What is an HTTP header?

An HTTP header is a name and value sent with every HTTP request or response, carrying information about the message itself, such as its content type, how long to cache it or where to redirect.

The start of a response:

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Cache-Control: max-age=3600
Strict-Transport-Security: max-age=31536000

Kinds

What headers are used for.

Content

Content-Type, Content-Length and Content-Encoding describe the body.

Caching

Cache-Control, ETag and Expires tell browsers and CDNs how long to reuse a response.

Redirects

Location names the new address in a 301 or 302 response.

Security

Strict-Transport-Security, Content-Security-Policy and others instruct the browser to protect the visitor.

Identification

User-Agent says what is making the request, Server what answered it.

Cookies and auth

Set-Cookie, Cookie and Authorization carry session and identity.

In practice

Headers are invisible, so check them.

Headers don't appear in the page, so mistakes in them go unnoticed. A missing Cache-Control makes a CDN guess, a wrong Content-Type makes a file download instead of displaying, and a missing security header leaves a protection off. The HTTP header checker shows what a server really sends.

FAQ

Common questions

What is the difference between request and response headers? +

Request headers are sent by the browser, such as User-Agent and Accept. Response headers are sent by the server, such as Content-Type and Set-Cookie.

Are header names case-sensitive? +

No. Content-Type and content-type are the same header. Values may be case-sensitive.

Can I see headers in my browser? +

Yes, in the developer tools' Network panel. The header checker shows them for any URL without opening developer tools.

Which headers matter for security? +

HSTS, Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and a framing rule. The security headers checker grades them.