Categories
HTTP Headers Reference
Look up commonly used HTTP request and response headers.
26 results
- RequestAccept
Indicates the media types the client can accept.
Accept: application/json
- RequestAccept-Encoding
Indicates the content encodings the client can accept.
Accept-Encoding: gzip, br
- RequestAccept-Language
Indicates the client's preferred language.
Accept-Language: ja-JP, en;q=0.8
- RequestAuthorization
Carries credentials (such as a token) to authenticate the client.
Authorization: Bearer <token>
- RequestCookie
Sends previously stored cookies back to the server with the request.
Cookie: session_id=abc123
- RequestHost
Specifies the target host and port of the request (required in HTTP/1.1).
Host: example.com
- RequestIf-Modified-Since
Requests the resource only if it has been modified since the given date.
If-Modified-Since: Wed, 01 Jan 2026 00:00:00 GMT
- RequestIf-None-Match
Requests the resource only if its ETag does not match the given value.
If-None-Match: "abc123"
- RequestOrigin
Indicates the origin (scheme, host, port) the request came from (used in CORS).
Origin: https://example.com
- RequestReferer
Indicates the URL of the page that linked to the requested resource.
Referer: https://example.com/page
- RequestUser-Agent
Identifies the client (browser, OS, etc.) making the request.
User-Agent: Mozilla/5.0 ...
- RequestX-Forwarded-For
Indicates the originating client's IP address when the request passes through a proxy (non-standard but widely used).
X-Forwarded-For: 203.0.113.1
- ResponseAccess-Control-Allow-Origin
In CORS, indicates which origins are permitted to access the resource.
Access-Control-Allow-Origin: *
- ResponseContent-Encoding
Indicates the content encoding applied to the response body.
Content-Encoding: gzip
- ResponseContent-Length
Indicates the size of the response body in bytes.
Content-Length: 1024
- ResponseETag
An opaque identifier for a specific version of a resource, used for cache validation.
ETag: "abc123"
- ResponseLocation
Indicates the redirect target, or the URL of a newly created resource.
Location: https://example.com/new-page
- ResponseSet-Cookie
Instructs the client to store a cookie.
Set-Cookie: session_id=abc123; HttpOnly; Secure
- ResponseWWW-Authenticate
Accompanies a 401 response to indicate the required authentication scheme.
WWW-Authenticate: Basic realm="Access"
- ResponseX-Content-Type-Options
A security header that disables MIME type sniffing.
X-Content-Type-Options: nosniff
- ResponseX-Frame-Options
A security header that controls whether the page can be embedded in a frame on another site.
X-Frame-Options: DENY
- ResponseStrict-Transport-Security
A security header (HSTS) that forces future requests to use HTTPS.
Strict-Transport-Security: max-age=31536000
- GeneralCache-Control
Used in both requests and responses to control caching behavior.
Cache-Control: no-cache
- GeneralContent-Type
Indicates the media type (MIME type) of the request or response body.
Content-Type: application/json; charset=utf-8
- GeneralConnection
Controls whether the current connection is kept open or closed.
Connection: keep-alive
- GeneralVary
Indicates which request headers affect the response content, for cache negotiation.
Vary: Accept-Encoding
Overview
- A cheatsheet summarizing the meaning and example usage of commonly used HTTP headers.
- Categorized into request headers (Accept, Authorization, etc.), response headers (Set-Cookie, ETag, etc.), and general headers used in both (Cache-Control, Content-Type, etc.).
- Search and filter by header name, type (request / response / general), or description.
Usage
- Enter a header name (e.g., cookie), type, or description keyword into the search field.
- The list of matching headers narrows down as you type.
- You can copy the example to your clipboard using the copy button.
Example
Input
cache
Output
Cache-Control: Used in both requests and responses to control caching behavior
Use Cases
- Looking up a header's name or purpose when you can't quite remember it during API development
- Referencing header names when building a curl command or fetch request
- Checking that security headers (X-Frame-Options, Strict-Transport-Security, etc.) haven't been missed
FAQ
Are all HTTP headers listed here?
No. This lists representative headers commonly used in practice. See an official reference like MDN for a more exhaustive list.
What makes a header "General"?
Headers used in both requests and responses — such as Cache-Control, Content-Type, Connection, and Vary — are categorized as "General".
Related Tools
Look up HTTP status codes by code number, keyword, or category (1xx–5xx).
Convert a curl command into JavaScript fetch() code.
Parse browser, OS, and device information from a User-Agent string.