HTTP Headers Reference: Every Header That Matters
Every time a browser loads a page, the server sends back a set of HTTP response headers before any HTML arrives. They control caching, security, redirects and how search engines treat your page — yet most sites get several of them wrong.
This is a practical reference: what each header does, when it matters, and a common mistake to avoid. At the end you can check any URL with our free URL Inspector, which shows all response headers plus an analysis of the security ones.
Check your headers now: paste any URL into the free URL Inspector. You'll see every response header, a pass/warn/fail analysis of the security headers, the full redirect chain, and the SSL certificate — no signup.
Security headers
| Header | What it does | Common mistake |
|---|---|---|
Strict-Transport-Security | Tells browsers to only ever reach the site over HTTPS, even if a user types http://. The max-age should be at least 31536000 (one year). | Sending it on an HTTP response (browsers ignore it there). Also forgetting includeSubDomains, leaving subdomains unprotected. |
Content-Security-Policy | Whitelists where scripts, styles, frames and other resources may load from. The single most effective defence against XSS. | Using unsafe-inline everywhere "to make it work", which removes most of the protection. |
X-Content-Type-Options | Set to nosniff: stops browsers from guessing file types, which can turn an uploaded file into executable script. | Setting it on HTML pages only — it matters most for user-uploaded files and APIs. |
X-Frame-Options | DENY or SAMEORIGIN: stops other sites from embedding your page in an iframe (clickjacking). | Relying on it alone — CSP's frame-ancestors directive is stronger and replaces it in modern browsers. |
Referrer-Policy | Controls how much referrer data leaves your site when users click outbound links. strict-origin-when-cross-origin is today's sensible default. | Leaving it unset: full URLs (including query strings with personal data) leak to every linked site. |
Permissions-Policy | Denies or allows browser features like camera, microphone and geolocation, including inside embedded iframes. | Omitting it entirely — then any third-party script can request powerful APIs. |
Caching headers
| Header | What it does | Common mistake |
|---|---|---|
Cache-Control | The modern way to control caching. Static assets: public, max-age=31536000, immutable. HTML: no-cache so updates show up immediately. | Long cache on HTML — visitors see stale pages after you deploy. |
ETag | A fingerprint of the response. On the next request the browser sends it back and gets a tiny 304 Not Modified instead of the whole page. | None usually — but weak ETags on cluster setups can cause needless re-downloads. |
Expires | Legacy predecessor of Cache-Control. Ignored when both are present. | Setting Expires and believing it overrides Cache-Control — it doesn't. |
Vary | Tells caches which request headers change the response, e.g. Vary: Accept-Encoding. | Vary: User-Agent — it fragments the cache into hundreds of near-empty entries. |
SEO-relevant headers
| Header | What it does | Common mistake |
|---|---|---|
Link: rel=canonical | HTTP-header version of the canonical tag — useful when the same file is served at multiple URLs and you can't change its HTML. | Conflicting canonicals: header says A, meta tag says B. Google picks one, not necessarily yours. |
X-Robots-Tag | Robots directives for non-HTML files: X-Robots-Tag: noindex keeps a PDF out of search results. | Trying to noindex a URL that also returns 404/redirects — the signal never gets read reliably. |
| Location (3xx responses) | The destination of a redirect. The status code matters too: 301 passes SEO value, 302 mostly doesn't. | Chains of 3+ hops instead of pointing directly at the final URL. See our guide to checking redirect chains. |
Retry-After | With 503: tells crawlers to come back later without treating pages as gone. | Returning 503 during maintenance without it, so Google starts dropping pages. |
Other headers worth knowing
Server/X-Powered-By— reveal technology details. Harmless individually, useful to attackers in aggregate. Many hosts let you remove them.Set-Cookie— always pair withSecure,HttpOnlyandSameSite=Lax(orStrict).Content-Encoding— gzip or brotli. Missing compression can double or triple load time on text-heavy pages.Alt-Svc— advertises HTTP/3 support.
A minimal, sane set for most sites
Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy: frame-ancestors 'self' Cache-Control: no-cache # HTML Cache-Control: public, max-age=31536000, immutable # hashed static assets
Check any URL in seconds
The free URL Inspector fetches the URL, follows every redirect, lists all response headers of the final response, grades the security headers pass/warn/fail, and shows the SSL certificate — including issuer, expiry countdown and chain trust. Nothing is stored and there's no account.
Related: How to check a URL redirect chain · Security headers checker · Page Profile CLI — check headers, meta tags & schema from the terminal · All free tools