devkult_
tools29converters34
home/headers

HTTP Headers

47 request and response headers explained — what each one does, the values that matter, copy-ready examples, and how to set it in Express, Next.js, nginx or Apache. For what a server's answer means, see the HTTP status codes; to see the headers a live URL returns, use the HTTP Status Checker.

Security baselineStrict-Transport-SecurityContent-Security-PolicyX-Content-Type-OptionsReferrer-PolicyPermissions-PolicyX-Frame-Options

Caching

Whether, where and for how long responses are stored, and how stale copies are revalidated.

Cache-Control
Request & response header
Directives that tell browsers and CDNs whether, where and for how long a response may be cached.
ETag
Response header
An identifier for a specific version of a resource, used to revalidate cached copies and to prevent lost updates.
If-None-Match
Request header
Makes a request conditional: send the resource only if its current ETag isn't one of those listed.
Last-Modified
Response header
The date and time the server believes the resource last changed.
Vary
Response header
Lists the request headers that change the response, so caches keep a separate copy for each variant.
If-Modified-Since
Request header
Asks the server to send the resource only if it changed after the given date — otherwise a 304.
If-Match
Request header
Makes a write conditional: apply it only if the resource still has this ETag. Prevents lost updates.
Expires
Response header
The HTTP/1.0 way to say when a response goes stale. Cache-Control: max-age overrides it.
Age
Response header
How many seconds a response has been sitting in a shared cache such as a CDN.

Security

Response headers that harden a site against XSS, clickjacking, downgrade and sniffing attacks.

Content-Security-Policy
Response header
Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.
Strict-Transport-Security
Response header
Tells browsers to use only HTTPS for the site for a set period, blocking downgrade attacks.
X-Frame-Options
Response header
Controls whether the page may be shown inside a frame, protecting against clickjacking.
X-Content-Type-Options
Response header
With nosniff, stops browsers guessing a response's type, so a text file can't be run as a script.
Referrer-Policy
Response header
Controls how much of the current URL is sent in the Referer header when users follow links or load resources.
Permissions-Policy
Response header
Turns browser features such as the camera, microphone and geolocation on or off for a page and its iframes.
Cross-Origin-Opener-Policy
Response header
Isolates your page from cross-origin windows that open it or that it opens.
Cross-Origin-Embedder-Policy
Response header
Requires the resources a page loads to opt in to being embedded — the second half of cross-origin isolation.
Cross-Origin-Resource-Policy
Response header
Says which sites may load this resource through plain tags like <img> and <script>.
X-Powered-By
Response header
Advertises the framework behind a site — Express, PHP, ASP.NET. Remove it.
Sec-Fetch-Site
Request header
Sent by browsers to say whether a request came from your own origin, your site, another site, or the user.

CORS

The headers browsers use to decide whether one origin may read another's responses.

Access-Control-Allow-Origin
Response header
Tells the browser which origin may read this response from JavaScript running on another site.
Access-Control-Allow-Methods
Response header
Lists the HTTP methods a cross-origin request may use, in the response to a CORS preflight.
Access-Control-Allow-Headers
Response header
Lists the request headers a cross-origin request may include, in the response to a CORS preflight.
Access-Control-Allow-Credentials
Response header
Allows a cross-origin page to read a response to a request made with cookies or HTTP authentication.
Origin
Request header
Sent by browsers to say which origin — scheme, host and port — a request comes from.
Access-Control-Expose-Headers
Response header
Lists the response headers that JavaScript on another origin is allowed to read.
Access-Control-Max-Age
Response header
How long, in seconds, a browser may cache the result of a CORS preflight.

Authentication & cookies

Credentials, login challenges and cookies.

Content

What the body is, how big it is, how it's compressed and how it should be handled.

Content-Type
Request & response header
States the media type of the body — HTML, JSON, form data, an image — and often its character encoding.
Content-Length
Request & response header
The size of the message body in bytes.
Content-Encoding
Response header
Says how the body was compressed — gzip, Brotli or zstd — so the client can decompress it.
Accept
Request header
Lists the response media types the client can handle, in order of preference.
Accept-Encoding
Request header
Lists the compression formats the client can decompress, so the server can pick one.
Content-Disposition
Response header
Tells the browser to display a response inline or download it as a file, and with what file name.
Accept-Language
Request header
The user's preferred languages, in order, from their browser settings.
Range
Request header
Asks for only part of a resource — how downloads resume and how video seeks.
Accept-Ranges
Response header
Tells clients the server supports byte-range requests on this resource.

Routing & context

Where to go next, when to retry, and where a request came from.