Host
request headerrouting & context
The domain name (and port) the request is for, so one server can host many sites.
One IP address often serves many sites. Host tells the server which one you want, and the server routes on it — nginx server_name, Apache virtual hosts, CDN configs. HTTP/1.1 requires it on every request; HTTP/2 and HTTP/3 carry the same value as the :authority pseudo-header.
Syntax
Host: <host>[:<port>]
Defined in RFC 9110 §7.2 — Host and :authority.
Examples
Host: www.example.com
the default port for the scheme is implied
Host: localhost:3000
a non-default port
Good to know
- Don't build absolute URLs — password-reset links especially — from the Host header without checking it; attackers can send any value. Use a configured base URL.
- Behind a proxy, the original host may arrive in
X-Forwarded-Host.
Who sets Host
Clients set Host from the URL. To test virtual hosting before DNS points at a server, curl can override it: curl -H "Host: www.example.com" http://203.0.113.10/ — or curl --resolve www.example.com:443:203.0.113.10 https://www.example.com/, which also gets TLS right.
Check it
In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with >:
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
Frequently asked questions
What happens if a request has no Host header?
An HTTP/1.1 server must reject it with 400 Bad Request.