What is an HTTP Header?

HTTP headers are metadata fields that accompany every request and response in the HyperText Transfer Protocol. They tell the browser and server what kind of content is being exchanged, how to cache it, who is allowed to access it, and dozens of other things — all before a single byte of the actual page content is processed.

Request Headers vs Response Headers

Headers travel in both directions:

• Request headers — sent from your browser to the server. They describe your browser, your preferred language, what content types you accept, and authentication tokens.
• Response headers — sent from the server back to your browser. They describe the content, how long to cache it, security policies, and more.

Common Request Headers

Header	What it does
Host	The domain name of the server being requested. Required in HTTP/1.1 to support virtual hosting (multiple sites on one IP).
User-Agent	Identifies the browser and operating system. Servers use this for analytics, mobile detection and sometimes feature gating.
Accept	The content types the client can handle. text/html, application/json etc.
Accept-Language	The user's preferred languages. Servers use this to return the correct localised version of a page.
Accept-Encoding	Compression formats the client supports. gzip, br (Brotli) are common.
Authorization	Credentials for authenticated requests. Usually a Bearer token or Basic auth string.
Referer	The URL of the page that linked to the current request. Used for analytics and CSRF protection.
Cookie	Session identifiers and other persistent data previously set by the server.

Common Response Headers

Header	What it does
Content-Type	The MIME type of the response body. text/html; charset=UTF-8 for HTML pages, application/json for APIs.
Content-Length	The size of the response body in bytes. Helps the browser show a progress indicator.
Cache-Control	Caching instructions. max-age=3600 means cache for one hour. no-store means never cache.
Set-Cookie	Instructs the browser to store a cookie. Can include scope, expiry, Secure and HttpOnly flags.
Location	The URL to redirect to. Used with 301, 302 and other redirect status codes.
Server	Identifies the server software. Often nginx, cloudflare, Apache or a custom value.
ETag	A version identifier for the resource. Browsers send it back in subsequent requests; if it matches, the server returns 304 Not Modified instead of the full content.

Headers and Performance

Several headers directly affect how fast a site loads:

• Cache-Control — Correctly caching static assets (images, CSS, JS) can eliminate network requests entirely on repeat visits. A common pattern: Cache-Control: public, max-age=31536000, immutable for versioned files.
• Content-Encoding — Confirms that compression (gzip or Brotli) is being applied. Text-based assets typically compress 60–80%, significantly reducing transfer size.
• CF-Cache-Status — Cloudflare-specific header showing whether the response was served from the CDN cache (HIT) or fetched from the origin (MISS).
• Link: rel=preload — Hints to the browser to fetch a resource early, before it is discovered during HTML parsing.

Security-Relevant Response Headers

A set of response headers exist specifically to improve browser security. These are checked by the Security Headers Scanner:

• Strict-Transport-Security — Force HTTPS. See the HSTS guide.
• Content-Security-Policy — Restrict resource loading. See the CSP guide.
• X-Frame-Options — Prevent clickjacking by blocking iframe embedding.
• X-Content-Type-Options: nosniff — Stop browsers from guessing MIME types, preventing certain injection attacks.
• Referrer-Policy — Control how much of the current URL is sent in the Referer header to third parties.