HTTP Response Headers
Common HTTP response headers and their purposes.
Common HTTP response headers with a description and an example value: Content-Type, Content-Length, Cache-Control, Set-Cookie, ETag, Location and CORS headers, plus the security headers HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy.
Use it when
- You need the meaning and format of a response header.
- You are hardening a site with security headers.
Watch out for
- Security headers need testing; for example a Content-Security-Policy can break inline scripts and third-party widgets.
- Headers can be modified or added by proxies and CDNs between the server and the client.
The data
22 rows
| Header | Description | Example |
|---|---|---|
| Content-Type | Media type of the response body. | application/json; charset=utf-8 |
| Content-Length | Size of the response body in bytes. | 2048 |
| Content-Encoding | Encoding applied to the body. | gzip, br |
| Cache-Control | Caching directives for the response. | public, max-age=86400 |
| Set-Cookie | Sends a cookie to the client. | session=abc123; HttpOnly; Secure |
| ETag | Identifier for a specific version of the resource. | "33a64df5" |
| Last-Modified | Date and time the resource was last modified. | Wed, 21 Oct 2026 07:28:00 GMT |
| Location | URL to redirect to. | https://api.example.com/users/42 |
| WWW-Authenticate | Authentication method required. | Bearer realm="api" |
| Access-Control-Allow-Origin | Allowed origins for CORS. | https://example.com |
| X-RateLimit-Remaining | Remaining requests in the current window. | 47 |
| Retry-After | Seconds to wait before retrying after 429. | 300 |
| Strict-Transport-Security | Tells browsers to use HTTPS only for the site for a period, preventing protocol downgrade. | max-age=31536000; includeSubDomains |
| Content-Security-Policy | Restricts which sources scripts, styles and other resources may load from, limiting injection attacks. | default-src 'self'; img-src https: |
| X-Content-Type-Options | Stops browsers from guessing content types, reducing MIME-sniffing attacks. | nosniff |
| Referrer-Policy | Controls how much referrer information is sent with requests. | strict-origin-when-cross-origin |
| Permissions-Policy | Enables or disables browser features such as camera or geolocation for the page and embedded frames. | geolocation=(), camera=() |
| Vary | Lists request headers that change the response, so caches store separate variants. | Accept-Encoding, Accept-Language |
| Content-Disposition | Suggests whether to display content inline or download it, and the filename. | attachment; filename="report.csv" |
| Alt-Svc | Advertises alternative endpoints or protocols, such as HTTP/3, for the same origin. | h3=":443"; ma=86400 |
| Age | The time in seconds the response has been in a shared cache. | 120 |
| Link | Provides related resources, such as preload hints, relations and pagination links. | </style.css>; rel=preload; as=style |
Fields
The shape of this dataset, read from the data itself: every column, its type and a real value. Agents can use this to plan a query without fetching the whole document.
| Section | Field | Type | Example |
|---|---|---|---|
| data | header | string | Content-Type |
| data | description | string | Media type of the response body. |
| data | example | string | application/json; charset=utf-8 |
Fetch the same bytes
The static files contain the same reference rows as the API, with no API rate limit. Live metadata, such as view counts, may differ. Use the API for content negotiation; use the static files for a cacheable snapshot.
curl "https://yjtoon.yunusemrevurgun.com/api/dataset/http-response-headers?format=toon"
const res = await fetch( "https://yjtoon.yunusemrevurgun.com/static-data/dataset/http-response-headers.toon" ); const toon = await res.text();
Rate limit: 120 requests per minute per IP, no key and no signup. API reference →