What's the difference between Cache-Control and Expires?

Cache-Control is the modern one — supports max-age, s-maxage, no-cache, no-store, immutable, etc. Expires is HTTP/1.0 era (an absolute date). Cache-Control overrides Expires when both are present. Use Cache-Control.

Is Content-Length required?

Not always — chunked transfer encoding doesn't use it. But most servers and clients prefer to know the body length up front for connection management. HTTP/2 handles this automatically via stream framing.

What headers are case-sensitive?

None — HTTP headers are case-insensitive per spec. HTTP/2 lowercases all header names on the wire (but most server APIs let you write them however you like). For consistency, use canonical Title-Case in code.

request · response · cors · security · live

All HTTP headers in one searchable list

Q: Is anything sent to a server?

No — this is a static reference page.

Browse standard request and response headers by category. Click a row to copy. Lookup is static and runs entirely in your browser.

HTTP Headers Reference

Total

headers

Visible

all

How to find an HTTP header

Pick a category, search by name, click a row to copy.

01
Pick a category
Auth, negotiation, caching, connection, cors, security, cookies, misc.
Lookups reference the IANA registries (MIME, HTTP status, TLDs) bundled at build time — no live network calls, no rate limits, no leaked queries.
filterIANAregistryofflinelive
cat · querycaching · IANA
```
Cache-Control ETag Vary
```
loaded · IANA bundlespec · ready
02
Search by name
Type cors, cache, auth… matches both name and description.
Builders emit canonical syntax per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs) so the output passes spec-compliant parsers.
searchRFC 9110canonicalspec-compliantlive
query · optionscors · live
```
Access-Control-* matched
```
options applied · livecanonical
03
Read direction
Each header is tagged request, response or both.
Validation flags common pitfalls — uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8 — before they bite production.
dirvalidationlintpitfallslive
dir · looked upboth · ready
```
Content-Type · both
```
result · livevalidated
04
Copy & ship
Click any row to copy the canonical header name into your clipboard.
Copy writes the snippet directly into your clipboard; downloads emit the right extension and MIME so curl/httpie pick them up correctly.
copyclipboardMIME-correctblobcurl-ready
ok · copiedready · done
```
Copied Cache-Control
```
shipped · ready to shipsuccess

Pro tips

Web-spec details that bite later

Idempotency saves retries

POST/PUT/DELETE should be safely retried. Use idempotency keys and return the same response on duplicate requests.

Match RFC 9110 status codes

Don’t invent codes. 422 for validation errors, 409 for conflicts, 429 for rate limits. Standard codes work with off-the-shelf clients.

Set <code>Cache-Control</code> deliberately

Default browser caching is conservative. Use max-age + stale-while-revalidate for hot endpoints.

Validate Open Graph in dev

OG tags break silently. Use a previewer like OG Generator + Facebook’s debugger before launch.

CORS is a server concern

The browser sends the preflight; the server decides. Wildcard origins disable credentials — be explicit.

MIME drives behaviour

Servers must send the right Content-Type. Browsers sniff but the spec says they shouldn’t — be explicit to avoid surprises.

Use Cases

When to look up a header

Server config, code review, debugging.

Server config

Decide which headers to add or strip at the edge. Bundled from IANA registries at build time — no live network call, no rate limit, no leaked queries. The MIME, TLD, and status-code tables are baked in so the tool works offline once loaded.

spec-compliant

Code review

Spot wrong direction (e.g. setting a request-only header). Output is canonical per the relevant RFC (9110 for HTTP, 5322 for headers, 3986 for URLs), so spec-compliant parsers accept it as-is. Cross-browser and cross-library behaviour stays consistent.

offline

Security audit

Confirm every required security header is shipped. Pairs with the curl-to-fetch converter for end-to-end test stubs — copy the curl from DevTools, paste, get an idiomatic fetch() body. Drop into Playwright/Vitest fixtures without manual translation.

IANA-backed

Client libraries

Document supported headers in your SDK. Catches common pitfalls (uppercase header names, smart quotes inside Content-Type, missing ;charset=utf-8) before they bite production. Validation flags rather than auto-corrects so you stay in control.

RFC-aligned

Onboarding

Help new engineers learn the moving parts of HTTP. Validation runs as you type — copy only when the output is shaped correctly. The output drops directly into nginx, Apache, or CDN configs without re-formatting or re-quoting.

production-grade

Debugging proxies

Identify mystery headers added by a CDN or LB. Same input plus same options always produces identical canonical output, so the tool is safe to embed in CI scripts that diff against expected configs.

curl-ready

FAQ

Frequently asked questions

Are these all the headers?

The standard, widely-used set. IANA tracks hundreds more; this list focuses on what you'll see in production.

Where's X-Forwarded-For?

Common but not standardised. The official replacement is the Forwarded header (RFC 7239).

Why is Referer misspelled?

It was misspelled in the original HTTP/0.9 spec. The header is enshrined that way for compatibility — the policy header is correctly spelled Referrer-Policy.

Can I add custom headers?

Yes — prefix with the use case (e.g. X-Acme-RequestID). Standard prefix X- is deprecated but ubiquitous.

Is anything sent to a server?

No — this list is static and the filter runs locally in your browser.

Suggest a tool

Something missing?

Tell us what you need. We ship the top requests every two weeks.

47 in queue·8 shipped this month

Request queued. Thanks!