HTTP headers & request methods
A reference for common HTTP request and response headers plus the nine standard request methods — to consult when writing APIs or debugging caching, CORS and method semantics.
A searchable reference of common HTTP request and response headers plus the nine standard request methods, covering CORS, caching, security fields and safe/idempotent semantics.
Steps and notes
What is HTTP headers & request methods?
A searchable reference of common HTTP request and response headers, joined by a table of the standard request methods. Instead of digging through RFCs to remember what Strict-Transport-Security does, which direction a header travels, or whether PATCH is idempotent, search by name and read a focused description — with CORS, caching and security headers grouped for fast scanning, and GET/POST/PUT/PATCH/DELETE/OPTIONS marked by their safety and idempotency so you pick the right verb, not just the right header.
- Type a field name (e.g. Cookie) or a purpose keyword (e.g. cache, CORS) in the search box
- The header list filters live
- Each entry shows the field name, direction (request / response) and a short description
- Below the headers, the request-methods table lists each verb with its safe / idempotent flags
- Search matches the field name, the description and the direction
- The request-methods table is always shown under the header reference
Frequently asked questions
- Which security headers should every site send?
- The usual baseline is Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options: nosniff and a frame policy (X-Frame-Options or CSP frame-ancestors). Search each one here for what it does.
- Which headers matter for CORS?
- Requests trigger Origin; responses need Access-Control-Allow-Origin (plus Allow-Methods/Allow-Headers for preflights). The reference groups these so you can debug a blocked request quickly.
- Which headers control caching?
- Cache-Control is the primary switch, with ETag/If-None-Match and Last-Modified/If-Modified-Since driving conditional revalidation. Note that Cache-Control is sent by the server but also honoured by browsers and CDNs.
- What is the difference between PUT and PATCH?
- PUT replaces the whole resource, so it is idempotent — sending the same body again yields the same result. PATCH applies a partial update and is not necessarily idempotent; the server decides. The methods table on this page flags each verb as safe and/or idempotent.
Category: Web
HTTP tools workflow
HTTP status codes → HTTP status checker → HTTP headers & request methods → User-agent parser → Device information → MIME types → Basic auth generator