T
DataToolings

HTTP Headers Reference

Searchable reference for HTTP request, response, and security headers with descriptions and example values.

50 headers

AcceptRequest

Media types the client can process.

Accept: application/json, text/html
Accept-EncodingRequest

Compression algorithms the client supports.

Accept-Encoding: gzip, deflate, br
Accept-LanguageRequest

Preferred natural languages for the response.

Accept-Language: en-US,en;q=0.9
AuthorizationRequest

Credentials to authenticate the client with the server.

Authorization: Bearer eyJhbGci...
Cache-ControlBoth

Directives for caching in both requests and responses.

Cache-Control: no-cache, no-store
ConnectionBoth

Controls whether the network connection stays open after the transaction.

Connection: keep-alive
Content-LengthBoth

Size of the request or response body in bytes.

Content-Length: 348
Content-TypeBoth

Media type of the resource or request body.

Content-Type: application/json; charset=utf-8
CookieRequest

Stored HTTP cookies previously sent by the server.

Cookie: session=abc123; theme=dark
HostRequest

Domain name and port of the server being requested. Required in HTTP/1.1.

Host: api.example.com
If-Modified-SinceRequest

Makes the request conditional — server returns 304 if not modified since this date.

If-Modified-Since: Wed, 21 Oct 2025 07:28:00 GMT
If-None-MatchRequest

Makes the request conditional based on ETag. Returns 304 if ETag matches.

If-None-Match: "abc123"
OriginRequest

Indicates the origin of a cross-site request. Used in CORS.

Origin: https://app.example.com
RefererRequest

Address of the previous page that linked to the current request.

Referer: https://example.com/page
User-AgentRequest

String identifying the client software making the request.

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)
X-Forwarded-ForRequest

Identifies the originating IP address of a client behind a proxy or load balancer.

X-Forwarded-For: 203.0.113.195, 70.41.3.18
X-Requested-WithRequest

Identifies Ajax requests. Commonly set to XMLHttpRequest by JS frameworks.

X-Requested-With: XMLHttpRequest
RangeRequest

Requests only part of a resource (used for resumable downloads).

Range: bytes=0-1023
ExpectRequest

Indicates expectations the server must meet to handle the request.

Expect: 100-continue
ForwardedRequest

Standardized replacement for X-Forwarded-For with proxy information.

Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43
Access-Control-Allow-OriginResponse

Specifies which origins can access the resource in cross-origin requests (CORS).

Access-Control-Allow-Origin: https://app.example.com
Access-Control-Allow-MethodsResponse

Specifies HTTP methods allowed in CORS preflight responses.

Access-Control-Allow-Methods: GET, POST, PUT, DELETE
Access-Control-Allow-HeadersResponse

Specifies headers allowed in CORS requests.

Access-Control-Allow-Headers: Content-Type, Authorization
Access-Control-Max-AgeResponse

How long (seconds) the CORS preflight response can be cached.

Access-Control-Max-Age: 86400
AgeResponse

Time in seconds the object has been in a proxy cache.

Age: 24
AllowResponse

Lists HTTP methods supported by the resource. Sent with 405 Method Not Allowed.

Allow: GET, POST, HEAD
Content-DispositionResponse

Indicates if content should be displayed inline or downloaded as an attachment.

Content-Disposition: attachment; filename="report.pdf"
Content-EncodingResponse

Encoding applied to the response body (e.g., gzip).

Content-Encoding: gzip
Content-LanguageResponse

Natural language(s) of the response content.

Content-Language: en-US
Content-RangeResponse

Indicates the range of bytes returned in a partial content response.

Content-Range: bytes 0-1023/2048
ETagResponse

Identifier for a specific version of a resource. Used for caching and conditional requests.

ETag: "abc123def456"
ExpiresResponse

Date/time after which the response is considered stale.

Expires: Thu, 01 Jan 2026 00:00:00 GMT
Last-ModifiedResponse

Date and time the resource was last modified.

Last-Modified: Wed, 21 Oct 2025 07:28:00 GMT
LocationResponse

URL to redirect the client to. Used with 3xx and 201 responses.

Location: https://example.com/new-page
Retry-AfterResponse

How long to wait before making a new request. Used with 429 and 503 responses.

Retry-After: 120
ServerResponse

Information about the server software handling the request.

Server: nginx/1.25.3
Set-CookieResponse

Sends a cookie from the server to the client.

Set-Cookie: session=abc123; HttpOnly; Secure; SameSite=Strict
Transfer-EncodingResponse

Encoding used to transfer the payload body (e.g., chunked).

Transfer-Encoding: chunked
VaryResponse

Tells caches which request headers to use when deciding whether a cached response can be used.

Vary: Accept-Encoding, Accept-Language
WWW-AuthenticateResponse

Defines the authentication method to access the resource. Sent with 401 responses.

WWW-Authenticate: Bearer realm="api"
Content-Security-PolicySecurity

Controls which resources the browser is allowed to load. Primary XSS defense.

Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-abc'
Strict-Transport-SecuritySecurity

Forces browsers to use HTTPS for future requests. Prevents protocol downgrade attacks.

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-OptionsSecurity

Prevents browsers from MIME-sniffing a response away from the declared content type.

X-Content-Type-Options: nosniff
X-Frame-OptionsSecurity

Controls whether the page can be embedded in an iframe. Prevents clickjacking. Superseded by CSP frame-ancestors.

X-Frame-Options: DENY
X-XSS-ProtectionSecurity

Legacy XSS filter for older browsers. Largely superseded by CSP.

X-XSS-Protection: 1; mode=block
Referrer-PolicySecurity

Controls how much referrer information is included with requests.

Referrer-Policy: strict-origin-when-cross-origin
Permissions-PolicySecurity

Controls which browser features and APIs can be used (replaces Feature-Policy).

Permissions-Policy: camera=(), microphone=(), geolocation=()
Cross-Origin-Opener-PolicySecurity

Isolates the browsing context to prevent cross-origin attacks (required for SharedArrayBuffer).

Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Embedder-PolicySecurity

Prevents loading cross-origin resources without explicit permission.

Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Resource-PolicySecurity

Prevents other origins from reading the response of the resource.

Cross-Origin-Resource-Policy: same-origin

What Is HTTP Headers Reference?

A searchable reference for all standard HTTP request, response, and security headers. Each entry includes a description, usage context, and a concrete example value — so you can find the right header and copy it directly into your code or server config.

How to Use

  1. Search by header name or description keyword
  2. Filter by type: Request, Response, Both, or Security
  3. Click the copy button to copy the example value

Features

  • 50 HTTP headers across 4 categories
  • Search by name or description
  • Filter by request, response, both, or security headers
  • One-click copy for each example value

FAQ

What are security headers?

Security headers are response headers that instruct the browser to enable or restrict certain behaviors — like blocking XSS (CSP), enforcing HTTPS (HSTS), or preventing clickjacking (X-Frame-Options).

What is the difference between request and response headers?

Request headers are sent by the client to the server (e.g., Authorization, Accept). Response headers are sent by the server back to the client (e.g., Content-Type, Set-Cookie). Some headers like Cache-Control appear in both.

Which security headers should every site have?

At minimum: Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options (or CSP frame-ancestors), and Referrer-Policy. Content-Security-Policy provides the strongest XSS protection but requires more configuration.