HTTP Headers Lookup

Reference guide for common HTTP request, response, and general headers.

Diagnostics & Configuration Templates

Quickly copy standard environments and templates for different header topologies.

Standard HTTP request representation matching modern client standards.

GET /api/v1/resource HTTP/1.1
Host: api.example.com
Accept: application/json
Authorization: Bearer YOUR_ACCESS_TOKEN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cache-Control: no-cache

Search Headers

Filter Type

39 headers shown

About HTTP headers

HTTP headers are key-value metadata passed between client and server in every request and response. Request headers describe the client and the resource it wants; response headersdescribe the server's response. General headers can appear in both. Security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options are response headers that browsers act on automatically. Related: URL encoder/decoder and CORS header generator.

Built and maintained by Meet Shah · Last updated 1 August 2026

What this tool is used for

Looking up what a header you have not seen before actually does.
Checking a header's expected value format.
Finding whether a header is a request or a response header.
Confirming a header's name spelling before using it.
Reading an example value for a header you are about to set.

Frequently Asked Questions

What does this reference cover?: Common request, response and general headers with a description and a realistic example value for each, grouped by purpose — caching, CORS, content negotiation, authentication, proxies and security. It is a lookup, not an exhaustive registry.
Why are some headers listed as general?: Because they are valid in both directions. `Cache-Control`, `Connection`, `Date`, `Transfer-Encoding` and `Via` all appear on requests and responses, and their meaning shifts slightly depending on which side sent them.
Is `Referer` really spelled that way?: Yes — the misspelling was in the original 1996 specification and was kept for compatibility. `Referrer-Policy`, added much later, uses the correct spelling, so a codebase touching both ends up with two spellings that are both right.
Are header names case-sensitive?: No, field names are case-insensitive by the specification. HTTP/2 and HTTP/3 go further and require them to be sent lowercase on the wire, which is why a response viewed in modern devtools shows `content-type` rather than `Content-Type`.
Which of these should I actually set?: For most sites: `Content-Type` with a charset, a deliberate `Cache-Control`, `Strict-Transport-Security`, `X-Content-Type-Options: nosniff`, and a `Content-Security-Policy`. The rest are situational or set for you by the server.
What is the difference between X-Forwarded-For and Forwarded?: `X-Forwarded-For` is the widespread de-facto header carrying a comma-separated chain of client addresses. `Forwarded` is the standardised replacement from RFC 7239 that also carries the protocol and host. Neither is trustworthy unless your own proxy sets it.

Common errors and gotchas

Assuming a header is honoured, when many are advisory and some are ignored entirely.
Setting a response header on a request, or the reverse.
Using a non-standard header without an `X-` or a documented prefix, which risks a future collision.
Assuming header names are case-sensitive, which in HTTP/1.1 they are not.
Setting a security header without testing, where a strict value can break the page.