HTTP Headers Lookup

Reference guide for common HTTP request, response, and general headers.

Diagnostics & Configuration Templates

Quickly copy standard environments and templates for different header topologies.

Standard HTTP request representation matching modern client standards.

GET /api/v1/resource HTTP/1.1
Host: api.example.com
Accept: application/json
Authorization: Bearer YOUR_ACCESS_TOKEN
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Connection: keep-alive
Cache-Control: no-cache

Search Headers

Filter Type

39 headers shown

About HTTP headers

HTTP headers are key-value metadata passed between client and server in every request and response. Request headers describe the client and the resource it wants; response headers describe the server's response. General headers can appear in both. Security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options are response headers that browsers act on automatically. Related: URL encoder/decoder and CORS header generator.

Built and maintained by Meet Shah · Last updated 1 August 2026

What this tool is used for

Looking up what a header you have not seen before actually does.
Checking a header's expected value format.
Finding whether a header is a request or a response header.
Confirming a header's name spelling before using it.
Reading an example value for a header you are about to set.

Frequently Asked Questions

What does this reference cover?: Common request, response and general headers with a description and a realistic example value for each, grouped by purpose — caching, CORS, content negotiation, authentication, proxies and security. It is a lookup, not an exhaustive registry.
Why are some headers listed as general?: Because they are valid in both directions. Cache-Control, Connection, Date, Transfer-Encoding and Via all appear on requests and responses, and their meaning shifts slightly depending on which side sent them.
Is Referer really spelled that way?: Yes — the misspelling was in the original 1996 specification and was kept for compatibility. Referrer-Policy, added much later, uses the correct spelling, so a codebase touching both ends up with two spellings that are both right.
Are header names case-sensitive?: No, field names are case-insensitive by the specification. HTTP/2 and HTTP/3 go further and require them to be sent lowercase on the wire, which is why a response viewed in modern devtools shows content-type rather than Content-Type.
Which of these should I actually set?: For most sites: Content-Type with a charset, a deliberate Cache-Control, Strict-Transport-Security, X-Content-Type-Options: nosniff, and a Content-Security-Policy. The rest are situational or set for you by the server.
What is the difference between X-Forwarded-For and Forwarded?: X-Forwarded-For is the widespread de-facto header carrying a comma-separated chain of client addresses. Forwarded is the standardised replacement from RFC 7239 that also carries the protocol and host. Neither is trustworthy unless your own proxy sets it.

Common errors and gotchas

Assuming a header is honoured, when many are advisory and some are ignored entirely.
Setting a response header on a request, or the reverse.
Using a non-standard header without an X- or a documented prefix, which risks a future collision.
Assuming header names are case-sensitive, which in HTTP/1.1 they are not.
Setting a security header without testing, where a strict value can break the page.