Web Development Reference
HTTP Headers Reference
An HTTP header is a name-value pair carried alongside a request or response that describes it — what format the body is in, how long it may be cached, which origins may read it, and who is asking. This reference lists the headers you will actually meet, with a real value for each.
Browse by Category
General
7Headers that apply to requests and responses alike.
Request Headers
26What the client tells the server about itself.
Response Headers
15What the server tells the client about the response.
Representation
9Describing the body: type, length, encoding, language.
Caching & Conditionals
12How long a response may be reused, and revalidation.
CORS
9Cross-origin access control, preflight and credentials.
Security
14Headers that harden the browser against attacks.
Cookies & Auth
11Setting credentials and carrying them back.
All HTTP Headers (103)
General (7)
Headers that apply to requests and responses alike.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Connection | Both | Whether the TCP connection stays open for further messages. Removed in HTTP/2 and HTTP/3, which multiplex over one connection. | keep-alive |
Date | Both | When the message was generated, in GMT. Used to calculate the age of a cached response. | Tue, 09 Jun 2026 08:14:00 GMT |
Via | Both | Records each proxy the message passed through, which is how a loop through caches gets detected. | 1.1 varnish, 1.1 cloudfront |
Upgrade | Both | Asks to switch this connection to another protocol — the mechanism behind the WebSocket handshake. | websocket |
Trailer | Both | Names headers that will appear after a chunked body, for values only known once the body is written. | Expires |
Transfer-Encoding | Response | How the body was encoded for transfer. chunked streams a body whose length is not known up front. | chunked |
Keep-Alive | Both | Tunes how long an idle connection is held open and how many requests it may serve. | timeout=5, max=100 |
Direction
Both
What it controls
Whether the TCP connection stays open for further messages. Removed in HTTP/2 and HTTP/3, which multiplex over one connection.
Typical value
keep-alive
Direction
Both
What it controls
When the message was generated, in GMT. Used to calculate the age of a cached response.
Typical value
Tue, 09 Jun 2026 08:14:00 GMT
Direction
Both
What it controls
Records each proxy the message passed through, which is how a loop through caches gets detected.
Typical value
1.1 varnish, 1.1 cloudfront
Direction
Both
What it controls
Asks to switch this connection to another protocol — the mechanism behind the WebSocket handshake.
Typical value
websocket
Direction
Both
What it controls
Names headers that will appear after a chunked body, for values only known once the body is written.
Typical value
Expires
Direction
Response
What it controls
How the body was encoded for transfer. chunked streams a body whose length is not known up front.
Typical value
chunked
Direction
Both
What it controls
Tunes how long an idle connection is held open and how many requests it may serve.
Typical value
timeout=5, max=100
Request Headers (26)
What the client tells the server about itself.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Host | Request | Which hostname the request is for. Mandatory in HTTP/1.1 — it is what lets one IP serve many sites. | example.com |
User-Agent | Request | Identifies the client software. Widely spoofed and increasingly frozen by browsers, so do not depend on it for logic. | Mozilla/5.0 (Macintosh; …) |
Accept | Request | Which media types the client can handle, with optional q weights so the server can pick the best. | application/json, text/html;q=0.9 |
Accept-Encoding | Request | Which compression schemes the client understands. Sending this is what enables gzip and brotli. | br, gzip, deflate |
Accept-Language | Request | Preferred human languages, weighted. The basis of server-side locale negotiation. | en-GB, en;q=0.9, ta;q=0.8 |
Referer | Request | The page that linked here. Misspelled in the original specification and never corrected. Trimmed by Referrer-Policy. | https://example.com/blog |
Range | Request | Asks for part of a resource. What makes video seeking and resumable downloads work. | bytes=0-1023 |
If-Modified-Since | Request | Revalidates a cached copy by date — the server answers 304 if nothing changed since. | Tue, 09 Jun 2026 08:14:00 GMT |
If-None-Match | Request | Revalidates by ETag. More precise than a date, and what browsers send when they hold an ETag. | W/"a1b2c3d4" |
If-Match | Request | Applies a write only if the resource still matches this ETag — optimistic locking for APIs. | "a1b2c3d4" |
If-Unmodified-Since | Request | Applies a write only if the resource has not changed since this time. | Tue, 09 Jun 2026 08:14:00 GMT |
Expect | Request | Asks the server to confirm before the body is sent. Avoids uploading a large body that will be rejected. | 100-continue |
From | Request | An email address for whoever runs the client. Used by well-behaved crawlers. | [email protected] |
Max-Forwards | Request | Caps how many proxies a TRACE or OPTIONS request may traverse. | 10 |
TE | Request | Which transfer encodings the client accepts, and whether it will read trailers. | trailers, deflate |
X-Requested-With | Request | A convention, not a standard, that frameworks set on XHR so servers can tell AJAX from a page load. | XMLHttpRequest |
X-Forwarded-For | Request | The original client IP, appended by each proxy. Trust it only from proxies you control — clients can forge it. | 203.0.113.7, 70.41.3.18 |
X-Forwarded-Proto | Request | The scheme the client used before the proxy. How an app behind a TLS-terminating load balancer knows it is on HTTPS. | https |
X-Forwarded-Host | Request | The Host the client originally asked for, preserved across a proxy that rewrites it. | example.com |
Forwarded | Request | The standardised replacement for the X-Forwarded-* family, carrying all of it in one header. | for=203.0.113.7;proto=https |
DNT | Request | Do Not Track. Effectively dead — never widely honoured and now removed from most browsers. | 1 |
Save-Data | Request | The user has asked for reduced data use. A cue to serve smaller images and skip prefetching. | on |
Sec-Fetch-Site | Request | Browser-set metadata saying whether the request is same-origin, same-site or cross-site. Cannot be forged by script. | same-origin |
Sec-Fetch-Mode | Request | Browser-set: how the request was initiated — navigate, cors, no-cors or same-origin. | cors |
Sec-Fetch-Dest | Request | Browser-set: what the result will be used for — document, script, image and so on. Useful for blocking odd combinations. | script |
Sec-CH-UA | Request | A client hint carrying browser brand and version, the structured replacement for parsing User-Agent. | "Chromium";v="120" |
Direction
Request
What it controls
Which hostname the request is for. Mandatory in HTTP/1.1 — it is what lets one IP serve many sites.
Typical value
example.com
Direction
Request
What it controls
Identifies the client software. Widely spoofed and increasingly frozen by browsers, so do not depend on it for logic.
Typical value
Mozilla/5.0 (Macintosh; …)
Direction
Request
What it controls
Which media types the client can handle, with optional q weights so the server can pick the best.
Typical value
application/json, text/html;q=0.9
Direction
Request
What it controls
Which compression schemes the client understands. Sending this is what enables gzip and brotli.
Typical value
br, gzip, deflate
Direction
Request
What it controls
Preferred human languages, weighted. The basis of server-side locale negotiation.
Typical value
en-GB, en;q=0.9, ta;q=0.8
Direction
Request
What it controls
The page that linked here. Misspelled in the original specification and never corrected. Trimmed by Referrer-Policy.
Typical value
https://example.com/blog
Direction
Request
What it controls
Asks for part of a resource. What makes video seeking and resumable downloads work.
Typical value
bytes=0-1023
Direction
Request
What it controls
Revalidates a cached copy by date — the server answers 304 if nothing changed since.
Typical value
Tue, 09 Jun 2026 08:14:00 GMT
Direction
Request
What it controls
Revalidates by ETag. More precise than a date, and what browsers send when they hold an ETag.
Typical value
W/"a1b2c3d4"
Direction
Request
What it controls
Applies a write only if the resource still matches this ETag — optimistic locking for APIs.
Typical value
"a1b2c3d4"
Direction
Request
What it controls
Applies a write only if the resource has not changed since this time.
Typical value
Tue, 09 Jun 2026 08:14:00 GMT
Direction
Request
What it controls
Asks the server to confirm before the body is sent. Avoids uploading a large body that will be rejected.
Typical value
100-continue
Direction
Request
What it controls
An email address for whoever runs the client. Used by well-behaved crawlers.
Typical value
Direction
Request
What it controls
Caps how many proxies a TRACE or OPTIONS request may traverse.
Typical value
10
Direction
Request
What it controls
Which transfer encodings the client accepts, and whether it will read trailers.
Typical value
trailers, deflate
Direction
Request
What it controls
A convention, not a standard, that frameworks set on XHR so servers can tell AJAX from a page load.
Typical value
XMLHttpRequest
Direction
Request
What it controls
The original client IP, appended by each proxy. Trust it only from proxies you control — clients can forge it.
Typical value
203.0.113.7, 70.41.3.18
Direction
Request
What it controls
The scheme the client used before the proxy. How an app behind a TLS-terminating load balancer knows it is on HTTPS.
Typical value
https
Direction
Request
What it controls
The Host the client originally asked for, preserved across a proxy that rewrites it.
Typical value
example.com
Direction
Request
What it controls
The standardised replacement for the X-Forwarded-* family, carrying all of it in one header.
Typical value
for=203.0.113.7;proto=https
Direction
Request
What it controls
Do Not Track. Effectively dead — never widely honoured and now removed from most browsers.
Typical value
1
Direction
Request
What it controls
The user has asked for reduced data use. A cue to serve smaller images and skip prefetching.
Typical value
on
Direction
Request
What it controls
Browser-set metadata saying whether the request is same-origin, same-site or cross-site. Cannot be forged by script.
Typical value
same-origin
Direction
Request
What it controls
Browser-set: how the request was initiated — navigate, cors, no-cors or same-origin.
Typical value
cors
Direction
Request
What it controls
Browser-set: what the result will be used for — document, script, image and so on. Useful for blocking odd combinations.
Typical value
script
Direction
Request
What it controls
A client hint carrying browser brand and version, the structured replacement for parsing User-Agent.
Typical value
"Chromium";v="120"
Response Headers (15)
What the server tells the client about the response.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Server | Response | Identifies the server software. Often trimmed deliberately, since a version number is a gift to an attacker. | nginx |
Location | Response | Where to go next. Meaningful on a 3xx redirect and on a 201 pointing at the resource just created. | /login?next=/dashboard |
Retry-After | Response | How long to wait before retrying, as seconds or a date. Sent with 429 and 503 — clients should honour it. | 120 |
Allow | Response | Which methods the resource supports. Required on a 405 response. | GET, POST, HEAD |
Accept-Ranges | Response | Advertises that range requests are supported, which is what enables resumable downloads. | bytes |
Content-Range | Response | Which part of the resource this 206 response contains, and its total size. | bytes 0-1023/146515 |
Vary | Response | Which request headers change the response, so caches key on them too. Omitting it is how users get served the wrong language or the wrong compression. | Accept-Encoding, Accept-Language |
Link | Response | Relationships expressed in a header rather than markup — pagination, preload hints and canonical URLs for non-HTML resources. | </next>; rel="next" |
X-RateLimit-Limit | Response | A convention, not a standard: how many requests are allowed in the current window. | 1000 |
X-RateLimit-Remaining | Response | How many requests remain in this window. Paired with X-RateLimit-Reset for the reset time. | 947 |
Timing-Allow-Origin | Response | Lets a named origin read detailed Resource Timing data for this resource, which is otherwise hidden cross-origin. | * |
Server-Timing | Response | Server-side timing metrics surfaced in browser devtools, for attributing latency to a backend phase. | db;dur=53, app;dur=47.2 |
Alt-Svc | Response | Advertises the same service on another protocol or port — how a browser discovers HTTP/3. | h3=":443"; ma=86400 |
Age | Response | How many seconds ago a cache stored this response. A large value on a fresh page means a cache is holding it. | 3600 |
Refresh | Response | A non-standard redirect after a delay, mirroring the meta refresh tag. Prefer a real 3xx. | 5; url=/dashboard |
Direction
Response
What it controls
Identifies the server software. Often trimmed deliberately, since a version number is a gift to an attacker.
Typical value
nginx
Direction
Response
What it controls
Where to go next. Meaningful on a 3xx redirect and on a 201 pointing at the resource just created.
Typical value
/login?next=/dashboard
Direction
Response
What it controls
How long to wait before retrying, as seconds or a date. Sent with 429 and 503 — clients should honour it.
Typical value
120
Direction
Response
What it controls
Which methods the resource supports. Required on a 405 response.
Typical value
GET, POST, HEAD
Direction
Response
What it controls
Advertises that range requests are supported, which is what enables resumable downloads.
Typical value
bytes
Direction
Response
What it controls
Which part of the resource this 206 response contains, and its total size.
Typical value
bytes 0-1023/146515
Direction
Response
What it controls
Which request headers change the response, so caches key on them too. Omitting it is how users get served the wrong language or the wrong compression.
Typical value
Accept-Encoding, Accept-Language
Direction
Response
What it controls
Relationships expressed in a header rather than markup — pagination, preload hints and canonical URLs for non-HTML resources.
Typical value
</next>; rel="next"
Direction
Response
What it controls
A convention, not a standard: how many requests are allowed in the current window.
Typical value
1000
Direction
Response
What it controls
How many requests remain in this window. Paired with X-RateLimit-Reset for the reset time.
Typical value
947
Direction
Response
What it controls
Lets a named origin read detailed Resource Timing data for this resource, which is otherwise hidden cross-origin.
Typical value
*
Direction
Response
What it controls
Server-side timing metrics surfaced in browser devtools, for attributing latency to a backend phase.
Typical value
db;dur=53, app;dur=47.2
Direction
Response
What it controls
Advertises the same service on another protocol or port — how a browser discovers HTTP/3.
Typical value
h3=":443"; ma=86400
Direction
Response
What it controls
How many seconds ago a cache stored this response. A large value on a fresh page means a cache is holding it.
Typical value
3600
Direction
Response
What it controls
A non-standard redirect after a delay, mirroring the meta refresh tag. Prefer a real 3xx.
Typical value
5; url=/dashboard
Representation (9)
Describing the body: type, length, encoding, language.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Content-Type | Both | What the body actually is. Getting it wrong makes browsers download files they should render, or block scripts entirely. | application/json; charset=utf-8 |
Content-Length | Both | Body size in bytes. Omitted when Transfer-Encoding: chunked is used, since the length is not known in advance. | 146515 |
Content-Encoding | Response | Which compression was applied to the body. The client must reverse it before parsing. | br |
Content-Language | Response | The human language of the body. Distinct from Content-Type, which describes the format. | en-GB |
Content-Disposition | Response | Whether to display the body inline or download it, and under what filename. | attachment; filename="report.pdf" |
Content-Location | Response | The direct URL of this particular representation, when the requested URL negotiates between several. | /report.en.pdf |
Content-MD5 | Response | A checksum of the body. Deprecated — it guards against corruption, not tampering. | Q2hlY2sgSW50ZWdyaXR5IQ== |
Last-Modified | Response | When the resource last changed. One-second resolution, so an ETag is more reliable for fast-changing content. | Tue, 09 Jun 2026 08:14:00 GMT |
ETag | Response | An opaque token identifying this version. A leading W/ marks it weak, meaning semantically rather than byte-for-byte equal. | W/"a1b2c3d4" |
Direction
Both
What it controls
What the body actually is. Getting it wrong makes browsers download files they should render, or block scripts entirely.
Typical value
application/json; charset=utf-8
Direction
Both
What it controls
Body size in bytes. Omitted when Transfer-Encoding: chunked is used, since the length is not known in advance.
Typical value
146515
Direction
Response
What it controls
Which compression was applied to the body. The client must reverse it before parsing.
Typical value
br
Direction
Response
What it controls
The human language of the body. Distinct from Content-Type, which describes the format.
Typical value
en-GB
Direction
Response
What it controls
Whether to display the body inline or download it, and under what filename.
Typical value
attachment; filename="report.pdf"
Direction
Response
What it controls
The direct URL of this particular representation, when the requested URL negotiates between several.
Typical value
/report.en.pdf
Direction
Response
What it controls
A checksum of the body. Deprecated — it guards against corruption, not tampering.
Typical value
Q2hlY2sgSW50ZWdyaXR5IQ==
Direction
Response
What it controls
When the resource last changed. One-second resolution, so an ETag is more reliable for fast-changing content.
Typical value
Tue, 09 Jun 2026 08:14:00 GMT
Direction
Response
What it controls
An opaque token identifying this version. A leading W/ marks it weak, meaning semantically rather than byte-for-byte equal.
Typical value
W/"a1b2c3d4"
Caching & Conditionals (12)
How long a response may be reused, and revalidation.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Cache-Control | Both | The primary caching control. On a response it says who may store it and for how long; on a request it can force revalidation. | public, max-age=31536000, immutable |
Cache-Control: no-store | Response | Must not be written to any cache. The correct directive for anything private — stronger than no-cache despite the name. | no-store |
Cache-Control: no-cache | Response | May be stored, but must be revalidated with the server before reuse. Unchanged content still saves bandwidth via a 304. | no-cache |
Cache-Control: max-age | Both | How many seconds the response stays fresh. After that it must be revalidated. | max-age=3600 |
Cache-Control: s-maxage | Response | Freshness for shared caches such as a CDN only, overriding max-age there. Lets a CDN hold longer than a browser. | s-maxage=86400 |
Cache-Control: stale-while-revalidate | Response | Serve the stale copy immediately while refreshing in the background — no user waits for the revalidation. | max-age=60, stale-while-revalidate=600 |
Cache-Control: immutable | Response | The body will never change at this URL, so skip revalidation entirely. Safe only with content-hashed filenames. | max-age=31536000, immutable |
Cache-Control: private | Response | Only the end user's browser may cache it — shared caches and CDNs must not. | private, max-age=600 |
Cache-Control: must-revalidate | Response | Once stale, the cache may not serve it without checking, even if the origin is unreachable. | max-age=0, must-revalidate |
Expires | Response | An absolute expiry date. Superseded by Cache-Control max-age, which wins wherever both are present. | Tue, 09 Jun 2026 08:14:00 GMT |
Pragma | Request | An HTTP/1.0 relic; only no-cache is defined. Present for legacy proxies, harmless to omit. | no-cache |
Surrogate-Control | Response | Caching directives aimed at a CDN specifically, which strips the header before the browser sees it. | max-age=3600 |
Direction
Both
What it controls
The primary caching control. On a response it says who may store it and for how long; on a request it can force revalidation.
Typical value
public, max-age=31536000, immutable
Direction
Response
What it controls
Must not be written to any cache. The correct directive for anything private — stronger than no-cache despite the name.
Typical value
no-store
Direction
Response
What it controls
May be stored, but must be revalidated with the server before reuse. Unchanged content still saves bandwidth via a 304.
Typical value
no-cache
Direction
Both
What it controls
How many seconds the response stays fresh. After that it must be revalidated.
Typical value
max-age=3600
Direction
Response
What it controls
Freshness for shared caches such as a CDN only, overriding max-age there. Lets a CDN hold longer than a browser.
Typical value
s-maxage=86400
Direction
Response
What it controls
Serve the stale copy immediately while refreshing in the background — no user waits for the revalidation.
Typical value
max-age=60, stale-while-revalidate=600
Direction
Response
What it controls
The body will never change at this URL, so skip revalidation entirely. Safe only with content-hashed filenames.
Typical value
max-age=31536000, immutable
Direction
Response
What it controls
Only the end user's browser may cache it — shared caches and CDNs must not.
Typical value
private, max-age=600
Direction
Response
What it controls
Once stale, the cache may not serve it without checking, even if the origin is unreachable.
Typical value
max-age=0, must-revalidate
Direction
Response
What it controls
An absolute expiry date. Superseded by Cache-Control max-age, which wins wherever both are present.
Typical value
Tue, 09 Jun 2026 08:14:00 GMT
Direction
Request
What it controls
An HTTP/1.0 relic; only no-cache is defined. Present for legacy proxies, harmless to omit.
Typical value
no-cache
Direction
Response
What it controls
Caching directives aimed at a CDN specifically, which strips the header before the browser sees it.
Typical value
max-age=3600
CORS (9)
Cross-origin access control, preflight and credentials.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Origin | Request | The scheme, host and port the request came from. Set by the browser and not forgeable by page script. | https://app.example.com |
Access-Control-Allow-Origin | Response | Which origin may read the response. Either one exact origin or *, never a list — echo the request Origin to allow several. | https://app.example.com |
Access-Control-Allow-Methods | Response | Which methods are permitted cross-origin. Answered on the preflight, not the real request. | GET, POST, PUT, DELETE |
Access-Control-Allow-Headers | Response | Which request headers the client may set. Any custom header triggers a preflight that must list it here. | Content-Type, Authorization |
Access-Control-Allow-Credentials | Response | Permits cookies and auth headers cross-origin. Incompatible with a wildcard origin — the origin must be named. | true |
Access-Control-Expose-Headers | Response | Which response headers page script may read. Without it, only a short safelist is visible to fetch(). | X-Total-Count, Link |
Access-Control-Max-Age | Response | How long a preflight result may be cached, so repeated calls skip the extra round trip. | 86400 |
Access-Control-Request-Method | Request | Sent on a preflight to ask whether this method would be allowed. | DELETE |
Access-Control-Request-Headers | Request | Sent on a preflight to ask whether these headers would be allowed. | authorization, content-type |
Direction
Request
What it controls
The scheme, host and port the request came from. Set by the browser and not forgeable by page script.
Typical value
https://app.example.com
Direction
Response
What it controls
Which origin may read the response. Either one exact origin or *, never a list — echo the request Origin to allow several.
Typical value
https://app.example.com
Direction
Response
What it controls
Which methods are permitted cross-origin. Answered on the preflight, not the real request.
Typical value
GET, POST, PUT, DELETE
Direction
Response
What it controls
Which request headers the client may set. Any custom header triggers a preflight that must list it here.
Typical value
Content-Type, Authorization
Direction
Response
What it controls
Permits cookies and auth headers cross-origin. Incompatible with a wildcard origin — the origin must be named.
Typical value
true
Direction
Response
What it controls
Which response headers page script may read. Without it, only a short safelist is visible to fetch().
Typical value
X-Total-Count, Link
Direction
Response
What it controls
How long a preflight result may be cached, so repeated calls skip the extra round trip.
Typical value
86400
Direction
Request
What it controls
Sent on a preflight to ask whether this method would be allowed.
Typical value
DELETE
Direction
Request
What it controls
Sent on a preflight to ask whether these headers would be allowed.
Typical value
authorization, content-type
Security (14)
Headers that harden the browser against attacks.
| Header | Direction | What it controls | Typical value |
|---|---|---|---|
Strict-Transport-Security | Response | Forces HTTPS for this host for the given period, so a later plain-HTTP link never leaves the browser. Only honoured over HTTPS. | max-age=31536000; includeSubDomains |
Content-Security-Policy | Response | Declares which sources may load and execute, which is the strongest defence against cross-site scripting. | default-src 'self'; img-src 'self' data: |
Content-Security-Policy-Report-Only | Response | Evaluates a policy and reports violations without blocking anything — how you roll a CSP out safely. | default-src 'self'; report-uri /csp |
X-Content-Type-Options | Response | Stops the browser guessing a type different from the declared one. The only valid value is nosniff, and every response should carry it. | nosniff |
X-Frame-Options | Response | Prevents the page being framed, blocking clickjacking. Superseded by CSP frame-ancestors, still sent for old browsers. | DENY |
Referrer-Policy | Response | How much of the current URL is sent as Referer on outbound links. Controls whether query strings leak to third parties. | strict-origin-when-cross-origin |
Permissions-Policy | Response | Enables or disables browser features per origin — camera, microphone, geolocation. Formerly Feature-Policy. | geolocation=(), camera=() |
Cross-Origin-Opener-Policy | Response | Detaches the page from cross-origin windows that opened it. Required, with COEP, to unlock SharedArrayBuffer. | same-origin |
Cross-Origin-Embedder-Policy | Response | Requires every embedded resource to opt in explicitly. The second half of cross-origin isolation. | require-corp |
Cross-Origin-Resource-Policy | Response | Says who may embed this resource at all, limiting cross-origin leaks such as Spectre-style side channels. | same-site |
X-XSS-Protection | Response | Toggled an old browser XSS filter that itself introduced bugs. Deprecated — set it to 0 and use CSP. | 0 |
X-Permitted-Cross-Domain-Policies | Response | Restricts legacy Flash and PDF cross-domain policy files. Cheap to send, still worth setting to none. | none |
Expect-CT | Response | Required Certificate Transparency logging. Obsolete — modern browsers enforce CT unconditionally. | max-age=86400, enforce |
Integrity-Policy | Response | Requires subresource integrity hashes on scripts, so a compromised CDN cannot swap the file. | blocked-destinations=(script) |
Direction
Response
What it controls
Forces HTTPS for this host for the given period, so a later plain-HTTP link never leaves the browser. Only honoured over HTTPS.
Typical value
max-age=31536000; includeSubDomains
Direction
Response
What it controls
Declares which sources may load and execute, which is the strongest defence against cross-site scripting.
Typical value
default-src 'self'; img-src 'self' data:
Direction
Response
What it controls
Evaluates a policy and reports violations without blocking anything — how you roll a CSP out safely.
Typical value
default-src 'self'; report-uri /csp
Direction
Response
What it controls
Stops the browser guessing a type different from the declared one. The only valid value is nosniff, and every response should carry it.
Typical value
nosniff
Direction
Response
What it controls
Prevents the page being framed, blocking clickjacking. Superseded by CSP frame-ancestors, still sent for old browsers.
Typical value
DENY
Direction
Response
What it controls
How much of the current URL is sent as Referer on outbound links. Controls whether query strings leak to third parties.
Typical value
strict-origin-when-cross-origin
Direction
Response
What it controls
Enables or disables browser features per origin — camera, microphone, geolocation. Formerly Feature-Policy.
Typical value
geolocation=(), camera=()
Direction
Response
What it controls
Detaches the page from cross-origin windows that opened it. Required, with COEP, to unlock SharedArrayBuffer.
Typical value
same-origin
Direction
Response
What it controls
Requires every embedded resource to opt in explicitly. The second half of cross-origin isolation.
Typical value
require-corp
Direction
Response
What it controls
Says who may embed this resource at all, limiting cross-origin leaks such as Spectre-style side channels.
Typical value
same-site
Direction
Response
What it controls
Toggled an old browser XSS filter that itself introduced bugs. Deprecated — set it to 0 and use CSP.
Typical value
0
Direction
Response
What it controls
Restricts legacy Flash and PDF cross-domain policy files. Cheap to send, still worth setting to none.
Typical value
none
Direction
Response
What it controls
Required Certificate Transparency logging. Obsolete — modern browsers enforce CT unconditionally.
Typical value
max-age=86400, enforce
Direction
Response
What it controls
Requires subresource integrity hashes on scripts, so a compromised CDN cannot swap the file.
Typical value
blocked-destinations=(script)
Frequently Asked Questions
What is the difference between Cache-Control: no-cache and no-store?
no-cache allows the response to be stored but requires revalidation with the server before it is reused, so an unchanged resource still saves bandwidth via a 304. no-store forbids storing it at all, which is what you want for anything private — it is the stronger of the two despite the name suggesting otherwise.
Which security headers should every site send?
At minimum: Strict-Transport-Security to force HTTPS, Content-Security-Policy to constrain what may execute, X-Content-Type-Options: nosniff to stop MIME sniffing, Referrer-Policy to limit what leaks in the Referer, and X-Frame-Options or CSP frame-ancestors to prevent clickjacking.
Why is my CORS request failing even though I set Access-Control-Allow-Origin?
Usually the preflight. A request with a non-simple method or custom header triggers an OPTIONS preflight that must be answered with Access-Control-Allow-Methods and Access-Control-Allow-Headers as well. And if credentials are involved, the origin must be named explicitly — the wildcard * is rejected with Access-Control-Allow-Credentials: true.
What is the difference between ETag and Last-Modified?
Both let a client revalidate a cached response. Last-Modified is a timestamp with one-second resolution; ETag is an opaque token the server derives from the content, so it detects changes a timestamp misses and works for resources that change more than once a second. Clients send them back as If-Modified-Since and If-None-Match.