HTTP Headers Reference
Every HTTP header developers meet in production — from Content-Type and Cache-Control to the whole CORS family and modern security headers — with examples and the pitfalls that trip most people up.
Each entry explains what a header does, when to set it, and one thing that will bite you if you set it wrong — like why Cache-Control: no-cache does not actually mean “don’t cache”, or why Access-Control-Allow-Origin: * cannot be combined with credentials.
Content
Declaring and describing the message body — type, size, encoding, disposition.
Caching
Directives that tell browsers and CDNs how long and how to store a response.
Cache-Control
Directives that control caching behavior.
ETag
A version identifier for the resource — the backbone of conditional GETs.
Expires
Legacy: an absolute HTTP date when the response becomes stale.
Age
How many seconds the response has been in a shared cache.
Vary
Which request headers cause different cached variants of the response.
Conditional
Send the resource only if it changed — the mechanics behind 304 Not Modified.
Authentication
Credentials and auth-scheme negotiation.
CORS
Cross-origin resource sharing headers — the whole `Access-Control-*` family.
Access-Control-Allow-Origin
Which origins may read this response cross-origin.
Access-Control-Allow-Methods
Which HTTP methods are allowed on the cross-origin resource.
Access-Control-Allow-Headers
Which request headers may be used in the actual cross-origin request.
Access-Control-Allow-Credentials
Whether cookies and Authorization can be sent cross-origin.
Access-Control-Max-Age
How long the browser may cache the preflight response.
Origin
The origin (scheme + host + port) of the request.
Security
Headers that harden the browser against XSS, framing, MIME sniffing, and cleartext.
Strict-Transport-Security
Force browsers to use HTTPS for a domain (HSTS).
Content-Security-Policy
The primary defense against XSS: whitelist trusted sources.
X-Frame-Options
Prevents clickjacking by controlling framing.
X-Content-Type-Options
Disables MIME-type sniffing.
Referrer-Policy
Controls the Referer header sent on outgoing links and requests.
Permissions-Policy
Controls which browser features and APIs pages can use.
Cookies
Setting and reading HTTP cookies.
Ranges
Partial content requests and responses.
Request negotiation
Client hints about accepted media types, encodings, and languages.
Accept
Which media types the client can process.
Accept-Encoding
Which content encodings (compressions) the client accepts.
Accept-Language
Preferred human languages for the response.
User-Agent
The client software identifying itself.
Host
The requested host name and port.
Referer
The URL of the previous page that led to this request.
Response
Response-only headers about servers, timing, and redirects.
Location
The redirect target (3xx) or newly created resource URL (201).
Retry-After
How long the client should wait before retrying.
Server
Identifies the server software.
Date
When the response was generated.
Allow
Which HTTP methods the target resource supports.
Link
Serialized <link> relationships as an HTTP header.
Miscellaneous
Proxy propagation, protocol upgrades, and other utility headers.