Web

HTTP Headers Cheatsheet

The HTTP headers you meet most, grouped by purpose. A quick reference for debugging caching, locking down security, and handling content negotiation.

Caching

Fresh for one hour before revalidation.

Never cache (for sensitive data).

Content fingerprint for conditional requests.

When the resource last changed.

The media type of the body.

Compression applied to the body.

Size of the body in bytes.

Media types the client will accept.

Force HTTPS for future requests (HSTS).

Restrict which resources may load.

Stop the browser guessing content types.

Prevent the page being framed (clickjacking).

Which origins may read the response.

Permitted methods for cross-origin requests.

Permitted custom request headers.

Send credentials or a token.

Server sets a cookie on the client.

Redirect target (with 3xx responses).

How long to wait before retrying (with 429/503).