Reference
Look up common HTTP request and response headers.
Runs entirely in your browser
Nothing you paste is uploaded. Monaco and Prettier load on demand from this origin.
Search
| Header | Direction | Purpose |
|---|---|---|
| Accept | Request | Media types the client can process. |
| Authorization | Request | Credentials for authentication. |
| Cache-Control | Both | Caching directives (max-age, no-store). |
| Content-Type | Both | Media type of the body. |
| Cookie | Request | Cookies sent to the server. |
| ETag | Response | Version identifier for a resource. |
| Location | Response | Redirect / created resource URL. |
| Set-Cookie | Response | Sets a cookie on the client. |
| Strict-Transport-Security | Response | Force HTTPS (HSTS). |
| User-Agent | Request | Client software identity. |
| X-Forwarded-For | Request | Originating client IP via proxies. |
| Access-Control-Allow-Origin | Response | CORS allowed origin. |
| Content-Security-Policy | Response | Restricts resource loading. |
| Retry-After | Response | When to retry after 429/503. |
There is no upload endpoint — your files are processed in this browser tab. Open your network tab and check. See how it stays private.
How to HTTP headers
- Search a header. Type a header name or keyword.
- Read its role. See its purpose and typical values.
- Use it. Apply the right header in your requests or responses.
Headers carry the metadata that makes HTTP work — content type, caching, auth, CORS. Knowing which header does what turns vague bugs (a resource won't cache, a request is blocked) into quick fixes.
For security-specific headers with recommended values, use the security header builder; to inspect live responses, use the HTTP client.
Frequently asked questions
What does Cache-Control do?
It tells browsers and CDNs how long and under what conditions to cache a response — directives like max-age, no-store, and private control caching behavior precisely.
Which headers matter for CORS?
The Access-Control-Allow-* family on responses, plus Origin on requests, govern cross-origin access. The reference explains each one's role.
Is anything fetched?
No. The reference is built in, so it works offline.