# HTTP Headers

47 HTTP request and response headers explained: syntax, values, examples and how to set them.

## Caching

Whether, where and for how long responses are stored, and how stale copies are revalidated.

- [Cache-Control](https://www.devkult.com/headers/cache-control.md): Request & response header. Directives that tell browsers and CDNs whether, where and for how long a response may be cached.
- [ETag](https://www.devkult.com/headers/etag.md): Response header. An identifier for a specific version of a resource, used to revalidate cached copies and to prevent lost updates.
- [If-None-Match](https://www.devkult.com/headers/if-none-match.md): Request header. Makes a request conditional: send the resource only if its current ETag isn't one of those listed.
- [Last-Modified](https://www.devkult.com/headers/last-modified.md): Response header. The date and time the server believes the resource last changed.
- [Vary](https://www.devkult.com/headers/vary.md): Response header. Lists the request headers that change the response, so caches keep a separate copy for each variant.
- [If-Modified-Since](https://www.devkult.com/headers/if-modified-since.md): Request header. Asks the server to send the resource only if it changed after the given date — otherwise a 304.
- [If-Match](https://www.devkult.com/headers/if-match.md): Request header. Makes a write conditional: apply it only if the resource still has this ETag. Prevents lost updates.
- [Expires](https://www.devkult.com/headers/expires.md): Response header. The HTTP/1.0 way to say when a response goes stale. Cache-Control: max-age overrides it.
- [Age](https://www.devkult.com/headers/age.md): Response header. How many seconds a response has been sitting in a shared cache such as a CDN.

## Security

Response headers that harden a site against XSS, clickjacking, downgrade and sniffing attacks.

- [Content-Security-Policy](https://www.devkult.com/headers/content-security-policy.md): Response header. Restricts where a page may load scripts, styles, images and frames from — the main defence against cross-site scripting.
- [Strict-Transport-Security](https://www.devkult.com/headers/strict-transport-security.md): Response header. Tells browsers to use only HTTPS for the site for a set period, blocking downgrade attacks.
- [X-Frame-Options](https://www.devkult.com/headers/x-frame-options.md): Response header. Controls whether the page may be shown inside a frame, protecting against clickjacking.
- [X-Content-Type-Options](https://www.devkult.com/headers/x-content-type-options.md): Response header. With nosniff, stops browsers guessing a response's type, so a text file can't be run as a script.
- [Referrer-Policy](https://www.devkult.com/headers/referrer-policy.md): Response header. Controls how much of the current URL is sent in the Referer header when users follow links or load resources.
- [Permissions-Policy](https://www.devkult.com/headers/permissions-policy.md): Response header. Turns browser features such as the camera, microphone and geolocation on or off for a page and its iframes.
- [Cross-Origin-Opener-Policy](https://www.devkult.com/headers/cross-origin-opener-policy.md): Response header. Isolates your page from cross-origin windows that open it or that it opens.
- [Cross-Origin-Embedder-Policy](https://www.devkult.com/headers/cross-origin-embedder-policy.md): Response header. Requires the resources a page loads to opt in to being embedded — the second half of cross-origin isolation.
- [Cross-Origin-Resource-Policy](https://www.devkult.com/headers/cross-origin-resource-policy.md): Response header. Says which sites may load this resource through plain tags like <img> and <script>.
- [X-Powered-By](https://www.devkult.com/headers/x-powered-by.md): Response header. Advertises the framework behind a site — Express, PHP, ASP.NET. Remove it.
- [Sec-Fetch-Site](https://www.devkult.com/headers/sec-fetch-site.md): Request header. Sent by browsers to say whether a request came from your own origin, your site, another site, or the user.

## CORS

The headers browsers use to decide whether one origin may read another's responses.

- [Access-Control-Allow-Origin](https://www.devkult.com/headers/access-control-allow-origin.md): Response header. Tells the browser which origin may read this response from JavaScript running on another site.
- [Access-Control-Allow-Methods](https://www.devkult.com/headers/access-control-allow-methods.md): Response header. Lists the HTTP methods a cross-origin request may use, in the response to a CORS preflight.
- [Access-Control-Allow-Headers](https://www.devkult.com/headers/access-control-allow-headers.md): Response header. Lists the request headers a cross-origin request may include, in the response to a CORS preflight.
- [Access-Control-Allow-Credentials](https://www.devkult.com/headers/access-control-allow-credentials.md): Response header. Allows a cross-origin page to read a response to a request made with cookies or HTTP authentication.
- [Origin](https://www.devkult.com/headers/origin.md): Request header. Sent by browsers to say which origin — scheme, host and port — a request comes from.
- [Access-Control-Expose-Headers](https://www.devkult.com/headers/access-control-expose-headers.md): Response header. Lists the response headers that JavaScript on another origin is allowed to read.
- [Access-Control-Max-Age](https://www.devkult.com/headers/access-control-max-age.md): Response header. How long, in seconds, a browser may cache the result of a CORS preflight.

## Authentication & cookies

Credentials, login challenges and cookies.

- [Authorization](https://www.devkult.com/headers/authorization.md): Request header. Carries the client's credentials — a bearer token, Basic username and password, or another scheme.
- [WWW-Authenticate](https://www.devkult.com/headers/www-authenticate.md): Response header. Sent with a 401 to tell the client which authentication scheme to use, and sometimes why the last attempt failed.
- [Set-Cookie](https://www.devkult.com/headers/set-cookie.md): Response header. Stores a cookie in the browser, with attributes that control its lifetime, scope and security.
- [Cookie](https://www.devkult.com/headers/cookie.md): Request header. Sends the cookies the browser has stored for this site back to the server.

## Content

What the body is, how big it is, how it's compressed and how it should be handled.

- [Content-Type](https://www.devkult.com/headers/content-type.md): Request & response header. States the media type of the body — HTML, JSON, form data, an image — and often its character encoding.
- [Content-Length](https://www.devkult.com/headers/content-length.md): Request & response header. The size of the message body in bytes.
- [Content-Encoding](https://www.devkult.com/headers/content-encoding.md): Response header. Says how the body was compressed — gzip, Brotli or zstd — so the client can decompress it.
- [Accept](https://www.devkult.com/headers/accept.md): Request header. Lists the response media types the client can handle, in order of preference.
- [Accept-Encoding](https://www.devkult.com/headers/accept-encoding.md): Request header. Lists the compression formats the client can decompress, so the server can pick one.
- [Content-Disposition](https://www.devkult.com/headers/content-disposition.md): Response header. Tells the browser to display a response inline or download it as a file, and with what file name.
- [Accept-Language](https://www.devkult.com/headers/accept-language.md): Request header. The user's preferred languages, in order, from their browser settings.
- [Range](https://www.devkult.com/headers/range.md): Request header. Asks for only part of a resource — how downloads resume and how video seeks.
- [Accept-Ranges](https://www.devkult.com/headers/accept-ranges.md): Response header. Tells clients the server supports byte-range requests on this resource.

## Routing & context

Where to go next, when to retry, and where a request came from.

- [Location](https://www.devkult.com/headers/location.md): Response header. The URL to go to next — the target of a redirect, or the address of a newly created resource.
- [Retry-After](https://www.devkult.com/headers/retry-after.md): Response header. How long the client should wait before retrying — sent with 429, 503 and some redirects.
- [Host](https://www.devkult.com/headers/host.md): Request header. The domain name (and port) the request is for, so one server can host many sites.
- [User-Agent](https://www.devkult.com/headers/user-agent.md): Request header. Identifies the client software making the request — browser, bot, library or command-line tool.
- [X-Forwarded-For](https://www.devkult.com/headers/x-forwarded-for.md): Request header. The chain of client IP addresses a request passed through on its way via proxies and load balancers.
- [Referer](https://www.devkult.com/headers/referer.md): Request header. The address of the page that linked to or loaded the requested resource.
- [Link](https://www.devkult.com/headers/link.md): Response header. Typed links in a header — preload hints, preconnects, canonical URLs and pagination.