HTTP Header Reference

HTTP headers are key-value pairs sent between the client and server with every HTTP request and response. They carry metadata about the request, response, and the body — such as content type, authentication credentials, caching policies, and security directives. Understanding headers is essential for configuring web servers, debugging APIs, implementing security, and optimizing performance.

Request headers are sent by the client (browser or API client) and include things like Host, User-Agent, Accept, and Authorization. Response headers are sent by the server and include Location, Set-Cookie, and WWW-Authenticate. General headers can appear in both directions, like Date, Cache-Control, and Connection. Entity headers describe the body, like Content-Type and Content-Length.

The essential security headers are: Content-Security-Policy (controls which resources can load), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options: nosniff (prevents MIME sniffing), X-Frame-Options: DENY (prevents clickjacking), and Referrer-Policy (controls referrer info). For modern apps, also consider Permissions-Policy (controls browser API access) and the COOP/COEP headers for cross-origin isolation.

CORS (Cross-Origin Resource Sharing) is a security mechanism that controls which websites can access resources from a different origin. When a browser makes a cross-origin request, it checks the server's CORS headers. The key headers are Access-Control-Allow-Origin (which origins are allowed), Access-Control-Allow-Methods (which HTTP methods), Access-Control-Allow-Headers (which custom headers), and Access-Control-Allow-Credentials (whether cookies can be sent).

Cache-Control is the most powerful caching header — it uses directives like max-age, no-cache, and no-store. Expires is an older HTTP/1.0 header that specifies an absolute expiration date. If both are present, Cache-Control max-age takes precedence. ETag is a validation token — the client can send it back via If-None-Match to check if the cached version is still fresh, which avoids downloading unchanged content.

Authorization is a request header sent by the client containing credentials (e.g., Bearer token, Basic auth). WWW-Authenticate is a response header sent by the server when the server needs to challenge the client for authentication — it tells the client which authentication scheme to use. The typical flow: client requests a resource, server responds with 401 + WWW-Authenticate, client retries with Authorization.

X-Forwarded-For is a de facto standard header added by proxies and load balancers to preserve the original client IP address. It can contain multiple IPs if there are multiple proxies. X-Real-IP is a simpler Nginx convention that contains only the original client IP. These are essential for applications that need to know the real client IP behind a proxy or CDN.

Yes — completely free, no registration, and 100% private. The entire database of HTTP headers is built into the page and runs locally in your browser. Nothing is uploaded, stored, or logged. The tool works offline after the page loads.