Find a request or response header with your browser’s Find command. Compare the listed purpose and example value when reading or composing HTTP messages.
Runs locally in your browser| Header | Meaning | Example |
|---|---|---|
| Accept | Media types the client can process in the response. | Accept: text/plain, text/html |
| Accept-Charset | Character encodings the client accepts. It is obsolete in modern HTTP. | Accept-Charset: utf-8 |
| Accept-Encoding | Content codings the client can decode, such as gzip or br. | Accept-Encoding: gzip, br |
| Accept-Language | Preferred response languages, optionally weighted with q values. | Accept-Language: en, zh |
| Authorization | Credentials used to authenticate the request to the origin server. | Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== |
| Cache-Control | Request cache directives, such as no-cache or max-age. | Cache-Control: no-cache |
| Connection | Controls hop-by-hop connection options. It must not be forwarded by proxies. | Connection: close |
| Cookie | Cookies previously stored for the target origin. | Cookie: sessionId=abc123 |
| Content-Length | Size of the request body in bytes. | Content-Length: 348 |
| Content-Type | Media type and optional character encoding of the request body. | Content-Type: application/x-www-form-urlencoded |
| Date | Date and time when the request message was generated; rarely sent by browsers. | Date: Tue, 15 Nov 2016 08:12:31 GMT |
| Expect | Expectations the server must meet, most commonly 100-continue. | Expect: 100-continue |
| From | Optional contact address for the human user controlling the client. Rarely used. | From: user@example.com |
| Host | Target host and optional port. Required in HTTP/1.1 requests. | Host: example.com |
| If-Match | Make the request conditional on the current ETag matching one of the supplied values. | If-Match: "33a64df5" |
| If-Modified-Since | Return the representation only if it changed after the supplied date. | If-Modified-Since: Sat, 29 Oct 2016 19:43:31 GMT |
| If-None-Match | Make the request conditional on the current ETag not matching a supplied value. | If-None-Match: "33a64df5" |
| If-Range | Send a range only when the validator still matches; otherwise send the complete representation. | If-Range: "33a64df5" |
| If-Unmodified-Since | Apply the request only if the resource has not changed since the supplied date. | If-Unmodified-Since: Sat, 29 Oct 2016 19:43:31 GMT |
| Max-Forwards | Limits how many proxies may forward a TRACE or OPTIONS request. | Max-Forwards: 10 |
| Pragma | Legacy HTTP/1.0 cache-control field, commonly used as Pragma: no-cache. | Pragma: no-cache |
| Proxy-Authorization | Credentials used to authenticate the request to a proxy. | Proxy-Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== |
| Range | Requests one or more byte ranges from the selected representation. | Range: bytes=500-999 |
| Referer | URL of the page that initiated the request. The historical field name is misspelled by specification. | Referer: https://example.com/page |
| TE | Transfer codings the client accepts, plus optional support for trailers. | TE: trailers |
| Upgrade | Protocols the client invites the server to switch to on the current connection. | Upgrade: h2c |
| User-Agent | Identifies the client software making the request. | User-Agent: Mozilla/5.0 (X11; Linux x86_64) |
| Via | Lists intermediaries that forwarded the request. | Via: 1.1 example.com (nginx) |
| Warning | Obsolete field for additional cache warnings; removed from current HTTP specifications. | Warning: 199 example.test "Miscellaneous warning" |
| Header | Meaning | Example |
|---|---|---|
| Accept-Ranges | Range units supported by the server, commonly bytes. | Accept-Ranges: bytes |
| Age | Seconds the response has spent in a cache since it was generated or revalidated. | Age: 12 |
| Allow | Request methods supported by the target resource. | Allow: GET, HEAD |
| Cache-Control | Response caching directives, such as max-age, no-cache, private, or no-store. | Cache-Control: no-cache |
| Content-Encoding | Content coding applied to the response body, such as gzip or br. | Content-Encoding: gzip |
| Content-Language | Natural language or languages of the response representation. | Content-Language: en, zh |
| Content-Length | Size of the response body in bytes. | Content-Length: 348 |
| Content-Location | URL for the specific representation contained in the response. | Content-Location: /index.html |
| Content-MD5 | Obsolete MD5 digest field for the message content. Use Digest or Content-Digest where supported. | Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ== |
| Content-Range | Byte range carried by a partial response and the complete representation size. | Content-Range: bytes 21010-47021/47022 |
| Content-Type | Media type and optional character encoding of the response body. | Content-Type: text/html; charset=utf-8 |
| Date | Date and time when the origin server generated the response. | Date: Tue, 15 Nov 2016 08:12:31 GMT |
| ETag | Opaque validator identifying the selected representation version. | ETag: "33a64df5" |
| Expires | Date and time after which a cached response is considered stale. | Expires: Thu, 01 Dec 2016 16:00:00 GMT |
| Last-Modified | Date and time when the origin believes the resource was last changed. | Last-Modified: Tue, 15 Nov 2016 12:45:26 GMT |
| Location | URL used for redirects or to identify a newly created resource. | Location: https://example.com/new-page |
| Pragma | Legacy HTTP/1.0 cache field. Cache-Control is preferred in modern responses. | Pragma: no-cache |
| Proxy-Authenticate | Authentication scheme and parameters required by a proxy. | Proxy-Authenticate: Basic realm="example" |
| Refresh | Non-standard refresh instruction supported by some browsers. Prefer an HTTP redirect where appropriate. | Refresh: 5; url=https://example.com/ |
| Retry-After | When the client should retry, expressed as a date or a delay in seconds. | Retry-After: 120 |
| Server | Information about the origin server software. Detailed version disclosure can increase fingerprinting risk. | Server: Apache/2.4 (Unix) |
| Set-Cookie | Creates or updates a cookie in the user agent. | Set-Cookie: sessionId=abc123; Max-Age=3600; HttpOnly |
| Trailer | Names fields that may appear in the trailer section of a chunked message. | Trailer: Max-Forwards |
| Transfer-Encoding | Hop-by-hop transfer coding used to frame the message, commonly chunked in HTTP/1.1. | Transfer-Encoding: chunked |
| Vary | Request fields a cache must consider when selecting a stored response. | Vary: Accept-Encoding |
| Via | Lists intermediaries that forwarded the response. | Via: 1.1 example.com (nginx) |
| Warning | Obsolete field for additional cache warnings; removed from current HTTP specifications. | Warning: 199 example.test "Miscellaneous warning" |
| WWW-Authenticate | Authentication scheme and challenge parameters required by the origin server. | WWW-Authenticate: Basic realm="example" |
This page is a static reference: two tables list the fields a client can send (29 request headers) and the fields a server can return (28 response headers), each with a short meaning and one example line.
The header name and the example are protocol text and stay identical in every language; only the meaning column is translated. Nothing is uploaded and no script asks for input - the tables are part of the HTML.
Request headers are fields a browser, an API client or a proxy can send; response headers are fields a server returns. Seven fields - Cache-Control, Content-Length, Content-Type, Date, Pragma, Via and Warning - appear in both tables because they can travel in either direction, and each row describes that direction.
Response-only entries such as Accept-Ranges, Age, ETag, Location and Retry-After are kept in the second table so a field never appears on the wrong side. Rows follow the order of the original reference, which is roughly alphabetical.
Examples are illustrative, not defaults: Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ== is the base64 form of Aladdin:open sesame, and Content-MD5: Q2hlY2sgSW50ZWdyaXR5IQ== decodes to Check Integrity! - useful for recognising a field, wrong for production.
A description also records when a field changed: Content-MD5 is superseded by Digest or Content-Digest, Warning was removed from current HTTP specifications, and Refresh is a non-standard convenience that an HTTP redirect replaces. The table describes the field; it does not check the headers you already have.
There is no input field, no run button and no request to a URL: the page cannot test the headers of a live site. For that, use the HTTP request tool or a command-line client such as curl -I.
Nothing is sent to VoriTools while you read, and the page has no filter UI - Ctrl+F is text-only, so it cannot group fields by category (for example all caching headers) or by status.