# The HTTP header - an overview for Internet users

When you visit a website, your browser sends a request to the web server to obtain data or information from it, e.g. an HTML file (i.e. a web page). Both in the request - the [HTTP-Request](https://www.ionos.com/digitalguide/hosting/technical-matters/http-request/ "HTTP request") – and in the server’s response, some meta-information is exchanged in addition to the actual data. This is summarized in the HTTP header. We explain the function of the HTTP header and its most important fields.

## Function of a Header, explained with an example

When the website www.example.com is opened, the web server not only opens the website itself, but also sends out – invisible to users – the following header:

[![Image: Screenshot of HTTP Response Header](https://www.ionos.com/digitalguide/fileadmin/_processed_/1/c/csm_http-response-header_181093208a.webp "Screenshot of HTTP Response Header")](https://www.ionos.com/digitalguide/fileadmin/DigitalGuide/Screenshots_2020/http-response-header.png) Screenshot of HTTP Response Header The individual lines are called “header fields”. Each (except the first) consists of a name/value pair separated by a colon.

Key to the individual symbols:

- **HTTP/1.1** is the valid HTTP protocol version.
- **200 OK** is the [Status-Code](https://www.ionos.com/digitalguide/hosting/technical-matters/the-most-important-http-status-codes-at-a-glance/). It says that the server has received, understood and accepted the request.
- **Content-Encoding** and **Content-Type** tell us about the type of file.
- **Age, Cache-Control, Expires, Vary** and **X-Cache** refer to the caching of the file.
- **Etag** and **Last-Modified** are used for version control of the delivered file.
- **Server** refers to the web server software.
- **Content-Length** is the file size in bytes.

As you can see, this header information is mainly used for **coordination between the client (browser) and the server**. It is ensured that the client can understand the form of the file, that the file is sufficiently up-to-date and that the file size meets the browser’s expectations.

The header lines shown in the example are **only a small part** of the available header fields. In total, there are almost 100 HTTP header fields, of which about 30 are for specifying HTTP requests, about 30 for the server response, and a whole range of other header fields that serve different purposes and are partly (still) not standardized.

The following overview explains the most important header fields.

### HTTP Request (Client Request)

<table>
  <thead>
    <tr>
      <th>Header Field</th>
      <th>Meaning</th>
      <th>Example</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>Accept</td>
      <td>Which content types the client can process; if the field is empty, these are all content types.</td>
      <td>Accept: text/html, application/xml</td>
    </tr>
    <tr>
      <td>Accept-Charset</td>
      <td>Which character sets the client can display.</td>
      <td>Accept-Charset: utf-8</td>
    </tr>
    <tr>
      <td>Accept-Encoding</td>
      <td>Which compressed formats the client supports.</td>
      <td>Accept-Encoding: gzip</td>
    </tr>
    <tr>
      <td>Accept-Language</td>
      <td>Requested language version</td>
      <td>Accept-Language: en-US</td>
    </tr>
    <tr>
      <td>Authorization</td>
      <td>Authentication data (e.g. for a login)</td>
      <td>Basic WjbU7D25zTAlV2tZ7==</td>
    </tr>
    <tr>
      <td>Cache-Control</td>
      <td>Options of the caching mechanism</td>
      <td>Cache-Control: no-cache</td>
    </tr>
    <tr>
      <td>Cookie</td>
      <td>Cookie stored for this server</td>
      <td>Cookie: $Version=1; Content=23</td>
    </tr>
    <tr>
      <td>Content-Length</td>
      <td>Length of the request body</td>
      <td>Content-Length: 212</td>
    </tr>
    <tr>
      <td>Content-Type</td>
      <td>MIME type of the body; relevant for POST and PUT requests</td>
      <td>Content-Type: application/x\_222-form-urlencoded</td>
    </tr>
    <tr>
      <td>Date</td>
      <td>Date and time of the request</td>
      <td>Date: Mon, 9 March 2020 09:02:22 GMT</td>
    </tr>
    <tr>
      <td>Expect</td>
      <td>Sends an expectation to the server, usually the receipt of a large request.</td>
      <td>Expect: 100-continue (the server should send code 100 when it is ready to receive the request)</td>
    </tr>
    <tr>
      <td>Host</td>
      <td>Domain name of the server</td>
      <td>Host: example.com</td>
    </tr>
    <tr>
      <td>If-Match</td>
      <td>Conditional execution of an action, depending on the matching of a transmitted code</td>
      <td>If-Match: „ft678iujhnjio90’pöl”</td>
    </tr>
    <tr>
      <td>If-Modified-Since</td>
      <td>Send only if the requested content has been modified since the specified time</td>
      <td>IF-Modified-Since: Mon 2 Mar 2020 1:00:00 GMT</td>
    </tr>
    <tr>
      <td>If-None-Match</td>
      <td>As above, but specified via an ETag (entity tag, see below)</td>
      <td>If-None-Match: „cxdrt5678iujhgbvb”</td>
    </tr>
    <tr>
      <td>If-Range</td>
      <td>Requests only the part of the content that was changed or is missing in the client cache</td>
      <td>If-Range: Mon 2 Mar 2020 1:00:00 GMT</td>
    </tr>
    <tr>
      <td>If-Unmodified-Since</td>
      <td>Analog IF-Modified-Since</td>
      <td>If-Modified-Since: Mon 2 Mar 2020 1:00:00 GMT</td>
    </tr>
    <tr>
      <td>Max-Forwards</td>
      <td>Defines the maximum number of times the server response may be forwarded</td>
      <td>Max-Forwards: 12</td>
    </tr>
    <tr>
      <td>Proxy-Authorization</td>
      <td>Used to authenticate the client to a proxy server</td>
      <td>Proxy-Authorization: Basic WjbU7D25zTAlV2tZ7==</td>
    </tr>
    <tr>
      <td>Range</td>
      <td>Specifies a portion of the requested content</td>
      <td>Range: bytes=0-9999</td>
    </tr>
    <tr>
      <td>Referrer</td>
      <td>URL of the resource from which the request comes (i.e. from which the link was made)</td>
      <td>Referrer: https://example.com/index.html</td>
    </tr>
    <tr>
      <td>TE</td>
      <td>Accepted extension transfer coding</td>
      <td>TE: gzip, deflate</td>
    </tr>
    <tr>
      <td>User-Agent</td>
      <td>User-Agent of the client (simply put: the browser)</td>
      <td>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36</td>
    </tr>
  </tbody>
</table>

## The most important HTTP request and response headers: An Overview

### HTTP-Response (Server Response)

<table>
  <thead>
    <tr>
      <th>Header Field</th>
      <th>Meaning</th>
      <th>Example</th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td>Accept-Ranges</td>
      <td>Which units the server accepts for the range specifications (see above)</td>
      <td>Accept-Ranges: bytes</td>
    </tr>
    <tr>
      <td>Age</td>
      <td>Number of seconds the object has been in the cache</td>
      <td>Age: 2300</td>
    </tr>
    <tr>
      <td>Allow</td>
      <td>Permitted request types for a specific resource</td>
      <td>Allow: GET, POST, HEAD</td>
    </tr>
    <tr>
      <td>Cache-Control</td>
      <td>Whether and how long the object may be kept in the cache</td>
      <td>Cache-Control: max-age=4800</td>
    </tr>
    <tr>
      <td>Connection</td>
      <td>Preferred type of connection</td>
      <td>Connection: close</td>
    </tr>
    <tr>
      <td>Content-Encoding</td>
      <td>Type of compression</td>
      <td>Content-Encoding: deflate</td>
    </tr>
    <tr>
      <td>Content-Language</td>
      <td>Language of the resource</td>
      <td>Content-Language: en-US</td>
    </tr>
    <tr>
      <td>Content-Length</td>
      <td>Size of the body in bytes</td>
      <td>Content-Length: 135674</td>
    </tr>
    <tr>
      <td>Content-Location</td>
      <td>Location of the file if it comes from a different location than the one requested (e.g. CDN)</td>
      <td>Content-Location: /example.com</td>
    </tr>
    <tr>
      <td>Content-Security-Policy</td>
      <td>Security concepts of the server</td>
      <td>Content-Security-Policy: frame-src ’none‘; object-src ’none‘</td>
    </tr>
    <tr>
      <td>Content-Type</td>
      <td>MIME type of the requested file</td>
      <td>Content-Type: text/tml; charset=utf-8</td>
    </tr>
    <tr>
      <td>Date</td>
      <td>Time of the response</td>
      <td>Date: Mon 2 Mar 2020 1:00:00 GMT</td>
    </tr>
    <tr>
      <td>ETag</td>
      <td>Marks a specific version of the file</td>
      <td>ETag: „vt6789oi8uztgfvbn”</td>
    </tr>
    <tr>
      <td>Expires</td>
      <td>When the file should be considered obsolete</td>
      <td>Expires: Tue 3 Mar 2020 1:00:00 GMT</td>
    </tr>
    <tr>
      <td>Last-Modified</td>
      <td>Time of the last modification of the file</td>
      <td>Last-Modified: Mon 2 Mar 2020 1:00:00 GMT</td>
    </tr>
    <tr>
      <td>Location</td>
      <td>Identifies the location to which the request was forwarded</td>
      <td>Location: https://www.example.com</td>
    </tr>
    <tr>
      <td>Proxy-Authenticate</td>
      <td>Says if and how the client must authenticate to the proxy</td>
      <td>Proxy-Authenticate: Basic</td>
    </tr>
    <tr>
      <td>Retry-After</td>
      <td>Sets from when the client should request again if the resource is temporarily unavailable (date or seconds)</td>
      <td>Retry-After: 300</td>
    </tr>
    <tr>
      <td>Server</td>
      <td>Identification of the server</td>
      <td>Server: Apache</td>
    </tr>
    <tr>
      <td>Set-Cookie</td>
      <td>Sets a cookie at the client</td>
      <td>Set-Cookie: UserID=XY; Max-Age=3800; Version=1</td>
    </tr>
    <tr>
      <td>Transfer-Encoding</td>
      <td>Compression method</td>
      <td>Transfer-Encoding: gpzip</td>
    </tr>
    <tr>
      <td>Vary</td>
      <td>Sets which header fields should be considered as varying if a file is requested from the cache.</td>
      <td>Vary: User-Agent (= the server holds different file versions depending on the user agent)</td>
    </tr>
    <tr>
      <td>Via</td>
      <td>Which proxies the response was sent through.</td>
      <td>Via: 1.1www.example.com</td>
    </tr>
  </tbody>
</table>


This is a markdown version of: [https://www.ionos.com/digitalguide/hosting/technical-matters/http-header/](https://www.ionos.com/digitalguide/hosting/technical-matters/http-header/) for AI/LLM consumption.