HTTP Header Reference

The box matches your text against each header's name and its description, case-insensitive, and the Direction menu then filters the result further. Searching cache returns five headers including Age, Vary and Pragma because the word appears in their descriptions, not only in a header name.

Request headers are sent by the client to describe the request or the client itself, such as Accept and User-Agent. Response headers are sent back by the server about the response, such as ETag and Server. Some, like Content-Type, Cache-Control and Connection, are marked both because they appear in either direction.

The reference tags a Security category that includes Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy and the Cross-Origin-Opener and Resource policies. Note that a text search for the word security only returns the two headers whose names contain it.

Authorization carries credentials, such as a Bearer token or Basic auth, so the server can authenticate the request. It is a request header, and the matching response header WWW-Authenticate is what a server sends with a 401 to tell the client which scheme to use.

The Referer header preserves a misspelling from the original HTTP specification and it is now part of the standard. It still works everywhere, while the newer Referrer-Policy header, which controls how much of that address is sent, uses the correct double-r spelling.

Cross-origin resource sharing uses a set of Access-Control headers plus Origin to let a server opt in to being read by other origins. A search for cors returns Origin, Access-Control-Request-Method and Access-Control-Request-Headers, since those descriptions mention CORS directly, while the Access-Control-Allow headers appear when you search access-control.

No. It is a static reference that explains what each header means and shows a representative example. To see the real headers a site returns, use your browser's network panel or a command-line tool like curl -I.

No. This is a curated list of 61 of the most common standard headers. Many more exist, including experimental headers and custom application headers, which are often prefixed with X- like X-Forwarded-For.

No. The list ships with the page and all filtering happens in your browser, so nothing you type is transmitted and the reference works offline once loaded.