What does Cache-Control, Authorization, CORS, and the other HTTP headers mean?
Every HTTP request and response carries a set of HTTP headers telling each side what is going on: which format, which cookies, which cache rules, which permissions. There are dozens of them and most developers remember five and panic at the rest.
Search any header here: by name (Cache-Control), description ("forces HTTPS"), or category (Caching, Security, CORS). Each one has a plain-English explanation, an example value ready to copy, and a list of related headers.
It runs offline because the data is baked in. Instant filter, copy just the name, just the value, or the full `Name: value` line.
How to use it
- Type a name (`Cache-Control`), a description (`forces HTTPS`), or a category into the search box. The list filters instantly.
- Use the Authentication / Caching / CORS / Security / Cookies / Proxies / Other pills to narrow down.
- Direction filter: Request / Response / Both - useful when you specifically want something the server sends back.
- Arrow keys ↑↓ move the highlight, Enter copies the name of the first hit.
- Click a header to see the detail panel: description, example value, related headers. Copy just the name, just the value, or the full `Name: value`.
When this is useful
Everyday situations with HTTP headers:
- CORS configuration - which Access-Control-* headers do you need so frontend X can read API Y? All in one category.
- Security hardening - auditing a server. Check: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy. All flagged as popular.
- Cache and CDN - why does the CDN not cache? Inspect Cache-Control + Vary + Expires + ETag. Understand how they interact.
- Debugging 401/403 - you got a 401 but do not know which scheme to advertise. Look up WWW-Authenticate, line up Authorization.
- Rate limiting - implementing 429 Too Many Requests. Which header tells the client to back off? Retry-After. Example value right here.
- HTTPS migration - how do you enable HSTS? Not just the syntax but the "include preload to be hardcoded into browsers" hint.
- Onboarding - a junior asks "what is X-Forwarded-For?". Send them this page instead of explaining.
Related tools: HTTP status codes for the same idea but for response codes. The HTTP headers inspector shows what a real server returns on a live URL.