HTTP Headers List

Common request & response HTTP headers, explained.

A searchable reference of common HTTP headers — request and response — like Content-Type, Authorization, Cache-Control, Set-Cookie, the Access-Control-* CORS headers and security headers such as Content-Security-Policy. Each shows whether it's a request or response header, a plain-English description and its category. Filter and tap to copy. Runs fully in your browser — no API.

How to use HTTP Headers List

  1. Open the list

    Launch this free HTTP headers reference to look up request and response headers in one searchable table.

  2. Search a header

    Type a header like Content-Type or a topic like 'cors' or 'cache' to filter instantly.

  3. Filter by category

    Use the category filter to focus on caching, CORS, authentication, cookies or security headers.

  4. Read the meaning

    Each row shows the header, whether it's request/response, and a clear description.

  5. Copy a header

    Tap any header name to copy it for your code, API client or server config.

  6. Debug requests

    Match a header you see in DevTools or a response against this list to understand what it controls.

Frequently asked questions

What are HTTP headers?

HTTP headers are key-value pairs sent with every HTTP request and response. They carry metadata — the content type, caching rules, authentication, cookies, CORS permissions, security policies and more — that tells the browser and server how to handle the message.

What is the difference between request and response headers?

Request headers are sent by the client (like Host, User-Agent, Authorization, Accept), while response headers are sent by the server (like Content-Type, Set-Cookie, Cache-Control, Location). Some headers can appear in both. This list marks the direction of each.

What does the Content-Type header do?

Content-Type tells the recipient the media type (MIME type) of the body — for example application/json, text/html or image/png — so it knows how to parse or display it. It's one of the most important headers for APIs and web pages.

What are CORS headers?

CORS (Cross-Origin Resource Sharing) headers like Access-Control-Allow-Origin, Access-Control-Allow-Methods and Access-Control-Allow-Headers tell the browser whether a page from one origin is allowed to read a response from another origin. They're set by the server to permit cross-origin requests.

Is this HTTP headers reference free?

Yes — it's completely free with no sign-up. The list runs in your browser from a built-in dataset, so there are no limits, no API keys and nothing is uploaded.

What is the difference between an HTTP header and a MIME type?

An HTTP header is a metadata field sent with a request or response; a MIME type is a value that some headers carry. For example, the Content-Type header's value is a MIME type like application/json. The header is the container, the MIME type is one kind of content.

What are common security headers?

Key security response headers include Content-Security-Policy (limits what resources load), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options, X-Frame-Options (clickjacking protection) and Referrer-Policy. Filter this list by the security category to see them explained.

Related tools — Reference · Codes & Web