Look up an HTTP header

Look up HTTP header semantics, grammar, caching, and forwarding behavior.

freeworks offlinenothing uploaded
ToolHTTP Headers Reference
Input
Output
—

How it works

A field name maps to its registered semantics, value grammar, cache impact, and request or response context. End-to-end and hop-by-hop behavior remain distinct, as do repeatable and non-combinable fields.

  • Names are case-insensitive but meanings are field-specific.
  • Raw grammar remains beside implementation guidance.

Worked example

Browse security-related HTTP headers
List all security headers like HSTS, CSP, X-Frame-Options with descriptions
Input
											Category: security
Search:
Output
												Strict-Transport-Security [security]
  Force HTTPS connections
  Example: Strict-Transport-Security: max-age=31536000; includeSubDomains

X-Content-Type-Options [security]
  Prevents MIME type sniffing
  Example: X-Content-Type-Options: nosniff

X-Frame-Options [security]
  Controls iframe embedding
  Example: X-Frame-Options: DENY

X-XSS-Protection [security]
  Enables cross-site scripting filter
  Example: X-XSS-Protection: 1; mode=block

Content-Security-Policy [security]
  Controls resources the user agent is allowed to load
  Example: Content-Security-Policy: default-src 'self'

Referrer-Policy [security]
  Controls how much referrer info is sent
  Example: Referrer-Policy: strict-origi…

When to use this

API documentation, proxy audits, and security reviews reference headers.

Edge cases

  • Set-Cookie cannot be joined like a comma-list.
  • Connection-specific fields should not be blindly forwarded.
  • A valid Cache-Control directive can be ignored by an intermediary.

References