HTTP Headers Reference

Informs the server about the content types the client can process.

Advertises which character encodings the client understands. Mostly obsolete.

Indicates which content-encoding algorithms (compression) the client supports.

Tells the server the preferred natural language for the response.

Carries credentials to authenticate the client with the server.

Controls whether the network connection stays open after the current transaction.

Indicates the size (in bytes) of the request body sent to the server.

Describes the media type of the body of the request (when sending data).

Sends previously stored cookies from the client back to the server.

Do Not Track — signals the user's tracking preference. Not widely honoured.

Indicates that the client requires certain server behaviours to proceed.

Contains the email address of the human user controlling the requesting user agent.

Specifies the host and port number of the server to which the request is sent. Required in HTTP/1.1.

Makes the request conditional — server processes it only if the ETag matches.

Makes the request conditional — returns 304 if the content has not changed since the given date.

Returns 304 Not Modified if the ETag matches (used for cache validation).

When resuming a partial download, requests the full resource if the ETag/date does not match.

Succeeds only if the resource has not been modified since the specified date.

Limits the number of times a TRACE or OPTIONS request can be forwarded.

Identifies the origin (scheme, hostname, port) of the cross-site access request.

Contains the credentials to authenticate a user agent with a proxy server.

Requests only a specific portion of a file — used for resumable downloads.

Contains the URL of the page that linked to the resource being requested.

Specifies the transfer encodings the user agent is willing to accept.

Signals the client's preference to receive an encrypted and authenticated response.

Identifies the client software, operating system, and version making the request.

Informs about proxies through which the request was sent.

Indicates if the server supports partial resource requests (byte-range requests).

How many seconds the object has been stored in a proxy cache.

Lists the HTTP methods supported by the resource. Sent with a 405 response.

Indicates if content should be displayed inline or treated as a download attachment.

Specifies the compression encoding applied to the response body.

Describes the natural language(s) of the intended audience for the response.

Indicates the size in bytes of the response body.

Indicates an alternate location for the returned data.

Indicates where a partial message belongs in the full resource body.

Describes the media type of the response body.

The date and time at which the message was generated on the server.

A unique identifier for a specific version of a resource, used for cache validation.

Gives a date/time after which the response is considered stale (superseded by Cache-Control).

The date and time at which the resource was last modified on the server.

Serialises one or more links in HTTP headers. Equivalent to the HTML <link> element.

Indicates the URL to redirect to in a 3xx redirect or after 201 Created.

Tells the client how long to wait before making a follow-up request (rate-limit / maintenance).

Describes the software used by the origin server to handle the request.

Sends a cookie from the server to the user agent for storage.

Allows the sender to include additional fields at the end of a chunked message.

Specifies the form of encoding used to transfer the payload body.

Determines how to match request headers to decide whether a cached response can be used.

Defines the HTTP authentication method that should be used to gain access to a resource.

Restricts the sources from which the browser can load resources (scripts, styles, images, etc.).

Like CSP but only reports violations without enforcing them. Useful for testing a new policy.

Forces browsers to only use HTTPS for a specified time period (HSTS).

Prevents browsers from MIME-sniffing the content type away from the declared value.

Indicates whether a page can be embedded in an <iframe>. Prevents clickjacking attacks.

Configures the cross-site scripting (XSS) filter built into older browsers. Deprecated in favour of CSP.

Controls how much referrer information is included with requests.

Allows or denies the use of browser features (camera, geolocation, microphone, etc.).

Prevents a document from loading cross-origin resources that do not explicitly grant permission.

Ensures a top-level document does not share a browsing context group with cross-origin documents.

Conveys a desire that the browser blocks no-cors cross-origin/cross-site requests to the resource.

Lets sites opt in to reporting and enforcement of Certificate Transparency requirements. Deprecated.

Associates a cryptographic public key with a web server to reduce the risk of MITM attacks. Deprecated.

Indicates whether the response can be shared with requesting code from the given origin.

Indicates whether the response to the request can be exposed when the credentials flag is true.

Used in preflight responses to indicate which request headers can be used during the actual request.

Specifies the HTTP methods allowed when accessing the resource in a CORS context.

Indicates which headers can be exposed as part of the response by listing their names.

Indicates how long the results of a preflight request can be cached (in seconds).

Used in preflight requests to tell the server which headers will be used in the actual request.

Used in preflight requests to let the server know which HTTP method will be used in the actual request.

Directives for caching mechanisms in both requests and responses.

Implementation-specific request header that may have various effects along the chain. Mostly obsolete.

Clears browsing data (cookies, storage, cache) associated with the requesting origin.

A version identifier for a specific version of a resource, enabling cache validation.

Contains the date/time after which the response is stale. Superseded by Cache-Control max-age.

The last modification date of the resource. Used for cache validation alongside If-Modified-Since.

Tells caches which request headers to use to determine if a cached response is still fresh.

Lists the encodings that have been applied to the entity body (e.g. compression).

Describes the natural language(s) intended for the audience of the enclosed content.

The size of the resource, in decimal number of bytes.

Indicates an alternate location for the returned data.

Indicates where in the full body message a partial message belongs.

Indicates the media type of the resource or data in the body of the message.

Specifies the form of encoding used to safely transfer the payload to the user.

Advertises which media types the server can accept in a PATCH request.

Advertises which media types the server can accept in a POST request.

Sends credentials (token, basic auth) to the server for the current request.

Defines the authentication scheme and parameters for the resource.

Defines the authentication method that should be used to gain access through a proxy.

Contains the credentials to authenticate a user agent with a proxy server.

Requests the server to switch to a different protocol (e.g. HTTP → WebSocket).

Sent by the server to confirm it is willing to upgrade the connection to WebSocket.

Negotiates protocol extensions between client and server during the WebSocket handshake.

A base64-encoded nonce sent by the client to prevent cached responses and confirm handshake.

Specifies one or more subprotocols to use over the WebSocket connection.

Specifies the WebSocket protocol version the client wants to use.