Look up common HTTP request and response headers in a searchable directory — filter by direction and category, read a one-line description and a realistic example, and copy any header name with one click. In your browser, free.

Every common HTTP request and response header, explained with a real-world example. Everything runs in your browser from a built-in reference — nothing is sent to the server.

Direction
Header Direction Category Description Example
No header matches your filters.
Try a different name or category — for example Authorization, Set-Cookie or CORS.

About HTTP Headers Reference

The HTTP Headers Reference is a searchable directory of the request and response headers you actually meet in real traffic. Each entry names the header, states in one line what it does, and shows a realistic example value — Cache-Control: max-age=3600 rather than an abstract placeholder — so you can lift working syntax straight into your code or config.

The list slices two ways at once: by direction, separating request headers, response headers and those that travel both ways, and by category — General, Authentication, Caching, Conditionals, Connection, Content, CORS, Cookies, Security, Range, Proxies and WebSockets. That makes it as quick to answer “which headers control caching?” as “what does this header in my DevTools trace mean?”.

Header names and example values each copy to the clipboard in one click, and everything runs in your browser from a built-in table — nothing you search for is sent anywhere.

How to use HTTP Headers Reference

  1. Search for a header by name, meaning or example value — for example Cache-Control, cookie or bearer.
  2. Use the direction filter to limit results to request headers, response headers or both.
  3. Pick a category chip — such as Caching, CORS or Security — to browse one concern at a time.
  4. Read the one-line description and the realistic example value for each header.
  5. Click to copy the header name or the example value into your code or configuration.

Frequently asked questions

Request headers travel from client to server and describe the request or the client — Accept, Authorization, User-Agent. Response headers travel back and describe the response or the server — Content-Type, Set-Cookie, Cache-Control. Some, like Content-Length, legitimately appear in both directions.

No. The standard defines header names as case-insensitive, so content-type and Content-Type are identical. HTTP/2 and HTTP/3 even transmit them lowercase on the wire. Header values, however, can be case-sensitive depending on the header.

The Security category collects them: Strict-Transport-Security forces HTTPS, Content-Security-Policy restricts what a page may load, X-Content-Type-Options stops MIME sniffing, and X-Frame-Options (or CSP frame-ancestors) blocks clickjacking. They are response headers your server should send on every page.

Cross-Origin Resource Sharing headers let a server declare which other origins may read its responses from browser JavaScript. Access-Control-Allow-Origin is the core one; its companions govern allowed methods, headers, credentials and how long browsers may cache the permission.

Yes — HTTP allows arbitrary headers, and applications commonly add their own for request IDs or API versions. The historical X- prefix convention has been deprecated, so modern guidance is to pick a meaningful unprefixed name instead.

Yes. It is a free, built-in reference that loads with the page; search and filtering run locally in your browser with no server requests.

Need help?
Found an issue with this tool? Let our team know.
Report an issue

Add this free tool to your own website — copy and paste the code below.