Specify what client hints should be included in subsequent requests.

accept-ch

What partial content range types this server supports via byte serving.

accept-ranges

Allow credentials to be sent in CORS requests.

access-control-allow-credentials

Indicate whether the response can be shared with the given origin.

access-control-allow-origin

The browser is allowed to request resources from the origin.

The age the object has been in a proxy cache in seconds.

Indicate a resource should be loaded from a different server while still appearing to be loaded from this server.

alt-svc

The ALPN protocol followed by the alternative host and port.

The number of seconds which the alternative service is available.

The entry is not deleted when the network is changed.

Platform for Privacy Preferences Project, now obsolete.

Inform all caching mechanisms from server to client whether they may cache this object.

cache-control

The time a browser should remember a site can only be accessed with https (seconds).

Client will accept stale responses (seconds).

Client wants a response that will be fresh for the given time (seconds).

May be stored by any cache but must be validated by the server.

Intermediate cache or proxy cannot modify the response or certain headers.

Override max-age for shared caches, ignored by private caches.

Client will accept a stale response if the check for a fresh one fails (seconds).

Client will accept a stale response and will check for a fresh one (seconds).

Encoded information about your request from Cloudflare.

cf-cache-status

Cloudflare has been instructed to not cache this.

The Cloudflare cache for this has expired

Resource was not found in Cloudflare cache.

cf-ray

cf-request-id

Control options for the current connection and list of hop-by-hop response fields.

connection

The client or server would like to close the connection.

The client would like to keep the connection open.

Indicate the connection should be upgraded from HTTP to HTTPS.

Determine whether the response should be displayed inline or downloaded.

content-disposition

The original filename of the file transmitted.

The original filename of the file transmitted, in RFC5987 encoding.

The HTML field that the content refers to.

Encodings used in the message, and the order they appear.

content-encoding

The natural language or languages of the intended audience for the enclosed content.

content-language

The length of the response body in octets (8-bit bytes).

content-length

'none'

'self'

unsafe-inline

unsafe-evail

unsafe-hashes

unsafe-allow-redirects

strict-dynamic

report-sample

script-src

<protocol>:

<domain>

nonce-<nonce>

sha-<sha>

The content security policy allows the server to determine what resources the user is allowed to load.

content-security-policy

Define what can be used in the base element.

Define what can be used as the target for forms.

Define valid parents for frame, iframe, embed, object, and applet.

Define sources for audio, video, and track elements.

Define navigation restrictions by any means.

Define sources for object, embed, and applet elements.

Define what plugins can be embedded and loaded.

Define sources for inline JavaScript event handlers.

Define sources for style and stylesheet link elements.

Treat insecure URLs as though they are secure.

Define sources for Worker, SharedWork, and ServiceWorker scripts.

The content security policy, reporting only.

content-security-policy-report-only

content-type

<type>

<type>; charset=<charset>

multipart/form-data; boundary=<boundary>

Boundary characters for multi-part encoding.

Isolate the document from cross-origin windows.

cross-origin-opener-policy

Isolated the browsing context to same-origin.

Retain references to new opened windows or tabs.

Allow document to be added to its openered browsing context group.

cross-origin-resource-policy

The date and time that the message was sent.

date

No preference has been given for tracking on the site.

An identifier for a specific version of a resource.

etag

W/"<tag>"

"<tag>"

Used by a server to indicate that UAs should evaluate connections to the host emitting the header field for CT compliance.

expect-ct

Tell client to refuse future connections that violate the CT policy.

The time after receiving this header that the client should use the header value (seconds).

The time at which the response is considered stale.

expires

self

none

<origin>

feature-policy

Control access to display capture devices.

Control whether page can set document.domain.

Control access to encrypted media extensions API.

Control if tasks should execute in a frame if hidden.

Control if tasks should execute if frame is out of viewport.

Control whether page can show layout animations.

Control access to page spatial navigation.

Control download and display of large images.

Control access to picture-in-picture mode.

Control access to web authentication API.

host

<host>:<port>

<host>

The last modified date for the requested object.

last-modified

Used to express a typed relationship with another resource.

link

location

mime-version

(<domains>)

permissions-policy

Control access to the user agent branding and version

Control access to the user agent architecture.

Control access to the user agent bitness.

Control access to the user agent full version.

Control access to the user agent mobile experience.

Control access about the user agent device.

Control access to the user agent platform.

Control access to the user agent platform version.

Control access to Federated Learning of Cohorts.

HTTP/1.0 backwards compatible cache handling.

pragma

Force requests to the origin server before releasing a cache.

Send or receive a partial part of the resource.

range

bytes=<start>-<end>

bytes=<start>-<end>/<total>

Controls what referrer information is sent with requests.

referrer-policy

No referrer information is sent along with requests.

Send the full referrer when the protocol security stays the same, or improves.

Send the full referrer when performing a same origin request, and the origin when not.

Send the full referrer for same origin requests, and nothing for cross-origin.

Send the origin when the protocol level stays the same

Send the full referrer for a same origin request. Send the origin only for cross-domain requests where the protocol level is the same. Otherwise do not send the referrer.

report-to

server

<server>/<version> (<system>)

<server>/<version>

<server>

server-timing

A cookie sent from the server to be set on the client

set-cookie

Cookie name and value. The value can be enclosed in double quotes, and must only contain ASCII characters (excluding control, space, quotes, comma, semi-colon, and backslashes.

The domain to which the cookie is applied.

Prevent JavaScript from accessing the cookie.

The number of seconds until the cookie expires.

The path on the domain to which the cookie is applied.

Control whether cookies are sent with cross-domain requests

A HSTS Policy informing the HTTP client how long to cache the HTTPS only policy and whether this applies to subdomains.

strict-transport-security

Use Google's preloading strict transport security.

Indicates that different content may be provided to different clients, depending on the vary header.

vary

Added by proxies to track a request through proxies and to avoid loops.

<version> <host>

<version> <host> :<port>

<protocol> <version> <host>

<protocol> <version> <host> :<port>

<protocol> <version> <name>

Authentication method used to access the resource.

www-authenticate

<type> realm="<realm>", charset="<charset>"

<type> realm="<realm>"

Encoding scheme to use when submitting authentication details.

A text description of the authenticated area.

Indicates whether a cache was used to server this response.

x-cache

Used by the Google Cloud platform to identify requests.

x-cloud-trace-context

x-content-type-option

Prevents Internet Explorer from MIME-sniffing a response away from the declared content-type.

x-content-type-options

Block requests if type 'style' or 'script'.

x-frame-options

x-magento-tags

Specifies if a cross-domain policy is allowed.

x-permitted-cross-domain-policies

x-pingback

x-powered-by

WordPress redirect agent.  A value of "WordPress" indicates that WordPress itself redirected the resource.

Create HTTP Headers

Your Headers

View Headers