HTTP Headers Reference
Every HTTP header field with its status, RFC clause and direction — plus builders for Cache-Control, CSP, HSTS and CORS values, all on this device.
All 260 header fields shown
The fields below are written up in full. Every other row in the table above carries its registry facts and links to the document that defines it.
Accept
Permanent
Which media types the client can use, with optional q-values ranking them.
What it means
A comma-separated list of media ranges (`text/html`, `image/*`, `*/*`), each optionally carrying a `q` weight from 0 to 1 that ranks it (RFC 9110 §12.5.1).
It is a preference, not a constraint: a server may send a representation the client did not list, and 406 is rarely the useful answer.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- CORS-safelisted request field — no preflight needed
Defined in: RFC 9110, Section 12.5.1: HTTP Semantics
Accept-Encoding
Permanent
Which content codings (gzip, br, zstd) the client can decode.
What it means
A list of content codings with optional q-values; `identity` means no coding, and `*` matches anything not otherwise listed (RFC 9110 §12.5.3).
The server's choice comes back in `Content-Encoding`, and the response should list `Accept-Encoding` in `Vary` if caches may hold both forms.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 12.5.3: HTTP Semantics
Accept-Language
Permanent
Which natural languages the client prefers, with optional q-values.
What it means
A list of language ranges (`en-GB`, `fr`, `*`) with optional q weights (RFC 9110 §12.5.4).
Browsers derive it from the user's OS and browser settings, so it reflects a preference the visitor may not know they set.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- CORS-safelisted request field — no preflight needed
Defined in: RFC 9110, Section 12.5.4: HTTP Semantics
Accept-Ranges
Permanent
Advertises that the resource supports range requests; `bytes` or `none`.
What it means
`Accept-Ranges: bytes` tells the client it may ask for byte ranges; `none` explicitly says it may not (RFC 9110 §14.3).
Absence is not a refusal — it simply says nothing, and a client may still try a `Range` request.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 14.3: HTTP Semantics
Access-Control-Allow-Credentials
Permanent
Set to `true` to let a credentialed cross-origin request read the response.
What it means
The only defined value is the literal `true`; anything else, including `false`, is treated as absent (WHATWG Fetch, CORS protocol).
With it set, `Access-Control-Allow-Origin` must name one explicit origin — `*` is rejected by the browser.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Fetch
Access-Control-Allow-Headers
Permanent
Which request header names a preflighted cross-origin request may send.
What it means
Answers the preflight's `Access-Control-Request-Headers`. Names are matched case-insensitively; `*` is a wildcard for non-credentialed requests only.
The CORS-safelisted headers never need listing, but `Authorization` is never covered by `*` and must always be named explicitly.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Fetch
Access-Control-Allow-Methods
Permanent
Which HTTP methods a preflighted cross-origin request may use.
What it means
A comma-separated method list answering the preflight's `Access-Control-Request-Method`; `*` is a wildcard for non-credentialed requests only.
It applies to the preflight decision, not to what the server actually implements — `Allow` is the field that answers that.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Fetch
Access-Control-Allow-Origin
Permanent
Which origin may read the response: one exact origin, `*`, or `null`.
What it means
Either the single wildcard `*`, or exactly one origin serialization (`https://app.example`) — a comma-separated list is not valid and browsers reject it.
Echoing the request's `Origin` is how a server supports several origins, and that response must list `Origin` in `Vary` so caches do not cross the wires.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Fetch
Age
Permanent
How many seconds ago the response was generated at the origin, per the cache serving it.
What it means
A non-negative integer of seconds, added by caches (RFC 9111 §5.1). A large `Age` next to a small `max-age` means the response is close to stale.
Its presence is a reliable sign the response came from a shared cache rather than the origin.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9111, Section 5.1: HTTP Caching
Allow
Permanent
The set of methods the target resource actually supports.
What it means
Required on a 405 response and allowed on any other (RFC 9110 §10.2.1). An empty `Allow` legitimately means the resource supports no methods at all.
This is the resource's real capability list, unlike `Access-Control-Allow-Methods`, which only answers a CORS preflight.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 10.2.1: HTTP Semantics
Cache-Control
Permanent
Directives that control caching along the whole request/response chain.
What it means
A comma-separated directive list; request and response directives are different vocabularies (RFC 9111 §5.2.1 and §5.2.2).
`no-cache` means revalidate before reuse; `no-store` means do not write it down at all. They are different instructions and are routinely confused.
Where both are present, `Cache-Control` overrides `Expires` (RFC 9111 §5.3).
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9111, Section 5.2: HTTP Caching
Connection
Permanent
Connection-scoped control options; names the fields an intermediary must strip.
What it means
Every field named in `Connection` is hop-by-hop: a proxy removes it before forwarding, along with `Connection` itself (RFC 9110 §7.6.1).
HTTP/2 and HTTP/3 forbid it outright — connection-specific fields do not exist there.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Hop-by-hop — an intermediary strips it before forwarding (RFC 9110 §7.6.1)
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 7.6.1: HTTP Semantics
Content-Disposition
Permanent
Whether to display the body inline or save it, and under what filename.
What it means
`inline` or `attachment`, plus an optional `filename` parameter (RFC 6266). The disposition type is case-insensitive.
A non-ASCII filename needs the `filename*` form of RFC 8187 (`UTF-8''` plus percent-encoding); plain `filename` is limited to ISO-8859-1.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 6266: Use of the Content-Disposition Header Field in the Hypertext Transfer Protocol (HTTP)
Content-Encoding
Permanent
Which codings have been applied to the body, in the order they were applied.
What it means
`gzip`, `br`, `zstd`, `deflate` and friends (RFC 9110 §8.4). The recipient decodes in reverse order to recover the representation.
It describes the representation itself, so `Content-Length` counts the encoded bytes and `ETag` identifies the encoded form.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 8.4: HTTP Semantics
Content-Length
Permanent
The body's size in decimal octets.
What it means
A single decimal number of octets (RFC 9110 §8.6). It counts the bytes on the wire after any `Content-Encoding` is applied.
It must not be combined with `Transfer-Encoding: chunked`; a message carrying both is a framing error.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 8.6: HTTP Semantics
Content-MD5
Obsoleted
Obsolete body checksum; removed from HTTP by RFC 7231 and still seen in older APIs.
What it means
A base64 MD5 digest of the body, defined by RFC 2616 §14.15 and deleted from HTTP in RFC 7231. The registry status is `obsoleted`.
Several storage APIs kept it as a vendor requirement, which is why it still appears in the wild; `Digest`/`Repr-Digest` (RFC 9530) is the current mechanism.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 2616, Section 14.15: Hypertext Transfer Protocol -- HTTP/1.1
Content-Range
Permanent
Which part of the representation the body carries, and the total size.
What it means
`bytes 0-1023/4096` on a 206, or `bytes */4096` on a 416 to report the real length (RFC 9110 §14.4).
Ranges are inclusive on both ends, so `0-1023` is 1024 octets.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 14.4: HTTP Semantics
Content-Security-Policy
Permanent
A policy of directives restricting where the page may load and run resources from.
What it means
Semicolon-separated directives, each a name plus a source list (CSP Level 3). Directives are matched case-insensitively.
`default-src` is the fallback for the fetch directives only — `frame-ancestors`, `base-uri`, `form-action` and `sandbox` do not fall back to it and must be set explicitly.
A nonce or hash with `'strict-dynamic'` is the modern shape; `'unsafe-inline'` disables the protection it appears in.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Content Security Policy Level 3
Content-Type
Permanent
The media type of the body, plus parameters such as `charset` or `boundary`.
What it means
`type/subtype` with optional `; name=value` parameters (RFC 9110 §8.3). The type and parameter names are case-insensitive.
`charset` only means something for types that define it; `application/json` is defined as UTF-8 and ignores the parameter (RFC 8259 §8.1).
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- CORS-safelisted request field — no preflight needed
Defined in: RFC 9110, Section 8.3: HTTP Semantics
Cross-Origin-Opener-Policy
Permanent
Whether the document shares a browsing-context group with its opener.
What it means
`unsafe-none` (the default), `same-origin-allow-popups` or `same-origin` (HTML Standard). `same-origin` severs `window.opener`.
Together with `Cross-Origin-Embedder-Policy` it is what makes a document cross-origin isolated and re-enables `SharedArrayBuffer`.
- Direction
- Response
- Structured type
- Item
Defined in: HTML
Cross-Origin-Resource-Policy
Permanent
Which origins may embed this resource at all: `same-origin`, `same-site` or `cross-origin`.
What it means
A blunt embedding block checked by the browser before the response reaches the embedding document (WHATWG Fetch).
Unlike CORS it needs no preflight and offers no negotiation — the response is either allowed to be embedded or it is not.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Fetch
Date
Permanent
When the message was originated, as an IMF-fixdate in GMT.
What it means
`Sun, 06 Nov 1994 08:49:37 GMT` — the preferred format of RFC 9110 §5.6.7, always GMT, always that exact shape.
Caches compute a response's age from it, so a badly-skewed origin clock produces wrong freshness everywhere downstream.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 6.6.1: HTTP Semantics
ETag
Permanent
An opaque validator for one representation; strong by default, `W/` for weak.
What it means
A quoted opaque string, optionally prefixed `W/` for a weak validator (RFC 9110 §8.8.3). Only the origin server assigns meaning to it.
Clients replay it in `If-None-Match` to get a 304, and in `If-Match` to make an unsafe request conditional.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 8.8.3: HTTP Semantics
Expires
Permanent
The date after which the response is considered stale.
What it means
An HTTP-date (RFC 9111 §5.3). A value in the past, or an unparsable one such as `0`, means already stale.
`Cache-Control: max-age` wins wherever both are present, so `Expires` is mainly a fallback for very old caches.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9111, Section 5.3: HTTP Caching
Forwarded
Permanent
The standardised proxy-hop record: `by`, `for`, `host` and `proto` parameters.
What it means
RFC 7239 replaces the de-facto `X-Forwarded-*` family with one field: `Forwarded: for=192.0.2.60;proto=http;by=203.0.113.43`.
Every value is supplied by an intermediary, so it is only as trustworthy as the nearest proxy you actually control.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 7239: Forwarded HTTP Extension
Host
Permanent
The target URI's host and port; mandatory on every HTTP/1.1 request.
What it means
`Host: example.com:8080` (RFC 9110 §7.2). A request without it, or with more than one, must be rejected with 400.
In HTTP/2 and HTTP/3 the `:authority` pseudo-header carries the same information.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 7.2: HTTP Semantics
If-Modified-Since
Permanent
Make a GET conditional on the representation changing since a date.
What it means
Takes an HTTP-date, normally a previously received `Last-Modified` (RFC 9110 §13.1.3). A match yields 304 with no body.
It is ignored when `If-None-Match` is also present, because an entity tag is the stronger validator.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 13.1.3: HTTP Semantics
If-None-Match
Permanent
Make a request conditional on none of the listed entity tags matching.
What it means
A list of entity tags or `*`, compared with the weak comparison function (RFC 9110 §13.1.2). A match yields 304 for GET/HEAD, 412 otherwise.
`If-None-Match: *` on a PUT is the standard way to say "create only if it does not exist yet".
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 13.1.2: HTTP Semantics
Keep-Alive
Permanent
Hints about an HTTP/1.1 persistent connection, such as `timeout` and `max`.
What it means
Defined in RFC 2068 §19.7.1 and never carried into RFC 9110; it is hop-by-hop and must be stripped by intermediaries.
It is a hint, not a contract — either end may close the connection at any time regardless of what it says.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Hop-by-hop — an intermediary strips it before forwarding (RFC 9110 §7.6.1)
- Forbidden name — fetch() will not set this field
Defined in: RFC 2068: Hypertext Transfer Protocol -- HTTP/1.1
Last-Modified
Permanent
When the origin believes the representation last changed.
What it means
An HTTP-date with one-second resolution (RFC 9110 §8.8.2), which is why it is a weaker validator than an entity tag.
Clients replay it in `If-Modified-Since`; where both exist, prefer `ETag`.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 8.8.2: HTTP Semantics
Link
Permanent
Typed links expressed in a header instead of the document body.
What it means
`<uri-reference>; rel="..."` plus optional parameters, comma-separated for multiple links (RFC 8288 §3).
The same relation types as HTML's `<link>` element apply, which is what makes header-driven `preload` and `preconnect` work.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 8288: Web Linking
Location
Permanent
Where to go next after a redirect, or where a created resource now lives.
What it means
A URI-reference, resolved against the request target (RFC 9110 §10.2.2). It may be relative.
On a 201 it identifies the resource that was created; on a 3xx it is the redirect target.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 10.2.2: HTTP Semantics
Origin
Permanent
The origin that caused the request, serialized as scheme://host[:port], or `null`.
What it means
Sent by the browser on cross-origin requests and on all non-GET requests (RFC 6454). It carries no path and no query.
It can be the literal `null` — for a sandboxed iframe or a `file:` document — and `null` must never be treated as trusted.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 6454: The Web Origin Concept
Permissions-Policy
Provisional
Which powerful browser features this document and its frames may use.
What it means
A structured dictionary of `feature=allowlist` entries, comma-separated: `geolocation=(), camera=(self)` (Permissions Policy).
An empty allowlist `()` disables the feature outright, including for the document's own origin. Omitting a feature leaves its default in place, which is not the same thing.
- Direction
- Response
- Structured type
- Dictionary
The registry cell is blank for this field; the type shown is this page's reading of the defining document.
Defined in: Permissions Policy
Proxy-Authenticate
Permanent
The authentication challenge a proxy sends with a 407.
What it means
Same shape as `WWW-Authenticate` but scoped to the proxy that sent it (RFC 9110 §11.7.1), and answered with `Proxy-Authorization`.
It applies to one connection only, so intermediaries do not forward it.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Hop-by-hop — an intermediary strips it before forwarding (RFC 9110 §7.6.1)
Defined in: RFC 9110, Section 11.7.1: HTTP Semantics
Public-Key-Pins
Permanent
HTTP Public Key Pinning — specified by RFC 7469 and removed from every major browser.
What it means
Pinned a site to specific public keys. Chrome removed support in 2018 and other browsers followed; nothing enforces it today.
The registry still lists it as `permanent`, which records the registration, not current browser behaviour. Certificate Transparency took over the role.
When to use it
Present here because it still turns up in old configuration files. Setting it has no effect in current browsers.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 7469: Public Key Pinning Extension for HTTP
Range
Permanent
Ask for part of a representation, normally as `bytes=start-end`.
What it means
`bytes=0-1023`, `bytes=1024-`, or the suffix form `bytes=-500` for the last 500 octets (RFC 9110 §14.2).
A server may answer 206 with the range, 200 with the whole thing, or 416 if the range cannot be satisfied.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- CORS-safelisted request field — no preflight needed
Defined in: RFC 9110, Section 14.2: HTTP Semantics
Referer
Permanent
The URI of the page the request came from — misspelled since 1996.
What it means
The originating URI, with fragment and userinfo removed (RFC 9110 §10.1.3). The spelling is the historical one and is now normative.
How much of it is sent is governed by `Referrer-Policy`; browsers default to `strict-origin-when-cross-origin`.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 10.1.3: HTTP Semantics
Referrer-Policy
Permanent
How much of the referring URL browsers may put in `Referer`.
What it means
One of the defined tokens, e.g. `no-referrer`, `same-origin`, `strict-origin-when-cross-origin` (W3C Referrer Policy).
A comma-separated list is allowed; the browser uses the last token it understands, which is how you ship a fallback.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Referrer Policy
Retry-After
Permanent
How long to wait before retrying: delay-seconds or an HTTP-date.
What it means
Exactly one of two forms — a non-negative integer of seconds, or an IMF-fixdate (RFC 9110 §10.2.3).
It is meaningful on 503, on 429, and on a 3xx to say when the redirect target is expected to be available.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 10.2.3: HTTP Semantics
Server
Permanent
The origin server's software, as product tokens with optional comments.
What it means
`nginx/1.25.3` or `Apache/2.4.58 (Unix)` (RFC 9110 §10.2.4). It is entirely advisory.
Publishing a precise version tells attackers which advisories to try; many deployments shorten it to the product name.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 10.2.4: HTTP Semantics
Strict-Transport-Security
Permanent
Tells the browser to use HTTPS for this host for the next `max-age` seconds.
What it means
`max-age` is required; `includeSubDomains` and `preload` are optional flags (RFC 6797 §6.1).
It is ignored when delivered over plain HTTP, and `max-age=0` clears the stored policy.
`preload` is not part of RFC 6797: it is a signal to the browser-maintained preload list, whose own rules require a long `max-age` and `includeSubDomains`.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 6797: HTTP Strict Transport Security (HSTS)
TE
Permanent
Which transfer codings the client accepts, plus whether it accepts trailers.
What it means
Notably `TE: trailers`, which is how a client says it will accept trailer fields (RFC 9110 §10.1.4).
It is hop-by-hop and must be listed in `Connection` when sent over HTTP/1.1.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Hop-by-hop — an intermediary strips it before forwarding (RFC 9110 §7.6.1)
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 10.1.4: HTTP Semantics
Trailer
Permanent
Announces which fields will arrive after the body, in the trailer section.
What it means
Lets a recipient know what is coming so it can decide whether to buffer (RFC 9110 §6.6.2).
Framing, routing, authentication, caching and content fields must never be sent as trailers — a recipient may drop the whole trailer section.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 6.6.2: HTTP Semantics
Transfer-Encoding
Permanent
Codings applied for transfer, not to the representation; `chunked` is the framing one.
What it means
Hop-by-hop and about message framing (RFC 9112 §6.1), unlike `Content-Encoding`, which describes the representation itself.
`chunked` must be the final coding, and it never coexists with `Content-Length`. HTTP/2 and HTTP/3 have their own framing and forbid this field.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Hop-by-hop — an intermediary strips it before forwarding (RFC 9110 §7.6.1)
- Forbidden name — fetch() will not set this field
Defined in: RFC 9112, Section 6.1: HTTP Semantics
Upgrade
Permanent
Offers to switch this connection to another protocol, such as WebSocket.
What it means
Listed alongside `Connection: upgrade`; acceptance is a 101 response naming the chosen protocol (RFC 9110 §7.8).
It is hop-by-hop, and HTTP/2 and HTTP/3 removed it in favour of their own mechanisms.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Hop-by-hop — an intermediary strips it before forwarding (RFC 9110 §7.6.1)
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 7.8: HTTP Semantics
User-Agent
Permanent
The client's product tokens — historically accreted and widely imitated.
What it means
A sequence of product tokens with optional comments (RFC 9110 §10.1.5). Browsers copy each other's tokens for compatibility, which is why almost everything claims to be Mozilla.
Serve features by detecting the feature, not by matching this string.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 10.1.5: HTTP Semantics
Vary
Permanent
Which request fields a cache must include in its key for this response.
What it means
A field-name list, or `*` meaning the response is effectively uncacheable by a shared cache (RFC 9110 §12.5.5).
Omitting it after content negotiation is the classic cache poisoning bug: one visitor's language or encoding gets served to the next.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 12.5.5: HTTP Semantics
Via
Permanent
The chain of intermediaries a message passed through.
What it means
Each hop appends its protocol and identifier: `1.1 proxy.example (squid/6.6)` (RFC 9110 §7.6.3).
It is how loops are detected, and it discloses topology, so many proxies use a pseudonym.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
- Forbidden name — fetch() will not set this field
Defined in: RFC 9110, Section 7.6.3: HTTP Semantics
WWW-Authenticate
Permanent
The authentication challenge accompanying a 401.
What it means
One or more challenges, each a scheme plus parameters such as `realm` and `charset` (RFC 9110 §11.6.1).
Sending `Basic` here is what makes a browser show its native login dialog.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: RFC 9110, Section 11.6.1: HTTP Semantics
X-Content-Type-Options
Permanent
`nosniff` — take `Content-Type` literally, do not guess.
What it means
The only defined value is `nosniff` (WHATWG Fetch). It stops MIME sniffing and enforces the script and style type checks.
It is a de-facto field that predates the registry's naming rules, which is why it keeps the `X-` prefix.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: Fetch
X-Forwarded-For
Not in the registry
De-facto client-IP chain added by proxies; never registered with IANA.
What it means
A comma-separated list of addresses, leftmost being the client as the first proxy saw it. It is not in the IANA registry and has no RFC.
RFC 7239's `Forwarded` is the standardised replacement. Trust only the entries added by proxies you control — everything to the left can be forged.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
X-Forwarded-Proto
Not in the registry
De-facto scheme (`http`/`https`) the client used to reach the first proxy.
What it means
Not registered and not specified by any RFC; the standardised equivalent is the `proto` parameter of `Forwarded`.
Applications behind a TLS-terminating proxy read it to decide whether to build https:// URLs — which makes it security-relevant and forgeable if it is not overwritten at the edge.
- Direction
- Request
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
X-Frame-Options
Permanent
Legacy framing control: `DENY` or `SAMEORIGIN`.
What it means
Predates CSP and is defined in the HTML Standard for legacy support. The `ALLOW-FROM` variant was never widely implemented and should not be used.
`Content-Security-Policy: frame-ancestors` supersedes it and wins where both are present in a conforming browser.
- Direction
- Response
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Defined in: HTML
X-Request-ID
Not in the registry
De-facto correlation id threaded through services; no registration, no RFC.
What it means
Widely used by proxies and frameworks to correlate one request across logs. The value format is entirely a local convention.
There is no registered equivalent; W3C Trace Context's `traceparent` covers the standardised tracing case.
- Direction
- Both
- Structured type
- None recorded
“None recorded” means the registry lists no structured type for this field (RFC 9651). It is not a claim that the field's value has no structure.
Registry rows only: for every field without a panel here, the table's facts come straight from the IANA registry and the document in its last column is the authority. This page has no hand-written explanation for those fields yet.
Composed value
Choose a directive and the value appears here.Choose a directive and the value appears here.What this builder covers
These are the directives this builder understands, in the order it writes them. Entries marked below are read and never written into the value. Anything else you pass it is named back to you and left out — the builder never guesses.
publicprivateno-cacheno-storemax-ages-maxagemust-revalidateproxy-revalidatemust-understandno-transformimmutablestale-while-revalidatestale-if-error
No field by that name — here's what that means
Nothing on the page matches. The snapshot holds every name the IANA registry carried on the date printed below, and nothing else — a name it does not carry is not necessarily wrong.
Do it offline:$ curl -sS -o /dev/null -D - https://example.com
How to use it
- Type in the filter. A full name wins outright (content-type finds Content-Type — names are case-insensitive), a partial name narrows to everything starting with it, and ordinary words search summaries and aliases. Press / to jump to the box.
- Open a field. Registry facts — status, defining document, structured type — are shown for every row; the 55 hand-covered fields add what the field means, how repeats combine, and whether an intermediary or fetch() may touch it at all.
- Switch to the builder for one of eleven values. Tick the directives you want: the value updates as you go, and a combination that contradicts the spec draws a warning beneath it rather than a silent repair.
- Copy the bare value, or the whole line as curl, fetch, nginx or Apache. Copy link puts the builder state in the URL fragment; a field row links as an ordinary anchor, /http-headers#h-cache-control.
All 257 registered HTTP field names sit on this page as plain HTML, so find-in-page works before any script runs. Filter by name, by registry status, or in plain words; open a field for its meaning and defining clause; then compose a Cache-Control, CSP, HSTS or CORS value and copy it as a curl, fetch, nginx or Apache line. Nothing is fetched.
How it works
A field name is a token, compared without regard to case (RFC 9110 §5.1). CONTENT-TYPE and content-type name one field, so this page keeps one record per name and treats capitalisation as noise. The alphabet is fixed too: letters, digits and a little punctuation, no spaces, no colons. Anything outside it is not a field name, and the finder says so rather than searching.
What travels is a field line: name, colon, optional whitespace, then the value (RFC 9110 §5.2). A list-valued field may be sent as several lines, which a recipient may join with commas in the order received (§5.3). Set-Cookie is the famous exception — its values are not a list. Line folding, continuing a value on an indented line, is deprecated and may get the message rejected.
Which names officially exist is not a matter of opinion: the IANA HTTP Field Name Registry records them under the process RFC 9110 §16.4 defines, with four standings — permanent, provisional, deprecated, obsoleted. This page ships a script-cut snapshot and keeps the obsoleted rows, because Content-MD5 still turns up in traffic. Unregistered extension fields stay legal (§16.4.1); the registry records claims, not permission.
Newer fields are defined as structured field values (RFC 9651): the value is declared an item, a list or a dictionary, so one grammar serves every parser. The registry carries that declaration in its own column, printed here verbatim. Read a blank carefully — it means the registry records no structured type, not that the field lacks structure. Cache-Control has plenty and no registered type.
Two boundaries decide who may see a field. Hop-by-hop fields mean something on one connection only and must be dropped before forwarding: Connection and whatever it names, plus Transfer-Encoding, TE, Upgrade, Keep-Alive and Proxy-Authenticate (RFC 9110 §7.6.1). The browser draws the second — Fetch stops script setting names like Host, and hides cross-origin response fields outside the CORS safelist. Rows carry both facts.
Examples
cache-controlCache-Control — permanent — request and response — [RFC 9111, Section 5.2: HTTP Caching]An exact match typed in lower case: names are case-insensitive, so one record answers. The row prints the registry's status and reference cells unaltered, the reference linked to its clause.
obsoleted39 obsoleted fields, beginning: Access-Control, C-Ext, C-Man, C-Opt, C-PEP, Content-Base, Content-MD5, Content-Script-TypeA status word selects the whole class, counted from the snapshot rather than typed into prose. Obsoleted rows stay in full: Content-MD5 outlived its spec.
cache for a weekCache-ControlPlain words work too: the phrase is an alias on the Cache-Control record, so a sentence nobody would look up under C still lands.
Link · target=/terms rel=copyright anchor=#foo</terms>; rel="copyright"; anchor="#foo"RFC 8288 §3's printed example, rebuilt and compared byte-for-byte with the line extracted from the RFC text. The angle brackets and the quoting are grammar, not decoration.
Cache-Control · public max-age=604800 immutablepublic, max-age=604800, immutable
add_header Cache-Control "public, max-age=604800, immutable" always;A week of caching for a fingerprinted asset, then the same value as an nginx directive. The always keyword matters: without it, error responses go out with no header attached.
X-My-Headerunknown-nameA well-formed name no entry claims. That is legal — extension fields are how the protocol grows — so you get an explanation and any near-enough registered name, never a blank.
Every example on this page is executed against the same engine that powers the tool, on every build.
Gotchas worth knowing
Repeated fields join with commas — except Set-Cookie
Two Accept-Encoding lines mean what one comma-joined line means (RFC 9110 §5.3). Set-Cookie is excluded: each line is one cookie, and commas appear inside Expires dates. Libraries that expose headers as a plain string map get this wrong often.
Some fields are correct and still invisible to script
Fetch keeps a forbidden list — Host, Cookie, Connection — that fetch() refuses to set, and hides cross-origin response fields until Access-Control-Expose-Headers names them. Affected rows say which applies, sparing a debug session on a header that is arriving fine.
Retry-After takes seconds or a date, never both
RFC 9110 §10.2.3 allows a non-negative integer of seconds or an HTTP-date; the forms are alternatives. The builder emits whichever you fill in and refuses a negative or fractional delay.
Non-ASCII filenames need the filename* form
A plain filename parameter carries ISO-8859-1 only, so an accented name travels percent-encoded in filename* (RFC 6266 §4.3). The builder switches forms itself and says so; §5 shows sending both when very old receivers matter.
preload is not part of the HSTS specification
RFC 6797 defines max-age and includeSubDomains, nothing more. preload signals the browser-maintained list, whose submission rules ask for a year of max-age plus includeSubDomains — rules owned by the list operators, changeable without an RFC.
This page cannot see your site
Nothing here is fetched, from your origin or anyone else's. It cannot tell you which fields your server sends or what a scanner would score: it documents fields and composes values. The curl line below is for observing a real response.
Common errors
No field by that name — here's what that means- The no-match state for a query that is no field name, status word, declared directive or row text. Not a dead end: it says what the snapshot holds, and that an unregistered well-formed name is a legal extension field.
A credentialed request cannot read a response whose Access-Control-Allow-Origin is *. Echo the request's Origin instead, and add Vary: Origin so caches keep the answers apart (WHATWG Fetch, CORS protocol).- Raised when the origin builder holds the wildcard with the credentialed toggle on. The browser performs the check, so the network tab looks healthy while the promise rejects.
no-store tells caches not to store the response at all, so max-age cannot take effect. RFC 9111 §5.2.2.5 — drop one of the two.- The value is emitted as configured, warning underneath — a chosen directive is never deleted behind your back. Private and cacheable is spelled private, max-age=…; not cacheable at all is no-store alone.
preload is not part of RFC 6797: it signals the browser-maintained preload list, whose submission rules require max-age of at least 31536000 (one year) together with includeSubDomains. As written, this header would be rejected by that list.- Shown when preload is ticked without the settings the list requires. Heed it before submitting: removal reaches users at browser-release pace, so an HTTPS-less subdomain becomes a months-long problem.
FAQ
What are HTTP headers?
Name-and-value lines carried alongside a request or response, describing the message rather than being its body: what the content is, how long it may be cached, what the browser may load. RFC 9110 §5 defines the syntax.
Are HTTP header names case-sensitive?
No. RFC 9110 §5.1 makes them case-insensitive tokens, so Content-Type and content-type are one field. HTTP/2 and HTTP/3 go further, requiring lower-case names on the wire — which is why a proxy log can look unlike the code behind it.
Can I invent my own header, and should it start with X-?
Invent it freely — unregistered extension fields are legal (RFC 9110 §16.4.1). Skip the X- prefix: RFC 6648 deprecated it in 2012, because a field that succeeds must drop the prefix and both spellings then live on. Pick a name you can keep.
What is the difference between no-cache and no-store?
no-cache permits storage but demands revalidation before a stored copy is reused. no-store forbids keeping the response at all. For a page that must always be fresh, no-cache is usually right; no-store is for content that must not sit on disk.
Why is my Access-Control-Allow-Origin: * being ignored?
Because the request carried credentials. Fetch refuses the wildcard when cookies or client certificates are in play, so the response is fetched and then withheld from your code. Echo the request's Origin value and send Vary: Origin with it.
Which headers does this page's builder cover?
Eleven values: Cache-Control, Content-Security-Policy, Strict-Transport-Security, the three Access-Control-Allow-* fields, Content-Type, Retry-After, Link, Permissions-Policy and Content-Disposition. Each prints its declared directive list; anything outside it is reported, never guessed at.
Can this tool check the headers my website sends?
No, and it never will from here: no request leaves your browser, so there is nothing to inspect and no grade to award. Run the curl line below against your own host to read the fields back.
Keyboard shortcuts
- /
- Focus the filter box
- ⌘/Ctrl + Enter
- Copy the composed value