Nova Free Tools
Support us
All toolsCategoriesGuidesAboutFavouritesSupport us
  1. Home
  2. API
  3. HTTP Header Reference

HTTP Header Reference

Common HTTP request and response headers explained, with examples, plus a checker for your site’s security headers.

Runs in your browser

73 headers

Accept

Request

Content negotiation

The media types the client can handle.

Accept: application/json

Accept-Encoding

Request

Content negotiation

The compression formats the client supports.

Accept-Encoding: gzip, deflate, br, zstd

Accept-Language

Request

Content negotiation

The languages the user prefers, in order.

Accept-Language: en-IN, en;q=0.9, hi;q=0.8

Accept-Ranges

Response

Range requests

Says whether the server supports range requests.

Accept-Ranges: bytes

Access-Control-Allow-Credentials

Response

CORS

Whether the browser may send cookies or credentials and expose the response.

Access-Control-Allow-Credentials: true

Access-Control-Allow-Headers

Response

CORS

The request headers allowed for a cross-origin request.

Access-Control-Allow-Headers: Content-Type, Authorization

Access-Control-Allow-Methods

Response

CORS

The methods allowed for a cross-origin request, sent in reply to a preflight.

Access-Control-Allow-Methods: GET, POST, PUT, DELETE

Access-Control-Allow-Origin

Response

CORS

Which origin may read the response in a browser.

Access-Control-Allow-Origin: https://app.example.com

* cannot be used together with credentials (cookies or Authorization).

Access-Control-Expose-Headers

Response

CORS

Response headers that browser JavaScript may read.

Access-Control-Expose-Headers: X-Request-Id, Link

Access-Control-Max-Age

Response

CORS

How long the browser may cache the preflight result, in seconds.

Access-Control-Max-Age: 86400

Access-Control-Request-Headers

Request

CORS

Sent in a preflight to ask whether headers are allowed.

Access-Control-Request-Headers: Content-Type, Authorization

Access-Control-Request-Method

Request

CORS

Sent in a preflight to ask whether a method is allowed.

Access-Control-Request-Method: PUT

Age

Response

Caching

How many seconds the response has been in a shared cache such as a CDN.

Age: 3600

Allow

Response

Redirects and requests

The methods a resource supports, sent with 405.

Allow: GET, HEAD, OPTIONS

Alt-Svc

Response

Connection

Advertises another way to reach the same service, such as HTTP/3.

Alt-Svc: h3=":443"; ma=86400

Authorization

Request

Authentication

Credentials that prove who the client is, such as a bearer token or Basic username and password.

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9…

Never log it in full. Basic credentials are only Base64-encoded, so always use HTTPS.

Cache-Control

Both

Caching

Rules for how browsers and CDNs may cache the response, and for how long.

Cache-Control: public, max-age=31536000, immutable

Use no-store for private data, no-cache to always revalidate, and long max-age with immutable for fingerprinted files.

Clear-Site-Data

Response

Caching

Asks the browser to clear cookies, storage or cache for the site, for example on sign-out.

Clear-Site-Data: "cache", "cookies", "storage"

Connection

Both

Connection

Whether to keep the connection open after the request (HTTP/1.1 only).

Connection: keep-alive

Content-Disposition

Response

Content

Whether to show the body in the browser or download it, and the suggested file name.

Content-Disposition: attachment; filename="invoice-0042.pdf"

Content-Encoding

Response

Content

How the body is compressed.

Content-Encoding: br

Content-Language

Response

Content

The language of the content for the reader.

Content-Language: en-IN

Content-Length

Both

Content

The size of the body in bytes.

Content-Length: 348

Content-Location

Response

Content

Another URL where the returned representation can be found.

Content-Location: /documents/foo.json

Content-Range

Response

Range requests

Which part of the resource this partial (206) response contains.

Content-Range: bytes 0-1023/146515

Content-Security-Policy

Response

Security

Limits where scripts, styles, images and frames may load from. The strongest defence against XSS.

Content-Security-Policy: default-src 'self'; img-src 'self' data:; frame-ancestors 'none'

Content-Security-Policy-Report-Only

Response

Security

Tests a CSP by reporting violations without blocking anything.

Content-Security-Policy-Report-Only: default-src 'self'; report-to csp

Content-Type

Both

Content

The media type of the body, and often its character set.

Content-Type: application/json; charset=utf-8

A wrong Content-Type is a common cause of 400 and 415 errors.

Cross-Origin-Embedder-Policy

Response

Security

Only allows cross-origin resources that explicitly opt in; needed for some powerful features.

Cross-Origin-Embedder-Policy: require-corp

Cross-Origin-Opener-Policy

Response

Security

Isolates your window from pop-ups and openers on other origins.

Cross-Origin-Opener-Policy: same-origin

Cross-Origin-Resource-Policy

Response

Security

Which sites may load this resource.

Cross-Origin-Resource-Policy: same-site

DNT

RequestDeprecated

Proxies and client info

The old “Do Not Track” signal, now largely ignored. Global Privacy Control (Sec-GPC) replaced it.

DNT: 1

ETag

Response

Caching

A version identifier for the resource, used to check whether a cached copy is still current.

ETag: "33a64df551425fcc55e4d42a148795d9"

Expect

Request

Redirects and requests

Asks the server to confirm before the client sends a large body.

Expect: 100-continue

Expires

Response

Caching

A date after which the response is stale. Cache-Control max-age takes priority.

Expires: Wed, 21 Oct 2026 07:28:00 GMT

Forwarded

Request

Proxies and client info

The standard replacement for the X-Forwarded-* headers.

Forwarded: for=203.0.113.7; proto=https; host=www.example.com

Host

Request

Proxies and client info

The domain (and port) the request is for. Required in HTTP/1.1.

Host: api.example.com

Idempotency-Key

Request

Redirects and requests

A unique key so a retried POST is not processed twice, for example a payment.

Idempotency-Key: 4f8e2a1c-…

If-Match

Request

Conditional requests

Only perform the update if the ETag matches, which prevents overwriting someone else’s change.

If-Match: "33a64df551425fcc55e4d42a148795d9"

If-Modified-Since

Request

Conditional requests

Only send the resource if it changed after this date; otherwise reply 304.

If-Modified-Since: Tue, 06 Oct 2026 10:00:00 GMT

If-None-Match

Request

Conditional requests

Only send the resource if its ETag is different; otherwise reply 304.

If-None-Match: "33a64df551425fcc55e4d42a148795d9"

If-Unmodified-Since

Request

Conditional requests

Only perform the request if the resource has not changed since this date.

If-Unmodified-Since: Tue, 06 Oct 2026 10:00:00 GMT

Keep-Alive

Both

Connection

Hints for how long and how many requests a persistent connection should last.

Keep-Alive: timeout=5, max=1000

Last-Modified

Response

Caching

When the resource last changed. Used with If-Modified-Since.

Last-Modified: Tue, 06 Oct 2026 10:00:00 GMT

Location

Response

Redirects and requests

Where to go next, for redirects (3xx) and newly created resources (201).

Location: https://example.com/new-page

Origin

Request

CORS

The scheme, host and port the request comes from. Browsers add it to cross-origin requests.

Origin: https://app.example.com

Permissions-Policy

Response

Security

Turns browser features such as camera, microphone and location on or off for the page and its frames.

Permissions-Policy: camera=(), microphone=(), geolocation=()

Pragma

RequestDeprecated

Caching

An old HTTP/1.0 cache header. Use Cache-Control instead.

Pragma: no-cache

Proxy-Authenticate

Response

Authentication

Sent with 407 to say how to authenticate with the proxy.

Proxy-Authenticate: Basic realm="proxy"

Proxy-Authorization

Request

Authentication

Credentials for a proxy server between the client and the destination.

Proxy-Authorization: Basic dXNlcjpwYXNz

Range

Request

Range requests

Asks for only part of the resource, for resumable downloads and video.

Range: bytes=0-1023

Referer

Request

Proxies and client info

The page that linked to this request (the spelling mistake is part of the standard).

Referer: https://example.com/pricing

Referrer-Policy

Response

Security

How much of the current URL is sent as the Referer when users follow links.

Referrer-Policy: strict-origin-when-cross-origin

Retry-After

Response

Redirects and requests

How long to wait before retrying, with 429 or 503.

Retry-After: 120

Sec-GPC

Request

Proxies and client info

Global Privacy Control: the user asks sites not to sell or share their data.

Sec-GPC: 1

Server

Response

Proxies and client info

The software that handled the request.

Server: nginx

Leaving out version numbers gives attackers less to go on.

Strict-Transport-Security

Response

Security

Tells browsers to use only HTTPS for the site from now on (HSTS).

Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

Transfer-Encoding

Response

Content

How the body is sent, usually chunked when its length is not known in advance (HTTP/1.1 only).

Transfer-Encoding: chunked

Upgrade

Both

Connection

Asks to switch to another protocol on the same connection, such as WebSocket.

Upgrade: websocket

User-Agent

Request

Proxies and client info

Identifies the browser, app or tool making the request.

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)…

Vary

Response

Caching

Which request headers change the response, so caches keep separate copies.

Vary: Accept-Encoding, Accept-Language

Vary: * or Vary: Cookie can make a CDN cache almost useless.

Via

Both

Proxies and client info

Proxies the message passed through.

Via: 1.1 varnish, 1.1 cloudfront

WWW-Authenticate

Response

Authentication

Sent with 401 to say which authentication scheme the server expects.

WWW-Authenticate: Bearer realm="api", error="invalid_token"

X-Content-Type-Options

Response

Security

Stops browsers guessing a different content type than the one declared.

X-Content-Type-Options: nosniff

X-Forwarded-For

Request

Proxies and client info

The original client IP address when the request passed through proxies or load balancers.

X-Forwarded-For: 203.0.113.7, 70.41.3.18

Easy to fake: only trust it when your own proxy sets it.

X-Forwarded-Host

Request

Proxies and client info

The original Host requested by the client before a proxy.

X-Forwarded-Host: www.example.com

X-Forwarded-Proto

Request

Proxies and client info

Whether the client used HTTP or HTTPS before a proxy.

X-Forwarded-Proto: https

X-Frame-Options

Response

Security

Stops other sites showing your pages in a frame (clickjacking). CSP frame-ancestors is the modern replacement.

X-Frame-Options: DENY

X-Request-ID

Both

Proxies and client info

A unique ID that follows a request through your services, for tracing and support.

X-Request-ID: 7f2c1a9e-3b4d-4c1f-9a2e-8b6d5c4e3f21

X-XSS-Protection

ResponseDeprecated

Security

An old browser XSS filter, now removed from browsers. Use a Content Security Policy instead.

X-XSS-Protection: 0

What is the HTTP Header Reference?

HTTP headers carry the extra information that travels with every request and response: who the client is, what formats it accepts, how long a response may be cached, which sites may read it and much more. Getting a few of them right makes a site faster and much safer.

This reference explains the headers developers use most, grouped by purpose (caching, CORS, cookies, security, authentication and so on), each with a real example. Paste the response headers of your own site into the checker to see which security headers are missing and what to add.

How to use it

  1. Search for a header by name or by what it does, for example “cache” or “cors”.
  2. Filter by request or response headers, or by group.
  3. Copy an example to use in your server configuration or code.
  4. To check a site, copy its response headers (DevTools → Network, or curl -I) into the checker.

Features

  • 70+ headers. Caching, CORS, cookies, security, authentication, content, proxies, ranges and more.
  • Real examples. A working example value for every header, ready to copy.
  • Security header check. Paste response headers to see which of HSTS, CSP, nosniff, Referrer-Policy and others are missing or weak.
  • Practical notes. Pitfalls such as CORS wildcards with credentials, or Vary: Cookie breaking CDN caching.
  • Deprecated headers marked. Pragma, X-XSS-Protection and DNT are flagged with what to use instead.
  • Private. The checker runs in your browser; headers you paste are not sent anywhere.

Frequently asked questions

Which security headers should every site send?

At least Strict-Transport-Security (HTTPS only), Content-Security-Policy (blocks injected scripts), X-Content-Type-Options: nosniff, a Referrer-Policy and a frame policy (CSP frame-ancestors or X-Frame-Options). Permissions-Policy is a good addition.

How do I see the headers of a website?

Open your browser’s developer tools, go to the Network tab, reload the page and click the first request to see its response headers. On the command line, run curl -I https://example.com.

What is the difference between Cache-Control no-cache and no-store?

no-cache lets the browser keep a copy but makes it check with the server (revalidate) before each use. no-store forbids keeping a copy at all, which is right for private data such as account pages.

Why does my API call fail with a CORS error?

The browser blocks reading a cross-origin response unless the server sends Access-Control-Allow-Origin for your origin. For requests with custom headers or methods like PUT, the server must also answer the OPTIONS preflight with Allow-Methods and Allow-Headers.

Last updated · Free, no sign-up, runs in your browser.

Free for everyone, kept free by you.

No paywall, no sign-up and no watermarks. If a tool saved you time, you can chip in any amount by UPI to keep Nova Free Tools running.

Support with UPIOur Android apps
Esc
↑↓ move↵ openEsc close