An HTTP headers reference is the cheat sheet every backend, frontend, and DevOps engineer keeps within reach. Headers control caching, CORS, authentication, security, content negotiation — almost every cross-cutting concern in HTTP.
This guide groups the headers you'll actually use, explains what each does, and lists common values.
HTTP Headers Reference — Free
Searchable reference for every HTTP header. Copy examples instantly.
Common Request Headers
| Header | Purpose |
|---|---|
| Authorization | Credentials (Bearer token, Basic auth) |
| Accept | Content types client can handle |
| Accept-Language | Preferred languages |
| Accept-Encoding | Supported compressions (gzip, br) |
| Content-Type | Body format on POST/PUT (application/json) |
| User-Agent | Client identification string |
| Cookie | Session and persistent state |
| Referer | URL that linked to the request |
| If-None-Match | Conditional GET (ETag) |
| If-Modified-Since | Conditional GET (date) |
Common Response Headers
| Header | Purpose |
|---|---|
| Content-Type | Response body format |
| Content-Length | Body size in bytes |
| Cache-Control | Caching directives (max-age, no-store) |
| ETag | Resource version identifier |
| Last-Modified | Last change timestamp |
| Set-Cookie | Sets a cookie on client |
| Location | Redirect target (3xx) |
| Server | Server software version |
Security Headers (Essential)
| Header | Purpose |
|---|---|
| Content-Security-Policy | Whitelist allowed scripts/sources |
| Strict-Transport-Security | Force HTTPS (HSTS) |
| X-Content-Type-Options | nosniff — prevent MIME sniffing |
| X-Frame-Options | DENY/SAMEORIGIN — clickjacking protection |
| Referrer-Policy | Control Referer leak |
| Permissions-Policy | Disable browser APIs (camera, mic) |
Modern sites should set all of these. Use a tool like securityheaders.com to audit.
CORS Headers
| Header | Purpose |
|---|---|
| Access-Control-Allow-Origin | Allowed origin (* or specific URL) |
| Access-Control-Allow-Methods | Permitted methods (GET, POST, ...) |
| Access-Control-Allow-Headers | Permitted custom headers |
| Access-Control-Allow-Credentials | Allow cookies in cross-origin requests |
| Access-Control-Max-Age | Cache preflight response (seconds) |
| Origin (request) | Sent by browser on cross-origin requests |
CORS errors? You're missing one of these on the server response.
Caching Headers
Cache-Control directives:
public— Cacheable by any cache (CDN, browser).private— Browser only, not shared caches.no-store— Never cache.no-cache— Cache but revalidate before serving.max-age=N— Cache for N seconds.must-revalidate— Stale must check origin.immutable— Never check, never changes (use with hash-based filenames).
Best-practice for hashed assets: Cache-Control: public, max-age=31536000, immutable
Authorization Header Formats
| Scheme | Format |
|---|---|
| Basic | Authorization: Basic base64(user:pass) |
| Bearer (JWT, OAuth2) | Authorization: Bearer eyJhbGc... |
| Digest | Authorization: Digest username="...",... |
| API Key (custom) | X-API-Key: your-key-here |
How to Use the Tool (Step by Step)
- 1
Pick Category
Request, response, security, CORS, caching.
- 2
Browse Headers
See purpose, valid values, example.
- 3
Search
Find specific header by name.
- 4
Copy Examples
Use in your server config or fetch call.
- 5
Validate
Test with curl or browser DevTools.
Frequently Asked Questions
Which security headers should every site have?+−
CSP, HSTS, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy. Audit with securityheaders.com.
How do I fix a CORS error?+−
Add Access-Control-Allow-Origin (and Allow-Methods, Allow-Headers if needed) to the server response.
What's the difference between no-cache and no-store?+−
no-store never caches. no-cache caches but always revalidates before serving.
Can I see a request's headers in the browser?+−
Yes — DevTools > Network tab > pick a request > Headers section shows both request and response headers.
What's a good cache strategy for static assets?+−
Hash the filename and use Cache-Control: public, max-age=31536000, immutable. Browser never re-checks until filename changes.
HTTP Headers Reference — Free
Searchable reference for every HTTP header. Copy examples instantly.
Open HTTP Headers Reference ->Related Guides
JSON Syntax Rules, Common Parse Errors and How to Fix Them
A complete developer reference for JSON syntax, common errors, formatting options, and how to validate JSON in any language or tool.
JWT Explained
Learn how JWTs work, decode tokens instantly, and debug authentication issues — all in your browser.