HTTP headers reference — 60 request and response headers explained

How to use the HTTP headers reference

1. Type in Filter. A header name (etag), a topic (cors, cookie, cache, hsts) or a status code mentioned in the purpose (304, 429) all work. Every word must appear in the row.
2. Optionally set Type to Request or Response (each includes the two-way headers) or Both (two-way headers only). All is the default.
3. Read the Purpose and copy the Example line as a starting point for your server config or test request.

What it does and when to use it

It is a short, practical list of the 60 headers you meet most when building or debugging web apps and APIs: 21 request headers, 28 response headers and 11 that travel both ways. Use it when a browser blocks a call with a CORS error, when a response is cached for too long, when a file download needs a filename, or when you set up security headers such as Content-Security-Policy, Strict-Transport-Security and Permissions-Policy.

The examples are realistic values, not just syntax. Cache-Control: public, max-age=31536000, immutable is the usual setting for fingerprinted static files. Content-Disposition: attachment; filename="report.pdf" forces a download.

Status codes have their own HTTP status codes reference, and Content-Type values are listed in MIME types. To turn headers into a request you can run, use the curl command builder.

How it works

The header list loads on first use and is filtered in your browser. Your filter is split into words, and a row stays only if each word appears in its name, type, purpose or example (case-insensitive). The word hsts is matched against the uppercase HSTS in the Strict-Transport-Security row. Nothing is fetched from your site, and nothing you type is sent anywhere.

Worked examples

Filter cors returns Showing: 7 of 60 headers. Six are the Access-Control-* headers, plus Origin, which the browser sends on every cross-origin request.

Filter 304 finds the two conditional request headers that can earn a “304 Not Modified” reply:

If-Modified-Since: Wed, 21 Oct 2026 07:28:00 GMT
If-None-Match: "33a64df5"

Filter hsts returns one row with a two-year policy (63,072,000 seconds):

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Limits and tips

• Not every header is here. Rare and vendor-specific headers (for example cloud-provider or CDN headers) are not listed, and there is no full list of directives for CSP or Cache-Control.
• Example values are examples. max-age=31536000 suits files whose name changes when their content changes, but it would keep a normal HTML page stale for a year.
• Test with preload in mind. The preload flag in HSTS is hard to undo once a domain is on browser preload lists.
• Connection and Keep-Alive are HTTP/1.1 only. HTTP/2 forbids connection-specific headers, as the table notes.