HTTP Headers Reference
Detailed explanations of HTTP request/response headers for quick reference.
53 Headers
AcceptRequestRFC 7231Indicates the media types (MIME types) that the client can handle
Example：
Accept: text/html, application/jsonAccept-EncodingRequestRFC 7231Indicates the content encoding methods that the client supports
Example：
Accept-Encoding: gzip, deflate, brAccept-LanguageRequestRFC 7231Indicates the natural language preferences of the client
Example：
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8Accept-CharsetRequestRFC 7231Indicates the character sets that the client supports
Example：
Accept-Charset: utf-8, iso-8859-1Content-TypeCommonRFC 7231Indicates the media type of the request or response body
Example：
Content-Type: application/json; charset=utf-8Content-EncodingResponseRFC 7231Indicates the encoding method used for the response body
Example：
Content-Encoding: gzipContent-LengthCommonRFC 7230Indicates the byte length of the request or response body
Example：
Content-Length: 1234Content-DispositionResponseRFC 6266Indicates how the response content should be displayed (inline or as an attachment download)
Example：
Content-Disposition: attachment; filename="file.pdf"Content-RangeResponseRFC 7233Indicates the position of a partial response within the full response
Example：
Content-Range: bytes 0-1023/10240Cache-ControlCommonRFC 7234Defines caching mechanism instructions for requests and responses
Example：
Cache-Control: max-age=3600, publicETagResponseRFC 7232A specific version identifier for a resource
Example：
ETag: "33a64df551425fcc55e4d42a148795d9f25f89d4"If-None-MatchRequestRFC 7232Makes a request conditional, returning the resource only if the ETag does not match
Example：
If-None-Match: "33a64df551425fcc55e4d42a148795d9f25f89d4"If-Modified-SinceRequestRFC 7232Makes a request conditional, returning the resource only if modified since the specified date
Example：
If-Modified-Since: Wed, 21 Oct 2025 07:28:00 GMTLast-ModifiedResponseRFC 7232Indicates the date and time the resource was last modified
Example：
Last-Modified: Wed, 21 Oct 2025 07:28:00 GMTExpiresResponseRFC 7234Indicates the date/time after which the response is considered stale
Example：
Expires: Thu, 01 Dec 2025 16:00:00 GMTAuthorizationRequestRFC 7235Contains credentials used to authenticate the user identity to the server
Example：
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...WWW-AuthenticateResponseRFC 7235Defines the authentication method used to access the resource
Example：
WWW-Authenticate: Bearer realm="api", error="invalid_token"Proxy-AuthorizationRequestRFC 7235Contains credentials used to authenticate to the proxy server
Example：
Proxy-Authorization: Basic dXNlcjpwYXNzStrict-Transport-SecurityResponseRFC 6797Instructs the browser to only access the current site via HTTPS (HSTS)
Example：
Strict-Transport-Security: max-age=31536000; includeSubDomainsContent-Security-PolicyResponseCSP Level 3Controls the resources the user agent is allowed to load for a page (CSP)
Example：
Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'X-Content-Type-OptionsResponsePrevents the browser from performing MIME type sniffing on the response
Example：
X-Content-Type-Options: nosniffX-Frame-OptionsResponseRFC 7034Indicates whether the browser is allowed to display the page in a frame/iframe
Example：
X-Frame-Options: DENYX-XSS-ProtectionResponseEnables the browser's built-in XSS filter (deprecated, CSP recommended instead)
Example：
X-XSS-Protection: 1; mode=blockReferrer-PolicyResponseReferrer PolicyControls how much information the Referer header carries in requests
Example：
Referrer-Policy: strict-origin-when-cross-originPermissions-PolicyResponsePermissions PolicyAllows or denies the browser from using specific features and APIs
Example：
Permissions-Policy: camera=(), microphone=(), geolocation=(self)Access-Control-Allow-OriginResponseFetchIndicates whether the response can be shared with requesting code from a given origin
Example：
Access-Control-Allow-Origin: https://example.comAccess-Control-Allow-MethodsResponseFetchIn a preflight response, indicates the HTTP methods allowed
Example：
Access-Control-Allow-Methods: GET, POST, PUT, DELETEAccess-Control-Allow-HeadersResponseFetchIn a preflight response, indicates the request headers allowed
Example：
Access-Control-Allow-Headers: Content-Type, AuthorizationAccess-Control-Allow-CredentialsResponseFetchIndicates whether the response can be exposed when credentials mode is include
Example：
Access-Control-Allow-Credentials: trueAccess-Control-Max-AgeResponseFetchIndicates how long the results of a preflight request can be cached
Example：
Access-Control-Max-Age: 86400Access-Control-Request-MethodRequestFetchInforms the server which HTTP method will be used in the actual request
Example：
Access-Control-Request-Method: DELETEAccess-Control-Request-HeadersRequestFetchInforms the server which request headers will be carried in the actual request
Example：
Access-Control-Request-Headers: X-Custom-HeaderOriginRequestRFC 6454Indicates the protocol, host, and port from which the request originates
Example：
Origin: https://example.comHostRequestRFC 7230Specifies the host and port of the target server for the request
Example：
Host: www.example.com:8080ConnectionCommonRFC 7230Controls whether the network connection stays open after the transaction completes
Example：
Connection: keep-aliveKeep-AliveCommonRFC 7230Indicates how long the sender wishes to keep the connection alive
Example：
Keep-Alive: timeout=5, max=1000Transfer-EncodingResponseRFC 7230Specifies the encoding form used to safely transfer the message body to the user
Example：
Transfer-Encoding: chunkedUpgradeCommonRFC 7230Requests the server to upgrade to another protocol
Example：
Upgrade: websocketCookieRequestRFC 6265Contains HTTP cookies previously stored by the server via Set-Cookie header
Example：
Cookie: session_id=abc123; user=johnSet-CookieResponseRFC 6265Sends cookies from the server to the user agent
Example：
Set-Cookie: session_id=abc123; Path=/; HttpOnly; Secure; SameSite=StrictUser-AgentRequestRFC 7231Identifies the application type, OS, vendor, and version of the user agent software
Example：
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36RefererRequestRFC 7231Contains the absolute or partial address of the page making the request
Example：
Referer: https://example.com/page.htmlLocationResponseRFC 7231Indicates the target URL for a redirect
Example：
Location: /new-pageRetry-AfterResponseRFC 7231Informs the client how long to wait before making another request
Example：
Retry-After: 120ServerResponseRFC 7231Contains software information about the origin server that handled the request
Example：
Server: nginx/1.24.0DateCommonRFC 7231The date and time at which the message was originated
Example：
Date: Wed, 21 Oct 2025 07:28:00 GMTVaryResponseRFC 7231Determines how to match request headers to decide whether a cached response can be used
Example：
Vary: Accept-Encoding, OriginX-Request-IDCommonA unique identifier used to trace requests
Example：
X-Request-ID: 550e8400-e29b-41d4-a716-446655440000X-Forwarded-ForRequestRFC 7239Identifies the originating IP connecting through a proxy or load balancer
Example：
X-Forwarded-For: 203.0.113.50, 70.41.3.18X-Forwarded-ProtoRequestIdentifies the protocol used between the client and proxy/load balancer
Example：
X-Forwarded-Proto: httpsForwardedRequestRFC 7239Contains client information added by proxy servers (standardized alternative to X-Forwarded-*)
Example：
Forwarded: for=192.0.2.60;proto=https;by=203.0.113.43RangeRequestRFC 7233Indicates which part of the document the server should return
Example：
Range: bytes 0-1023AgeResponseRFC 7234Indicates how long the object has been stored in a proxy cache (in seconds)
Example：
Age: 3600Usage
Features
This tool catalogs common HTTP request and response headers with detailed descriptions and category filtering.
Steps
Use the search box to quickly find headers, filter by type (request/response/common) and category (security/cache/content, etc.).