HTTP headers: plainly explained.

HTTP headers are small pieces of metadata sent along with every HTTP request and response. Each header is a name and a value, for example Content-Type: text/html. They travel before the actual content and tell the receiver how to interpret it, whether to store it, who is allowed to read it and how to secure it.

Visitors never see headers, but they shape the speed, security and search visibility of every page.

When a browser requests a page, it sends request headers. The server answers with response headers followed by the body.

GET /pricing HTTP/1.1
Host: www.example.com
Accept-Language: en

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Cache-Control: public, max-age=3600
Strict-Transport-Security: max-age=31536000

You can inspect headers in the Network tab of your browser developer tools or with a command such as curl -I.

• Request headers: sent by the browser, such as User-Agent, Accept-Language and Cookie.
• Response headers: sent by the server, such as Content-Type, Set-Cookie and Location.
• Caching headers: Cache-Control, ETag and Expires control how long content is stored.
• Security headers: protect visitors against common attacks.

• Serve every page over HTTPS and add Strict-Transport-Security once you are sure it works.
• Set long cache lifetimes for static assets and short ones for HTML.
• Return the right status code and Content-Type, since wrong values can prevent indexing or break rendering.
• Avoid leaking server details in headers such as Server or X-Powered-By.
• Test changes on a staging environment: a strict security header can block your own scripts.

Headers sit at the boundary between performance, security and SEO. Through our website services, we configure caching, redirects and security headers at the hosting or CDN level, and we verify them with each launch so that pages are fast, safe and correctly indexed.