HTTP Headers (Request & Response Metadata)

HTTP Headers are colon-separated name-value pairs transmitted at the beginning of every HTTP/1.1 message and in compressed binary frames across HTTP/2 and HTTP/3. Operating as the control plane for web communication, headers instruct browsers, proxy servers, CDNs, and application servers how to handle authentication, negotiate content representations, enforce security boundaries, manage cookies, and optimize client-side caching.

Inspect and audit your server's security headers in real time with our HTTP Headers Analyzer or construct safe policies with the CSP Builder.

---

Technical Specifications at a Glance

Specification	Details
Standard Specifications	RFC 9110 (HTTP Semantics) & RFC 9111 (HTTP Caching)
Syntax Format	Case-insensitive Field-Name: Field-Value\r\n
Header Categories	Request Headers, Response Headers, Representation Headers, Framing/Control
Compression Standard	HPACK (HTTP/2 - RFC 7541) / QPACK (HTTP/3 - RFC 9204)
Max Header Size	Vendor-dependent (Typically 8 KB to 32 KB across Apache, NGINX, Node.js)

---

The 4 Primary Functional Categories of HTTP Headers

1. Essential Security Headers

Modern web applications rely on defensive HTTP response headers to protect users from clickjacking, cross-site scripting (XSS), and eavesdropping:

Security Header	Standard Purpose & Best-Practice Value
Content-Security-Policy	Restricts allowed script, style, and media sources: default-src 'self'
Strict-Transport-Security	Mandates HTTPS connections for future visits: max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	Prevents MIME-sniffing: nosniff
X-Frame-Options	Blocks clickjacking inside <iframe>: DENY or SAMEORIGIN
Referrer-Policy	Controls referrer leakage: strict-origin-when-cross-origin
Permissions-Policy	Disables invasive device APIs: camera=(), microphone=(), geolocation=()

2. Caching & Performance Headers

• Cache-Control: Defines browser and CDN caching lifetimes (public, max-age=31536000, immutable).
• ETag: An arbitrary hash representing entity state, used in conditional requests (If-None-Match: "33a64df5").
• Last-Modified: Timestamps used with If-Modified-Since to receive 304 Not Modified responses.

3. Cross-Origin Resource Sharing (CORS) Headers

• Access-Control-Allow-Origin: Explicitly permits specified client origins to read server responses.
• Access-Control-Allow-Methods: Lists allowed HTTP verbs (GET, POST, PUT, DELETE).
• Access-Control-Allow-Headers: Specifies allowable custom request headers.

4. Content Negotiation Headers

• Content-Type: Identifies payload MIME type (application/json; charset=utf-8).
• Accept: Informs the server of acceptable formats (text/html, application/json).
• Accept-Encoding: Negotiates compression algorithms (gzip, deflate, br, zstd).

---

Code Example: Setting Hardened Security Headers

Modern Next.js Configuration (next.config.mjs)

/** @type {import('next').NextConfig} */
const nextConfig = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'X-Frame-Options', value: 'DENY' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { 
            key: 'Strict-Transport-Security', 
            value: 'max-age=63072000; includeSubDomains; preload' 
          },
        ],
      },
    ];
  },
};

export default nextConfig;

---

Frequently Asked Questions

Are HTTP header names case-sensitive?

No. RFC 9110 specifies that HTTP header names are case-insensitive (content-type is identical to Content-Type and CONTENT-TYPE). However, header values may be case-sensitive depending on the directive.

What causes a "CORS Missing Allow Origin" error?

When a browser script makes a fetch request to a different domain, protocol, or port, the browser blocks access to the response unless the server returns an Access-Control-Allow-Origin header matching the requesting origin.

How can I check what headers my website is currently sending?

Enter your domain into our free HTTP Headers Analyzer to inspect raw response headers, detect missing security policies, and receive security grade scores.