMT

If-None-MatchRequest

Make request conditional on ETag mismatch

W/"67ab43"

If-RangeRequest

Make range request conditional on ETag/date

"33a64df551425fcc55e4d42a148795d9f25f89d4"

If-Unmodified-SinceRequest

Make request conditional on no modification

Wed, 21 Oct 2026 07:28:00 GMT

Max-ForwardsRequest

Limit the number of proxies/loops

5

OriginRequest

Origin of the request (CORS)

https://example.comRFC 6454

Proxy-AuthorizationRequest

Credentials for proxy authentication

Basic dXNlcjpwYXNz

RangeRequest

Request only part of the body

bytes=0-1023

RefererRequest

Address of the previous page

https://example.com/page

TERequest

Transfer encodings the client accepts

trailers, deflate

User-AgentRequest

Client software identity string

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36RFC 7231

X-Forwarded-ForRequest

Client IP address through proxies

203.0.113.195, 70.41.3.18

X-Forwarded-HostRequest

Original Host header through proxy

example.com

X-Forwarded-ProtoRequest

Original protocol through proxy

https

X-Requested-WithRequest

Often used to identify AJAX requests

XMLHttpRequest

X-CSRF-TokenRequest

CSRF protection token

abc123def456

X-API-KeyRequest

API key for authentication

sk_test_123456789

Response Headers (36)

Accept-RangesResponse

Whether the server supports range requests

bytes

Access-Control-Allow-OriginResponse

CORS: which origins may access the resource

https://example.com or *Fetch

Access-Control-Allow-MethodsResponse

CORS: permitted HTTP methods

GET, POST, PUT, DELETE

Access-Control-Allow-HeadersResponse

CORS: permitted request headers

Content-Type, Authorization

Access-Control-Allow-CredentialsResponse

CORS: allow credentials

true

Access-Control-Expose-HeadersResponse

CORS: headers the browser can expose

X-Custom-Header

Access-Control-Max-AgeResponse

CORS: how long to cache preflight results

86400

AllowResponse

Methods the resource supports

GET, POST, HEAD

Content-DispositionResponse

Indicates if content is inline or attachment

attachment; filename="report.pdf"RFC 6266

Content-EncodingResponse

Encoding used on the body

gzipRFC 7231

Content-LanguageResponse

Language of the audience

en-USRFC 7231

Content-LengthResponse

Size of the body in bytes

34851RFC 7230

Content-LocationResponse

Alternate location for the returned data

/docs/data.json

Content-RangeResponse

Where in the full body this partial belongs

bytes 21010-47021/47022

Content-Security-PolicyResponse

CSP: restrict resource loading

default-src 'self'; script-src 'self'CSP3

Content-TypeResponse

Media type of the resource

application/json; charset=utf-8RFC 7231

Cross-Origin-Embedder-PolicyResponse

Controls cross-origin resource loading

require-corp

Cross-Origin-Opener-PolicyResponse

Isolates browsing context group

same-origin

Cross-Origin-Resource-PolicyResponse

Restricts cross-origin resource access

same-site

ETagResponse

Unique identifier for the version

"33a64df551425fcc55e4d42a148795d9f25f89d4"RFC 7232

ExpiresResponse

Date/time after which the response is stale

Wed, 21 Oct 2026 07:28:00 GMT

Last-ModifiedResponse

Date the resource was last modified

Wed, 21 Oct 2026 07:28:00 GMTRFC 7232

LocationResponse

URL to redirect to (3xx responses)

https://example.com/new-pageRFC 7231

Retry-AfterResponse

Seconds to wait before retrying (429/503)

120

ServerResponse

Server software identity

nginx/1.25.3

Set-CookieResponse

Set an HTTP cookie

session=abc123; HttpOnly; Secure; SameSite=StrictRFC 6265

Strict-Transport-SecurityResponse

HSTS: force HTTPS

max-age=31536000; includeSubDomains; preloadRFC 6797

VaryResponse

Headers that determine cached responses

Accept-Encoding, Origin

WWW-AuthenticateResponse

Authentication scheme (401 responses)

Bearer realm="api"RFC 7235

X-Content-Type-OptionsResponse

Prevent MIME-sniffing

nosniff

X-Frame-OptionsResponse

Control framing/clickjacking

DENY

X-Powered-ByResponse

Technology stack (often hidden for security)

Express

X-RateLimit-LimitResponse

Rate limit quota

1000

X-RateLimit-RemainingResponse

Remaining requests in window

999

X-RateLimit-ResetResponse

When the rate limit resets (epoch)

1735689600

X-XSS-ProtectionResponse

Legacy XSS filter (deprecated, use CSP instead)

1; mode=block

Search tools

HTTP Headers Reference

General Headers (9)

Request Headers (29)

Response Headers (36)