What Are HTTP Headers?
HTTP headers are key-value pairs sent between the browser and server with every HTTP request and response. They carry metadata about the request, response, caching behavior, security policies, content type, and more. Headers are invisible to users but critical for how the web works.
How It Works
Request headers are sent by the browser (User-Agent, Accept, Cookie). Response headers are sent by the server (Content-Type, Cache-Control, Set-Cookie). Some headers control caching, others enforce security policies, and many are used for debugging and optimization.
Why It Matters
HTTP headers control security (CSP, HSTS, X-Frame-Options), performance (Cache-Control, ETag), and functionality (CORS, Content-Type). Missing or misconfigured headers can expose your site to attacks, slow down performance, or break cross-origin functionality.
Common Issues
- Missing security headers (CSP, X-Frame-Options, HSTS)
- Incorrect Cache-Control headers causing stale content
- CORS headers blocking legitimate cross-origin requests
- Missing Content-Type headers causing rendering issues