HTTP Headers Reference

The media type of the resource. Tells the recipient how to interpret the content.

Media types the client can understand, used for content negotiation.

Credentials for authenticating the client with the server.

Directives for caching mechanisms in both requests and responses.

The size of the request/response body in bytes.

Any encodings applied to the content (compression).

Stored cookies previously sent by the server via Set-Cookie.

Send cookies from the server to be stored by the client.

Access-Control-Allow-Origin, Methods, Headers — control cross-origin access.

An identifier for a specific version of a resource, used for caching.

The domain name of the server (required in HTTP/1.1).

Makes the request conditional — returns 304 if the ETag still matches.

The URL to redirect to (used with 3xx status codes).

The origin (scheme, host, port) that triggered the request.

The address of the previous page from which this request was made.

Information about the server software.

Information about the client (browser, OS, version).

The originating client IP when behind a proxy or load balancer.

Whether the page can be displayed in an iframe (clickjacking protection).

Prevents MIME-sniffing — forces the declared Content-Type.

Tells the browser to always use HTTPS for this domain.

Enables the browser's built-in XSS filtering (deprecated in modern browsers).

Controls how much referrer information is sent with requests.

Defines allowed sources for scripts, styles, images and other resources.