HTTP Headers Reference
Complete guide to HTTP headers — learn what each header does, how to configure it, and why it matters for security and performance.
Security
Content-Security-PolicyControls which resources the browser is allowed to load for a page, helping prevent XSS and data injection attacks.
Cross-Origin-Opener-PolicyIsolates the browsing context to prevent cross-origin attacks like Spectre from accessing sensitive data.
Cross-Origin-Resource-PolicyRestricts which origins can load a resource, preventing unauthorized cross-origin reads.
Permissions-PolicyControls which browser features and APIs can be used on the page, such as camera, microphone, and geolocation.
Referrer-PolicyControls how much referrer information is included with requests, balancing privacy with analytics needs.
Strict-Transport-SecurityInstructs browsers to only access the site via HTTPS, protecting against protocol downgrade attacks and cookie hijacking.
X-Content-Type-OptionsPrevents browsers from MIME-sniffing the content type, reducing the risk of drive-by downloads and XSS attacks.
X-Frame-OptionsControls whether a page can be displayed in a frame or iframe, protecting against clickjacking attacks.
X-XSS-ProtectionLegacy header that enabled the browser's built-in XSS filter. Now deprecated in favor of Content-Security-Policy.
Response
ConnectionControls whether the network connection stays open after the current transaction finishes.
Content-DispositionIndicates whether the response should be displayed inline or downloaded as a file attachment.
Content-EncodingSpecifies the compression algorithm applied to the response body, such as gzip or brotli.
Content-LengthSpecifies the size of the response body in bytes.
Content-TypeIndicates the media type of the response body, telling the browser how to interpret and display the content.
DateIndicates the date and time at which the response was generated by the server.
ETagProvides a unique identifier for a specific version of a resource, enabling efficient conditional requests.
Last-ModifiedIndicates the date and time the resource was last modified, used for cache validation.
LocationSpecifies the URL to redirect the client to, used with 3xx redirect status codes.
Retry-AfterTells the client how long to wait before making a new request after being rate-limited or redirected.
ServerIdentifies the web server software. Should be minimized for security reasons.
Set-CookieSends a cookie from the server to the browser for session management, tracking, and personalization.
Transfer-EncodingSpecifies the encoding used to transfer the response body, typically chunked.
WWW-AuthenticateDefines the authentication method the server requires to access a protected resource.
Caching
AgeIndicates how long a response has been stored in a cache, in seconds since generation.
Cache-ControlThe primary header for controlling caching behavior, defining how and for how long responses can be cached.
ExpiresSpecifies a date/time after which the response is considered stale. Superseded by Cache-Control max-age.
PragmaLegacy HTTP/1.0 header for backward-compatible cache control. Replaced by Cache-Control.
VaryTells caches which request headers to consider when deciding whether to serve a cached response.
CORS
Access-Control-Allow-CredentialsIndicates whether the response to a credentialed cross-origin request can be exposed to JavaScript.
Access-Control-Allow-HeadersSpecifies which HTTP headers can be used in the actual request following a CORS preflight.
Access-Control-Allow-MethodsSpecifies which HTTP methods are allowed in a CORS preflight response.
Access-Control-Allow-OriginSpecifies which origins are permitted to read the response, the fundamental CORS header.
Access-Control-Max-AgeSpecifies how long the results of a CORS preflight request can be cached.
Request
AcceptSpecifies the media types the client can process in the response.
Accept-EncodingIndicates which content encodings the client can understand.
Accept-LanguageAdvertises the natural languages the client prefers in the response.
AuthorizationCarries credentials to authenticate the client with the server.
CookieSends previously stored cookies from the server back with each request.
HostSpecifies the domain name and port of the server being requested.
If-Modified-SinceMakes the request conditional; server responds with 304 if content hasn't changed since the given date.
If-None-MatchMakes the request conditional based on an ETag value; enables efficient cache validation.
OriginIndicates the origin (scheme, host, port) from which a cross-origin request is made.
RangeRequests only a specific part of a resource, enabling partial content downloads.
RefererContains the URL of the page that linked to the currently requested resource.
User-AgentIdentifies the client application, operating system, and engine making the request.
Check your website's HTTP headers right now
Check headers →