Accept | Request | Content types the client prefers, e.g. text/html, application/json. |
Accept-Encoding | Request | Compression the client accepts — gzip, br (Brotli), zstd. |
Accept-Language | Request | Preferred natural languages, e.g. en-US, ja;q=0.9. |
Authorization | Request | Credentials — Bearer tokens, Basic auth, signatures. |
Cache-Control | Both | Caching rules — max-age, no-cache, no-store, private. |
Connection | Both | Hop-by-hop options like keep-alive or close. |
Content-Disposition | Response | Present as attachment with a suggested filename for downloads. |
Content-Encoding | Response | Compression applied to the body — gzip, br. |
Content-Language | Response | Natural language of the body content. |
Content-Length | Both | Body size in bytes. |
Content-Location | Response | Canonical URL for the returned representation. |
Content-Range | Response | Which byte range this partial response carries, e.g. bytes 0-99/500. |
Content-Security-Policy | Response | Restricts where scripts, images, and frames may load from. |
Content-Type | Both | Media type of the body, e.g. application/json; charset=utf-8. |
Cookie | Request | Cookies the client sends back to the server. |
Cross-Origin-Embedder-Policy | Response | Requires cross-origin resources to opt in (require-corp). |
Cross-Origin-Opener-Policy | Response | Isolates the window from cross-origin openers (same-origin). |
Cross-Origin-Resource-Policy | Response | Declares which origins may embed this resource. |
Date | Response | When the response was generated (HTTP-date format). |
ETag | Response | Opaque version tag for cache validation (If-None-Match). |
Expect | Request | Usually '100-continue' — ask before sending a large body. |
Expires | Response | Legacy absolute cache expiry time; Cache-Control takes precedence. |
Forwarded | Request | Standard proxy info — for=, proto=, host=. |
Host | Request | The requested host — required in HTTP/1.1. |
If-Match | Request | Only proceed if the current ETag matches. |
If-Modified-Since | Request | Return content only if newer than this date. |
If-None-Match | Request | Return 304 if the ETag still matches — cache revalidation. |
If-Unmodified-Since | Request | Only proceed if the resource is not newer than this date. |
Last-Modified | Response | When the resource last changed — a weak validator. |
Link | Both | Related resources — preload hints, pagination, versions. |
Location | Response | Redirect or created-resource target URL. |
Origin | Request | The scheme+host+port that caused the request — for CORS and CSRF checks. |
Permissions-Policy | Response | Controls browser features — camera, geolocation, fullscreen. |
Pragma | Both | Legacy 'no-cache' hint kept for HTTP/1.0 compatibility. |
Range | Request | Ask for part of the body — bytes=0-99 resumes a download. |
Referer | Request | The page that linked here (historic misspelling). |
Referrer-Policy | Response | How much of the URL is sent as Referer to other sites. |
Retry-After | Response | How long to wait before retrying — seconds or a date. |
Sec-Fetch-Dest | Request | Where the response will be used — document, image, script. |
Sec-Fetch-Mode | Request | The request mode — navigate, cors, no-cors. |
Sec-Fetch-Site | Request | Relationship of the initiator — same-origin, cross-site. |
Server | Response | Software handling the request — often masked for security. |
Set-Cookie | Response | Store a cookie — attributes like HttpOnly, Secure, SameSite. |
Strict-Transport-Security | Response | Force HTTPS for future visits (max-age=63072000; includeSubDomains). |
Transfer-Encoding | Response | Usually 'chunked' — body streamed in pieces. |
Upgrade-Insecure-Requests | Request | Client prefers HTTPS versions of resources on the page. |
User-Agent | Request | Client software identifier — browser name, version, OS. |
Vary | Response | Caches must key on these request headers (e.g. Accept-Encoding). |
Via | Response | Lists proxies the message passed through. |
WWW-Authenticate | Response | How to authenticate — comes with a 401. |
X-Content-Type-Options | Response | 'nosniff' — browsers must not guess the content type. |
X-Forwarded-For | Request | De-facto proxy header listing original client IPs. |
X-Frame-Options | Response | DENY or SAMEORIGIN — legacy clickjacking protection (use CSP frame-ancestors). |
X-XSS-Protection | Response | Legacy browser XSS filter — obsolete; set to 0. |
Access-Control-Allow-Origin | Response | CORS — which origins may read this response. |
Access-Control-Allow-Methods | Response | CORS preflight — methods allowed on the real request. |
Access-Control-Allow-Headers | Response | CORS preflight — request headers allowed. |
Access-Control-Max-Age | Response | How long a preflight result can be cached (seconds). |
Access-Control-Request-Method | Request | CORS preflight — the method the real request will use. |
Access-Control-Request-Headers | Request | CORS preflight — custom headers the real request will send. |