HTTP Header Reference

Quick reference for common HTTP request and response headers with descriptions and examples. Free online utility — your data never leaves the browser.

) appear in both directions with different meanings." }} />

Security Headers Worth Setting

— current default for most authenticated HTML. Misconfiguring this is the #1 cause of 'why am I seeing old content' bugs." }} />

More Frequently Asked Questions

Are header names case-sensitive?

No — HTTP/1.1 header names are case-insensitive. HTTP/2 lowercases them on the wire.

Which headers are required?

For HTTP/1.1 requests,

.

What is X-Powered-By?

An informational header revealing the backend tech (PHP, Express). Best practice is to remove it — it tells attackers what to target.

How do I see headers?

Browser DevTools → Network tab → click a request → Headers panel. Or use

.

Are custom X- headers still recommended?

RFC 6648 deprecated the X- prefix in 2012. Just use a plain name — most APIs do.