HTTP Headers
Articles, guides, and in-depth tips for the HTTP Headers — everything you need to get the most out of it.
✦ AI-powered — understands natural language
HSTS Doesn't Protect the First Connection — Why the Preload List Exists and How to Use It Safely
HTTP/2 and HTTP/3 Changed the Transport, Not the Headers — Here's What That Means in Practice
HTTP/2 and HTTP/3 changed the transport layer — binary framing, header compression, multiplexing, QUIC — but the headers you see in a response inspector are mostly the same HTTP/1.1 headers. Here's what HTTP/2's HPACK compression and multiplexing actually do, what the :method/:path/:status pseudo-headers mean, how to identify which HTTP version served a response, and what the Alt-Svc h3 header signals about HTTP/3 availability.
Cache-Control Demystified: Why "no-cache" Doesn't Mean "Don't Cache," and Other Misread Directives
"Cache-Control: no-cache" doesn't mean "don't cache this" — it means "cache it, but check with the server before using the cached copy, every time." This single misconception is responsible for much "why is this still cached" confusion. Here's the real no-cache vs no-store distinction, why private vs public matters for shared CDN caches, what must-revalidate does when the server is unreachable, and why Vary headers matter for content that differs by language or compression.
CORS Explained: Why It's a Server-Side Fix for a Browser-Side Error, and How to Debug It
A CORS error appears in the browser console as if it's a client-side problem — but it's actually caused by missing response headers from the server, which is why "it works in curl/Postman but fails in the browser" is the classic CORS symptom. Here's same-origin policy, the key CORS headers, simple vs preflighted requests, and a systematic debugging approach.
HTTP Caching Deep Dive: Cache-Control Directives, ETags, and Content Hashing Strategy
Content-hashed filenames with max-age=31536000 can eliminate network requests for returning users. Here's the complete HTTP caching strategy: Cache-Control directives in depth, ETags and conditional requests, the Vary header pitfall, CDN cache busting, and a practical caching strategy by resource type.
HTTP Security Headers: What Most Sites Are Missing and How to Fix It
Security headers most sites are missing, what HSTS, CSP, and X-Frame-Options actually prevent, how Cache-Control directives work, and which headers reveal server information you should hide in production.
HTTP Headers Checker — Inspect Response Headers for Any URL Instantly
Learn what HTTP response headers are, what the key headers (Cache-Control, HSTS, CSP, CORS, X-Frame-Options) mean, and how to use a free HTTP headers checker for security audits and debugging.
