# Host Header — Syntax, Values & Examples

> The domain name (and port) the request is for, so one server can host many sites.

One IP address often serves many sites. Host tells the server which one you want, and the server routes on it — nginx `server_name`, Apache virtual hosts, CDN configs. HTTP/1.1 requires it on every request; HTTP/2 and HTTP/3 carry the same value as the `:authority` pseudo-header.

- Type: Request header
- Category: Routing & context
- Defined in: [RFC 9110 §7.2 — Host and :authority](https://www.rfc-editor.org/rfc/rfc9110.html#section-7.2)

## Syntax

```http
Host: <host>[:<port>]
```

## Examples

```http
Host: www.example.com
```

the default port for the scheme is implied

```http
Host: localhost:3000
```

a non-default port

## Good to know

- Don't build absolute URLs — password-reset links especially — from the Host header without checking it; attackers can send any value. Use a configured base URL.
- Behind a proxy, the original host may arrive in `X-Forwarded-Host`.

## Who sets Host

Clients set Host from the URL. To test virtual hosting before DNS points at a server, curl can override it: `curl -H "Host: www.example.com" http://203.0.113.10/` — or `curl --resolve www.example.com:443:203.0.113.10 https://www.example.com/`, which also gets TLS right.

## Check it

In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with `>`:

```sh
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
```

## FAQ

### What happens if a request has no Host header?

An HTTP/1.1 server must reject it with 400 Bad Request.

## Status codes it appears with

- [400 Bad Request](https://www.devkult.com/http/400.md)
- [421 Misdirected Request](https://www.devkult.com/http/421.md)

## Related headers

- [X-Forwarded-For](https://www.devkult.com/headers/x-forwarded-for.md): The chain of client IP addresses a request passed through on its way via proxies and load balancers.
- [Origin](https://www.devkult.com/headers/origin.md): Sent by browsers to say which origin — scheme, host and port — a request comes from.
- [Location](https://www.devkult.com/headers/location.md): The URL to go to next — the target of a redirect, or the address of a newly created resource.

Open the interactive page: https://www.devkult.com/headers/host