HTTP Header Explorer

Every HTTP header explained with examples and common mistakes. Searchable by category: request, response, security, caching, CORS. Generate security header configurations.

HTTP Header Explorer

Complete reference for HTTP headers. Searchable, categorized, with examples and common mistakes. Generate security header configurations.

AcceptRequest

Tells the server what content types the client can handle.

AuthorizationRequest

Sends credentials for authenticating with the server.

User-AgentRequest

Identifies the client application making the request.

HostRequest

Specifies the domain name of the server (required in HTTP/1.1).

CookieRequest

Sends stored cookies to the server.

RefererRequest

URL of the page that linked to the current request.

If-None-MatchRequest

Makes request conditional; server returns 304 if ETag matches.

If-Modified-SinceRequest

Only return the resource if it has been modified since the given date.

←

Select a header from the list to see full details, examples, and common mistakes.

How to Look Up HTTP Headers

Explore 38 HTTP headers with examples and mistakes to avoid, using The IT Hustle's free HTTP Header Explorer.

1
Browse by categoryFilter headers by Request, Response, Security, Caching, CORS, or Content to narrow down what you're looking for.
2
Or search by nameType into the search box to match against header names, descriptions, and categories.
3
Read the detailsEach header shows a plain-English description, a realistic example value, and the common mistakes developers make with it.
4
Follow related headersClick the related-header links to jump between headers that work together, like Cache-Control and ETag.
5
Copy security presetsUse the Security Generator presets — Strict CSP, HSTS, or the Full Security Suite — to copy production-ready header configurations.

Frequently Asked Questions

Start with Strict-Transport-Security (forces HTTPS), Content-Security-Policy (blocks XSS vectors), X-Content-Type-Options: nosniff, and X-Frame-Options (prevents clickjacking). The Full Security Suite preset bundles a solid baseline you can copy directly.

CSP is a response header that whitelists where scripts, styles, images, and other resources may load from. A strict policy is one of the most effective defenses against cross-site scripting, though it needs testing since an over-strict policy can break legitimate resources.

Request headers are sent by the browser (like Authorization or Accept), while response headers are sent by the server (like Cache-Control or Set-Cookie). The category filter separates them so you know which side of the connection sets each one.

It depends on your stack — nginx uses add_header directives, Apache uses the Headers module in .htaccess, and most frameworks have middleware. Pair this reference with our Nginx Config Generator or .htaccess Generator to produce the actual configuration.

HTTP Header Explorer