HTTP headers are a key part of the protocol. They convey request and response metadata, including content type, caching, authentication, and security settings. Understanding headers is essential for debugging APIs, configuring performance, and ensuring security.
You can get a complete analysis of your website’s headers with HTTP Headers Analyzer and Security Headers on rechecker.ru.
HTTP request and response structure
GET /api/users HTTP/1.1
Host: example.com
Accept: application/json
User-Agent: MyApp/1.0
Authorization: Bearer <token>
---
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: max-age=3600
Content-Length: 1234Headers follow the first line (the request/status line), with one header per line in the format Name: Value.
Request headers
Required and commonly used
| Header | Description | Example |
|---|---|---|
| Host | Domain and port of the target server | Host: example.com |
| User-Agent | Client identifier | User-Agent: Mozilla/5.0... |
| Accept | Preferred content types | Accept: application/json |
| Accept-Language | Preferred languages | Accept-Language: ru-RU,ru;q=0.9 |
| Accept-Encoding | Supported compression methods | Accept-Encoding: gzip, br |
| Authorization | Credentials | Authorization: Bearer <token> |
| Content-Type | Request body type | Content-Type: application/json |
| Content-Length | Body size in bytes | Content-Length: 256 |
Specialized
| Header | Purpose |
|---|---|
| Cookie | Send cookies |
| Referer | URL of the source page |
| Origin | Origin for CORS |
| If-None-Match | Conditional request (ETag) |
| If-Modified-Since | Conditional request (date) |
Response headers
Content and encoding
| Header | Description | Example |
|---|---|---|
| Content-Type | MIME type and encoding | Content-Type: text/html; charset=utf-8 |
| Content-Length | Body size | Content-Length: 4096 |
| Content-Encoding | Compression | Content-Encoding: gzip |
| Content-Disposition | Filename when downloading | Content-Disposition: attachment; filename="file.pdf" |
Caching
For more on caching, see Cache-Control, ETag, Expires: managing caching with headers.
| Header | Description |
|---|---|
| Cache-Control | Caching directives (max-age, no-cache, no-store) |
| ETag | Content hash for validation |
| Expires | Cache expiration date (superseded by Cache-Control) |
| Last-Modified | Date of last modification |
| Vary | Headers that affect response variant selection |
Security
| Header | Purpose |
|---|---|
| Strict-Transport-Security | HSTS — enforce HTTPS |
| Content-Security-Policy | CSP — control content sources |
| X-Frame-Options | Protection against clickjacking |
| X-Content-Type-Options | Disable MIME sniffing |
| Referrer-Policy | Control Referer transmission |
| Permissions-Policy | Restrict browser APIs |
CORS
| Header | Description |
|---|---|
| Access-Control-Allow-Origin | Allowed origins |
| Access-Control-Allow-Methods | Allowed HTTP methods |
| Access-Control-Allow-Headers | Allowed request headers |
| Access-Control-Max-Age | Preflight caching |
Cache-Control: key directives
Cache-Control: public, max-age=3600, s-maxage=86400, stale-while-revalidate=600| Directive | Value | Description |
|---|---|---|
| public | — | Can be cached by a CDN and the browser |
| private | — | Only in the user's browser |
| max-age | seconds | Cache lifetime |
| s-maxage | seconds | Lifetime in a shared cache (CDN) |
| no-cache | — | Must be validated before use |
| no-store | — | Do not cache at all |
| stale-while-revalidate | seconds | Serve stale content while it is being refreshed |
Content-Type: common MIME types
| Type | MIME | Extension |
|---|---|---|
| HTML | text/html | .html |
| JSON | application/json | .json |
| XML | application/xml | .xml |
| JavaScript | application/javascript | .js |
| CSS | text/css | .css |
| PNG | image/png | .png |
| JPEG | image/jpeg | .jpg, .jpeg |
| application/pdf | ||
| Form data | application/x-www-form-urlencoded | — |
| Multipart | multipart/form-data | — |
Practical recommendations
For static resources
Cache-Control: public, max-age=31536000, immutableUse long-lived caching for files with a hash in the filename (for example, main.a1b2c3.js).
For HTML pages
Cache-Control: no-cacheOr use a short max-age with validation through ETag.
For APIs
Cache-Control: private, no-storeFor personal data. For public read-only APIs, use max-age with a reasonable value.
Security by default
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Referrer-Policy: strict-origin-when-cross-originDebugging headers
curl -I https://example.comOr in your browser: DevTools → Network → select a request → Headers.
Online tool: HTTP Headers — a complete analysis of response headers with explanations.