HTTP Header Reference Lookup

Report an Issue

Help us improve by telling us what went wrong.

Embed this Tool

Customize and copy the embed code for your website.

Look Up Any HTTP Header and Understand Its Purpose

HTTP headers control everything from caching behavior and content negotiation to security policies and authentication. Yet with over 100 standard headers and dozens of non-standard ones in common use, nobody memorizes them all. The HTTP Header Reference Lookup lets you search for any HTTP header by name and instantly understand what it does, how to use it correctly, and what values it accepts.

This tool is the reference you keep open in a browser tab while configuring web servers, debugging API responses, setting security headers, or optimizing caching strategies. Instead of searching the web and wading through outdated Stack Overflow answers, you get authoritative, well-organized information about every header in one place.

What the Reference Includes

Each header entry provides a description explaining its purpose in plain language, the syntax showing the correct value format, example values demonstrating common configurations, the directionality (request header, response header, or both), and usage notes covering edge cases and common mistakes. Security-related headers include specific guidance on recommended values that protect against common web vulnerabilities.

The reference covers the full spectrum: general headers like Cache-Control and Connection, request headers like Accept, Authorization, and User-Agent, response headers like Content-Type, Set-Cookie, and Location, security headers like Content-Security-Policy, Strict-Transport-Security, and X-Frame-Options, and CORS headers like Access-Control-Allow-Origin and Access-Control-Allow-Methods.

Real-World Scenarios

Configuring cache headers: You are setting up a CDN and need to decide between Cache-Control directives like public, private, no-cache, no-store, max-age, and s-maxage. The reference explains each directive precisely, including the subtle but critical difference between no-cache (revalidate before using) and no-store (never cache at all). Getting this wrong can expose private data through shared caches or prevent CDN effectiveness entirely.

Implementing security headers: Your security audit flagged missing headers. The reference guides you through adding Content-Security-Policy, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy with recommended values. Each header entry explains what attack it mitigates and what happens if it is misconfigured.

Debugging CORS issues: Your frontend application receives opaque responses or CORS errors from your API. The reference explains exactly which headers need to be present in the preflight response, what values they should contain, and common misconfigurations like missing Access-Control-Allow-Headers for custom request headers.

Troubleshooting content negotiation: Your API returns XML when the client expects JSON, or vice versa. The reference explains how Accept, Content-Type, and Accept-Encoding headers interact to determine response format and encoding.

Who Uses This Lookup?

Backend developers configuring response headers in their API frameworks. DevOps engineers writing Nginx, Apache, or Caddy configuration files. Security engineers hardening web applications against common attack vectors. Frontend developers troubleshooting fetch requests that fail due to missing or incorrect headers. QA engineers verifying that API responses include the expected headers with correct values.

Headers That Trip People Up

Several headers are commonly misconfigured. Cache-Control has complex directive interactions that even experienced developers get wrong. Content-Security-Policy has a verbose syntax where a single typo can break your entire site or leave a security gap. Set-Cookie attributes like SameSite, Secure, HttpOnly, and Domain interact in ways that affect authentication flows across subdomains. Authorization has multiple schemes (Bearer, Basic, Digest) each with different formatting requirements. The reference addresses these complexities head-on.

Tips for Working with HTTP Headers

Use your browser's developer tools (Network tab) to inspect headers in real time while developing. Compare what you see against the reference to verify correctness. When adding security headers, test incrementally - adding a restrictive Content-Security-Policy all at once can break existing functionality. Use report-only mode first when available. Remember that header names are case-insensitive per the HTTP specification, but header values are often case-sensitive. Always check the reference for case sensitivity requirements of specific values.

The HTTP Header Reference Lookup runs entirely in your browser with no external dependencies. It is always available, always fast, and covers every header you will encounter in modern web development.