How This HTTP Headers Reference Works
This http headers reference covers 44 entries you can search by name, keyword, or category. Type a header name, a keyword, or part of a description into the search box, or pick a category, and this http headers search tool filters down to matching entries instantly. Each result shows the header's category, a plain-English description of what it does, a real example value formatted the way it actually appears on the wire, for instance a content-security-policy header example with realistic directive values rather than a bare placeholder, and whether it's RFC-standard, an HTTP/2-specific header, non-standard (vendor or de facto convention), or deprecated in favor of something newer. Search and category filtering combine, so searching "cache" within the caching category narrows straight down to a cache-control header explained result rather than making you scroll a full list of http headers to find it.
Request vs Response Headers
Every entry is tagged as belonging primarily to the request side (sent by the client, like Accept, Authorization, User-Agent, Cookie) or the response side (sent by the server, like Content-Type, Set-Cookie, Location, ETag), though a handful of headers, especially in caching and CORS, are relevant to both directions of the exchange. Knowing which side a header belongs to matters when debugging: a header your code sets on a response won't do anything if the framework is only reading it as a request header, and vice versa.
CORS and Security Headers Explained
CORS headers explained briefly: a cross-origin request first triggers a preflight OPTIONS request, and the server's Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers responses determine whether the browser lets the actual request through, a mismatch in any of these is the single most common source of a CORS error in the browser console. Security headers reference material tends to circle around the same handful of headers: Content-Security-Policy restricts what a page is allowed to load, Strict-Transport-Security forces HTTPS for a period of time, X-Frame-Options and CSP's frame-ancestors directive prevent clickjacking, and Referrer-Policy controls how much of the current URL leaks to the next site a user navigates to.
| Header | Category | What it protects against |
|---|---|---|
| Content-Security-Policy | Security | XSS and unauthorized resource loading |
| Strict-Transport-Security | Security | Protocol downgrade / SSL-stripping attacks |
| X-Frame-Options | Security | Clickjacking via iframe embedding |
| Access-Control-Allow-Origin | CORS | Unauthorized cross-origin reads of a response |
Common Uses
Looking up the exact header name and casing while debugging a CORS error, comparing Cache-Control against ETag and Last-Modified to pick the right caching strategy for a given resource, auditing which security headers a site is missing before a review, and checking what a header your framework sets automatically actually does are the most common uses of this http headers cheat sheet. Searching by category, like pulling up every content-signaling header at once, is a common secondary use when working through a checklist rather than looking up one header at a time.
What This Tool Doesn't Do
This is a curated list of http request headers list and http response headers list entries covering the headers developers actually run into day to day, it isn't an exhaustive mirror of the IANA HTTP header registry, dozens of niche or vendor-specific headers exist beyond what's covered here. It doesn't fetch or inspect a live site's actual headers either, this is a static reference, not a header-checking scanner, and for the exact RFC text behind a given header, this tool doesn't currently link out to the specification itself, treat the descriptions here as a practical summary rather than the normative source.