Content-Security-Policy
Defines the sources from which a document may load and execute different kinds of resources.
HTTP Scanner reference
HTTP Response Header Reference
Browse practical explanations of common HTTP response headers, including syntax, examples, implementation mistakes, and security considerations.
Check a website’s response headersSecurity and privacy
Strict-Transport-Security
Tells a browser to use HTTPS for future requests to the responding host over a stated period.
X-Content-Type-Options
Controls whether a browser may infer a resource type other than the declared media type.
X-Frame-Options
Specifies the conditions under which a response may be displayed within a frame or iframe.
Referrer-Policy
Defines which portions of a referring URL a browser sends when it requests another resource.
Permissions-Policy
Declares which browser features are available to the document and to embedded browsing contexts.
Cross-Origin-Opener-Policy
Sets the browsing-context group relationship between this document and cross-origin opened documents.
Cross-Origin-Embedder-Policy
Specifies requirements for embedding cross-origin resources within a document.
Cross-Origin-Resource-Policy
Declares which origins may request a resource in certain cross-origin contexts.
Clear-Site-Data
Requests that a browser clear selected data types associated with the response origin.
Origin-Agent-Cluster
Indicates whether the origin should use a dedicated browser agent cluster.
X-Permitted-Cross-Domain-Policies
Describes a response policy for legacy cross-domain policy-file handling by compatible clients.
X-DNS-Prefetch-Control
Controls whether compatible browsers may pre-resolve domain names referenced by a document.
Infrastructure and disclosure
Server
Identifies software or services that handled the response on the server side.
X-Powered-By
Provides an optional label for the framework, runtime, or platform used to generate a response.
X-AspNet-Version
Reports the version of ASP.NET that generated the response when an application includes it.
X-Runtime
Reports the server-side processing duration or runtime information for a response.
X-Generator
Provides an optional identifier for software that created the response content.
Via
Lists intermediary protocols and hosts through which the message has been forwarded.
Caching
Cache-Control
Defines directives that govern how browsers and intermediary caches store and reuse a response.
Age
Indicates the estimated number of seconds a response has been stored in a cache.
Expires
Supplies a date and time after which a cached response is considered stale.
ETag
Provides an opaque identifier for a specific version of a resource representation.
Last-Modified
Reports the date and time when the server considers the selected representation last changed.
Vary
Names request header fields that can cause caches to select a different stored response.
Content and representation
Content-Type
Declares the media type and optional character encoding of the response representation.
Content-Length
States the size in bytes of the response body when that size is known in advance.
Content-Encoding
Identifies the content codings applied to the representation before it is sent to the recipient.
Content-Language
Identifies the natural language or languages intended for the response representation.
Content-Disposition
Describes how a client should present a response, including an optional suggested file name.
Content-Location
Provides a URI that identifies a location associated with the selected representation.
Accept-Ranges
Indicates whether the resource supports range requests and the unit used for those ranges.
CORS
Access-Control-Allow-Origin
Identifies the origin allowed to access the response from a cross-origin browser request.
Access-Control-Allow-Credentials
Indicates whether a cross-origin browser request may include credentials in its response handling.
Access-Control-Allow-Methods
Lists the HTTP methods permitted for a cross-origin request in the relevant CORS context.
Access-Control-Allow-Headers
Lists request header fields permitted for a cross-origin request in the relevant CORS context.
Access-Control-Expose-Headers
Lists response header fields that browser scripts may access from a cross-origin response.
Access-Control-Max-Age
Specifies how long a browser may reuse the result of a CORS preflight request.
Cookies and authentication
Set-Cookie
Instructs a client to store a cookie with attributes that define its scope and lifetime.
WWW-Authenticate
Describes one or more authentication challenges that a client may use for the requested resource.
Redirects and response control
Location
Provides a URI used to identify a redirect target or the location of a newly created resource.
Retry-After
Indicates when a client may make another request after a response that asks it to wait.
Linking and performance metadata
Link
Supplies typed relationships between the response and other resources identified by URIs.
Server-Timing
Communicates named timing metrics collected while a server processed the request.
Timing-Allow-Origin
Identifies origins that may access detailed timing information for the response resource.