HTTP header reference

Directives that caches (browsers, proxies, CDNs) must follow for both requests and responses, such as how long a response may be reused.

Controls whether the network connection stays open after the current transaction, e.g. keep-alive or close.

Lists the encoding (e.g. gzip, br, deflate) applied to the body, which the receiver must reverse to read it.

The size of the message body in bytes, letting the receiver know when the body has fully arrived.

The MIME type of the body, such as application/json or text/html, telling the receiver how to interpret it.

The date and time at which the message was originated, in HTTP-date format.

A legacy, HTTP/1.0-era caching directive - Cache-Control is the modern replacement and should be preferred.

Lists which header fields will appear in the trailer of a message sent with chunked transfer encoding.

Specifies the form of encoding used to safely transfer the body, most commonly chunked.

Asks to switch the current connection to a different protocol, such as from HTTP/1.1 to WebSocket.

Added by proxies and gateways to show which intermediaries the message passed through.

A now-deprecated way to carry additional information about the status of a message, particularly around caching.

Tells the server which media types the client can understand, e.g. application/json or text/html.

Tells the server which character encodings the client can understand, such as UTF-8.

Tells the server which content encodings (e.g. gzip, br) the client can decode.

Tells the server which human languages, and in what order of preference, the client would like the response in.

Sent in a CORS preflight request to tell the server which HTTP method the actual request will use.

Sent in a CORS preflight request to tell the server which headers the actual request will include.

Carries credentials to authenticate the client with the server, e.g. a Bearer token or Basic auth string.

Sends previously stored cookies back to the server that set them.

Indicates that the client requires specific server behaviour before it sends the request body, most commonly Expect: 100-continue.

The standardised replacement for the various X-Forwarded-* headers, disclosing client info through a proxy in one field.

The email address of the person controlling the requesting user agent, mostly used by web crawlers.

The domain name and port of the server the request is being sent to - required on every HTTP/1.1 request.

Makes the request conditional on the resource matching one of the given ETags, commonly used to avoid lost updates.

Makes a GET request conditional - the server only sends the full body if the resource has changed since the given date.

Makes a request conditional on the resource not matching any of the given ETags - the ETag equivalent of If-Modified-Since.

Used with Range to make a partial-content request conditional, falling back to the full resource if it has changed.

Makes the request conditional on the resource not having changed since the given date.

Limits how many times a TRACE or OPTIONS request may be forwarded by proxies.

Identifies the origin (scheme, host, port) that initiated a cross-origin request, used by CORS.

Carries credentials to authenticate the client with a proxy server, the proxy equivalent of Authorization.

Requests only part of a resource, e.g. bytes=0-999, used for resumable downloads and video seeking.

The address of the page that linked to the resource being requested.

Lists the transfer encodings the client is willing to accept in the response, beyond the default chunked.

Identifies the client application, operating system, and version making the request.

"Do Not Track" - a now largely unsupported request that the client does not want its browsing tracked.

Historically used to identify an AJAX request, e.g. XMLHttpRequest, though the Fetch API often omits it.

Identifies the originating IP address of a client connecting through a proxy or load balancer.

Identifies the original Host header requested by the client before it reached a proxy.

Identifies the original protocol (http or https) the client used before reaching a proxy that terminated TLS.

Signals that the client prefers an encrypted, authenticated response and will follow an upgrade to HTTPS.

Tells the server the client has requested a reduced-data-usage mode, so lighter responses should be served where possible.

"Global Privacy Control" - signals that the user does not consent to their data being sold or shared.

Tells the browser which origin(s) are allowed to read a cross-origin response, the core CORS header.

Tells the browser whether the response can be shared when the request was made with credentials (cookies, auth).

Lists which response headers a cross-origin script is allowed to access, beyond the small CORS-safelisted set.

How long, in seconds, the results of a CORS preflight request may be cached.

Lists which HTTP methods are allowed when accessing the resource in a cross-origin request.

Lists which headers are allowed in the actual request when making a cross-origin request.

Advertises which patch document formats a resource accepts on a PATCH request.

Tells the client whether the server supports range requests for a resource, e.g. Accept-Ranges: bytes.

How many seconds the response has been sitting in a proxy cache.

Lists the HTTP methods supported by a resource, typically sent with a 405 Method Not Allowed response.

Advertises an alternative way to reach the same service, e.g. over HTTP/3, without a redirect.

Suggests how the browser should handle the response - inline, or as a download with a given filename.

The natural language(s) of the intended audience for the response body.

An alternate location for the returned data, useful when content negotiation has selected a specific representation.

Indicates where in the full resource a partial response body belongs, used with 206 Partial Content.

An opaque identifier for a specific version of a resource, used for cache validation and conditional requests.

The date/time after which the response is considered stale - largely superseded by Cache-Control's max-age.

The date and time the resource was last changed, used for cache validation via If-Modified-Since.

Expresses a typed relationship with another resource, e.g. rel="preload" or pagination links.

The URL to redirect to, or the URL of a newly created resource after a 201 Created response.

Sent by a proxy to request authentication from the client, the proxy equivalent of WWW-Authenticate.

Tells the client how long to wait before making a follow-up request, used with 429 and 503 responses.

Identifies the software (and sometimes version) handling the request on the origin server.

Instructs the client to store a cookie, to be sent back on future requests to the same site.

HSTS - tells the browser to only ever connect to this site over HTTPS for a given period of time.

Lists which request headers a cache must also match on before it can reuse a cached response.

Indicates the authentication scheme(s) that must be used to access the resource, sent with a 401 response.

Tells the browser whether the page may be rendered inside a frame/iframe, a defence against clickjacking.

Declares which sources of scripts, styles, images, and other content the browser is allowed to load, mitigating XSS.

Allows or disables the use of browser features and APIs (camera, geolocation, etc.) in the page and its iframes.

Set to nosniff to stop the browser guessing a response's content type instead of trusting Content-Type.

A now-deprecated header that used to enable a browser's built-in cross-site-scripting filter.

Identifies the technology powering the web application, e.g. a framework or language - often removed for security.

Recommends which rendering/compatibility mode Internet Explorer should use for the page.

Instructs the browser to reload the page, or redirect to a different URL, after a given number of seconds.