Bundled, not fetched
Every status code, header, media type and method below ships with this page — the tool fetches nothing, so it works offline. It is a curated reference, not a live mirror of the IANA registries: the 135 headers and 94 media types here are the ones you actually meet, not the several hundred (and several thousand) those registries hold.
One box searches all four datasets at once — press / to jump here. Click any row for the full explanation and a copy button. Status codes 85 100 Continue The server has read the request headers and the client should send the body. Only ever sent in reply to a request carrying Expect: 100-continue, which lets a client avoid uploading a large body that would be rejected outright. 101 Switching Protocols The server is switching to the protocol named in the request's Upgrade header. This is how a WebSocket handshake completes over HTTP/1.1. 102 Processing A WebDAV interim response telling the client the request was accepted and is still being worked on, so it should not time out. Largely superseded by 103 Early Hints and by chunked progress reporting. 103 Early Hints Sent before the real response so the browser can start preloading assets named in Link headers while the server is still generating the page. Safe to ignore; the final status follows. 200 OK The request succeeded and the body is the requested representation. The default success code for GET, and the right one for POST/PATCH when you return the resulting resource. 201 Created The request created one or more new resources. The Location header should point at the primary one; the body typically describes it. 202 Accepted The request was accepted for processing but nothing has happened yet — the deliberate answer for asynchronous jobs. Give the client somewhere to poll, because 202 promises nothing about the eventual outcome. 203 Non-Authoritative Information Like 200, but a proxy or transforming intermediary modified the payload it received from the origin. Rare in practice outside content-filtering middleboxes. 204 No Content Success, and there is deliberately nothing to send back. The usual answer to a DELETE, or to a PUT/PATCH where the client already knows the new state; browsers stay on the current page. 205 Reset Content Success, and the client should clear the form or document view that produced the request. Essentially a 204 with a 'reset the input' instruction attached. 206 Partial Content The response carries only the byte ranges asked for by the request's Range header. This is what powers resumable downloads and video seeking; the body is framed by Content-Range. 207 Multi-Status A WebDAV response whose XML body carries a separate status for each resource affected — the operation may have partly succeeded and partly failed. 208 Already Reported Inside a WebDAV 207 body, marks a resource whose members were already enumerated by an earlier part of the same response, so they are not repeated. 218 This is fine Returned by some Apache configurations instead of a 4xx/5xx when a request fails but the operator wants a 2xx on the wire. Not registered with IANA and not understood by anything else. Unofficial 226 IM Used The response is the result of applying one or more instance-manipulations (such as a delta encoding) to the current resource, as requested by A-IM. Almost never seen outside RFC 3229 implementations. 300 Multiple Choices The request maps to more than one representation and the server is asking the client (or user) to pick. Rarely implemented; agent-driven negotiation never caught on. 301 Moved Permanently The resource has a new canonical URL in Location and clients should update links and bookmarks. Historically clients rewrite POST to GET when following it — use 308 if you need the method preserved. 302 Found A temporary redirect. Because most clients historically rewrote POST to GET when following it, its semantics are ambiguous — prefer 303 (see other resource) or 307 (repeat the same method). 303 See Other Points the client at a different resource, to be fetched with GET regardless of the original method. The correct finish to a POST when you want the browser's reload to be harmless (POST/redirect/GET). 304 Not Modified The client's cached copy is still fresh, so no body is sent. Produced when a conditional request (If-None-Match / If-Modified-Since) matches the current ETag / Last-Modified. 305 Use Proxy Told the client to repeat the request through a specified proxy. Deprecated for security reasons — clients must not honour it. Deprecated 306 (Unused) Reserved. Defined in a draft of HTTP/1.1 as 'Switch Proxy' and never shipped; the number stays reserved so it can't be reused. Deprecated 307 Temporary Redirect Same as 302 but the method and body must be preserved — a POST stays a POST. Use it when you want an unambiguous temporary redirect. 308 Permanent Redirect The permanent counterpart of 307: new canonical URL, and the method and body are preserved. The modern replacement for 301 on non-GET endpoints. 400 Bad Request The server cannot or will not process the request because it is malformed — bad syntax, invalid framing, or a body that fails schema validation. The catch-all client error; prefer a more specific 4xx when one fits. 401 Unauthorized Authentication is required or the credentials supplied were not accepted. It must carry a WWW-Authenticate header describing how to authenticate. Despite the name it means 'unauthenticated' — use 403 for a known user who lacks permission. 402 Payment Required Reserved for future use and never standardised into a payment protocol. Some APIs repurpose it to mean 'quota exhausted, upgrade your plan'. 403 Forbidden The server understood the request and refuses to authorise it; repeating it with the same credentials will not help. Use 404 instead when even revealing the resource's existence is a leak. 404 Not Found No representation exists for this URL, and the server is not saying whether that is permanent. Also the polite way to hide a resource from someone not allowed to know it exists. 405 Method Not Allowed The URL exists but does not support this method — for example a POST to a read-only endpoint. The response must list the supported methods in Allow. 406 Not Acceptable No representation matches the client's Accept, Accept-Language or Accept-Encoding constraints. Servers are allowed to ignore this and send their preferred representation instead, which most do. 407 Proxy Authentication Required Like 401, but the challenge comes from a proxy between client and origin. Carries Proxy-Authenticate, and the client answers with Proxy-Authorization. 408 Request Timeout The client did not finish sending the request within the server's idle window. Often emitted when an idle keep-alive connection is being reaped, in which case the client may simply retry. 409 Conflict The request conflicts with the resource's current state — a duplicate unique key, an edit against a stale version, or a state machine that forbids this transition. The body should explain enough for the client to resolve it. 410 Gone The resource existed and has been permanently removed, with no forwarding address. A deliberate, stronger statement than 404 — useful for telling crawlers to drop a URL. 411 Length Required The server refuses the request because it has no Content-Length. Typically from servers that will not accept a chunked body on an endpoint. 412 Precondition Failed A conditional header such as If-Match or If-Unmodified-Since did not hold, so the request was not applied. This is how optimistic concurrency control reports a lost update. 413 Content Too Large The request body exceeds what the server is willing to accept. If the limit is temporary the response may include Retry-After. Called 'Payload Too Large' before RFC 9110. 414 URI Too Long The request target is longer than the server will parse — usually a GET that should have been a POST, or a redirect loop appending query parameters. 415 Unsupported Media Type The body's Content-Type (or Content-Encoding) is not one this endpoint accepts — for example form-encoded data sent to a JSON-only API. 416 Range Not Satisfiable None of the requested byte ranges overlap the resource — typically a start offset past the end of the file. The response should carry Content-Range: bytes */<length>. 417 Expectation Failed The expectation in the request's Expect header cannot be met by at least one hop. In practice this means Expect: 100-continue was refused. 418 I'm a Teapot A joke from the 1998 Hyper Text Coffee Pot Control Protocol: the teapot refuses to brew coffee. IANA reserves 418 as '(Unused)' precisely so nobody assigns it a real meaning, and some frameworks return it as a deliberate no-op. Unofficial 419 Page Expired Laravel returns this when a form's CSRF token is missing or stale, usually because the session expired while the page was open. Not registered with IANA. Unofficial 420 Enhance Your Calm / Method Failure Two unrelated vendor uses share this number: the old Twitter Search API returned it for rate limiting, and Spring's WebDAV support used 'Method Failure'. Neither is registered — use 429 for rate limiting. Unofficial 421 Misdirected Request The connection this request arrived on is not authoritative for the requested authority. Mostly an HTTP/2 concern, where a client may coalesce several hostnames onto one connection. 422 Unprocessable Content The syntax is fine and the media type is understood, but the content is semantically wrong — valid JSON that fails business rules. The usual choice for validation errors in JSON APIs. Called 'Unprocessable Entity' before RFC 9110. 423 Locked The WebDAV resource, or its parent, is locked and the request has no matching lock token. 424 Failed Dependency A WebDAV request failed because another action it depended on failed — for example a member of the same atomic operation. 425 Too Early The server refuses to process a request sent in TLS 1.3 early data, because replaying it would not be safe. The client should retry once the handshake completes. 426 Upgrade Required The server refuses this request on the current protocol and names the required one in Upgrade — for example demanding TLS or HTTP/2. 428 Precondition Required The server requires the request to be conditional, so that a client cannot blindly overwrite a resource it has not re-read. Answer it by resending with If-Match. 429 Too Many Requests The client has been rate limited. Should include Retry-After, and commonly carries vendor X-RateLimit-* or the standard RateLimit headers describing the budget. 431 Request Header Fields Too Large The request's headers are collectively (or individually) too big. In the wild this is almost always an oversized Cookie header. 440 Login Time-out Microsoft IIS returns this when the session has expired and the client must log in again. Not registered with IANA. Unofficial 444 No Response An nginx-internal code: the configuration told nginx to close the connection with no response at all, typically to drop malicious traffic. It never appears on the wire — only in access logs. Unofficial 449 Retry With Microsoft IIS extension meaning the request should be retried after performing the action described in the body. Not registered with IANA. Unofficial 451 Unavailable For Legal Reasons Access is denied because of a legal demand — a court order, a takedown, or a geographic block required by law. The response should link to the blocking authority via Link: rel="blocked-by". The number is a nod to Fahrenheit 451. 494 Request Header Too Large nginx-internal code logged when request headers exceed the configured buffer; nginx sends 400 to the client. Not registered with IANA. Unofficial 495 SSL Certificate Error nginx-internal code logged when a client certificate was presented but failed verification. Not registered with IANA. Unofficial 496 SSL Certificate Required nginx-internal code logged when a client certificate was required but none was presented. Not registered with IANA. Unofficial 497 HTTP Request Sent to HTTPS Port nginx-internal code logged when a plaintext request arrives on a TLS listener. Not registered with IANA. Unofficial 498 Invalid Token Esri ArcGIS returns this for an expired or otherwise invalid token. Not registered with IANA. Unofficial 499 Client Closed Request nginx logs this when the client disconnected before the server produced a response — the classic signature of a user hitting stop, or of an upstream slower than the client's timeout. It is never sent to the client. Esri ArcGIS separately uses 499 for 'Token Required'. Unofficial 500 Internal Server Error An unhandled failure on the server with no more specific code available. If you can name the failure — bad gateway, overloaded, timeout — a more specific 5xx tells operators far more. 501 Not Implemented The server does not support the functionality required — typically an unrecognised method. Distinct from 405, which means the method is known but not allowed here. 502 Bad Gateway A proxy or load balancer got an invalid — or no — response from the upstream it forwarded to. In practice: the app server is down, crashed mid-response, or spoke a protocol the proxy could not parse. 503 Service Unavailable The server is temporarily unable to handle the request — overloaded, or down for maintenance. Explicitly transient, so include Retry-After when you know how long. 504 Gateway Timeout A proxy gave up waiting for the upstream server. Distinguishes 'the backend was too slow' from 502's 'the backend answered with garbage'. 505 HTTP Version Not Supported The server refuses the major HTTP version used in the request line. 506 Variant Also Negotiates A transparent content-negotiation misconfiguration: the chosen variant is itself a negotiable resource, so negotiation would loop. 507 Insufficient Storage The WebDAV server cannot store the representation needed to complete the request — it is out of space or quota. 508 Loop Detected A WebDAV operation was aborted because it encountered an infinite loop while traversing bindings. 509 Bandwidth Limit Exceeded Emitted by the Apache bandwidth-limit module and by control panels such as cPanel when an account exceeds its transfer allowance. Not registered with IANA. Unofficial 510 Not Extended The request needs further extensions declared under the HTTP Extension Framework. That framework was moved to Historic status, so this code is obsolete. Deprecated 511 Network Authentication Required You are behind a captive portal: the network, not the origin server, is intercepting the request and demanding you log in. Never sent by origin servers themselves. 520 Web Server Returned an Unknown Error Cloudflare's catch-all when the origin returned something it could not interpret — an empty reply, a connection reset, or a malformed response. Not registered with IANA. Unofficial 521 Web Server Is Down Cloudflare could not open a TCP connection to the origin — usually the origin is offline or firewalling Cloudflare's IPs. Not registered with IANA. Unofficial 522 Connection Timed Out Cloudflare's TCP handshake with the origin did not complete in time — packet loss, an overloaded origin, or a dropping firewall. Not registered with IANA. Unofficial 523 Origin Is Unreachable Cloudflare could not route to the origin at all — typically bad DNS records for the origin host. Not registered with IANA. Unofficial 524 A Timeout Occurred Cloudflare connected to the origin successfully but the origin did not finish the response within Cloudflare's window (100 seconds by default). Not registered with IANA. Unofficial 525 SSL Handshake Failed The TLS handshake between Cloudflare and the origin failed — usually no shared cipher or protocol version. Not registered with IANA. Unofficial 526 Invalid SSL Certificate Cloudflare is in Full (strict) mode and the origin's certificate could not be validated — expired, self-signed, or wrong hostname. Not registered with IANA. Unofficial 527 Railgun Error A Cloudflare Railgun connection to the origin failed. Railgun has been retired, so this is effectively historical. Not registered with IANA. Unofficial Deprecated 530 Cloudflare Error (see 1xxx code) Cloudflare returns 530 alongside a five-digit 1xxx error code in the body, which carries the real meaning (1000 DNS points to prohibited IP, 1020 firewall rule, and so on). Pantheon separately uses 530 for 'Site Frozen'. Not registered with IANA. Unofficial Headers 135 req AcceptMedia types the client can handle, ranked with q-values. The server picks one and echoes it in Content-Type; if nothing matches it may answer 406 or just send its preferred form. req Accept-CharsetWhich character encodings the client accepts. Deprecated — everything is UTF-8 now, and servers should ignore it. Deprecated req+res Accept-EncodingCompression codings the client can decode. The server's choice comes back in Content-Encoding, and the response should carry Vary: Accept-Encoding so caches don't serve gzip to a client that can't read it. req Accept-LanguageNatural languages the user prefers, ranked. Useful for choosing a translation, but a notorious fingerprinting vector, so treat it as a hint rather than identity. res Accept-PatchWhich patch document formats this resource accepts on a PATCH request. Usually advertised alongside a 415. res Accept-PostWhich media types this resource accepts in a POST body. The POST counterpart of Accept-Patch. res Accept-RangesAdvertises that the server supports range requests on this resource — which is what enables resumable downloads and video seeking. none explicitly says it does not. res VaryNames the request headers that were used to select this representation, so caches key on them too. Forgetting Vary: Accept-Encoding or Vary: Origin is the single most common cause of a cache serving the wrong body to the wrong client. req+res Content-TypeThe media type of the body, plus parameters such as charset or a multipart boundary. Getting this wrong is why a JSON API returns text or a download opens in the browser. req+res Content-LengthSize of the body in bytes. Omitted when the length isn't known up front, in which case HTTP/1.1 uses chunked Transfer-Encoding instead. req+res Content-EncodingCompression applied to the body, which the recipient must undo before reading it. Note this describes the *encoding*, not the format — Content-Type still says what's inside. req+res Content-LanguageThe natural language of the body's intended audience. Describes what was sent, unlike Accept-Language which asks. req+res Content-LocationThe specific URL of the representation in this message, when it differs from the request target — for example the concrete /report.pdf behind a negotiated /report. Not a redirect. res Content-DispositionTells the browser to display the body inline or download it, and supplies a filename. Use the filename* form for non-ASCII names. Also used per-part inside multipart/form-data bodies. res Content-RangeWhich part of the full representation a 206 body covers, and the total size. On a 416 it takes the form bytes */<length> to tell the client how long the resource really is. req+res Content-DigestIntegrity digest of the *bytes actually sent* (after any Content-Encoding). Replaces the old Digest header. req+res Repr-DigestIntegrity digest of the full representation independent of encoding or range, so it stays stable whether the body arrived gzipped or in pieces. req+res Want-Content-DigestAsks the other side to include a Content-Digest, and with which algorithms, ranked by preference. req+res DigestOlder integrity digest header. Obsoleted by Content-Digest / Repr-Digest, which fixed its ambiguity about what exactly was hashed. Deprecated req+res TrailerLists header fields that will appear after a chunked body — used for values only known once the body is complete, such as a digest. req+res Cache-ControlThe primary caching directive set. On responses: max-age, s-maxage, no-cache (revalidate before use), no-store (never write to disk), private/public, immutable, stale-while-revalidate. On requests it lets the client override, e.g. no-cache for a hard reload. res AgeHow many seconds ago this response was generated at the origin, as estimated by the cache serving it. A non-zero Age proves you got a cache hit. res ExpiresAn absolute expiry date for the response. Legacy: Cache-Control: max-age wins wherever both are present. Expires: 0 is a common way to say 'already stale'. req+res PragmaHTTP/1.0 relic; only Pragma: no-cache was ever meaningful. Deprecated — use Cache-Control. Deprecated req+res WarningCarried extra information about staleness or transformations. Removed from the HTTP caching specification in RFC 9111 because nothing acted on it. Deprecated res Clear-Site-DataInstructs the browser to wipe data this origin has stored — cookies, storage, caches, or all of it. The clean way to finish a logout. res ETagAn opaque version tag for this representation. Strong by default; a W/ prefix means weak (semantically equivalent, byte-wise possibly not). Clients send it back in If-None-Match or If-Match. res Last-ModifiedWhen the representation last changed, to one-second resolution. Weaker than an ETag — two edits within the same second are indistinguishable. req If-None-MatchDo the request only if the resource's ETag does *not* match. The normal cache revalidation path: a match yields 304 and no body. If-None-Match: * also means 'only create if it doesn't exist'. req If-MatchDo the request only if the ETag matches. This is optimistic concurrency control for writes — a mismatch gives 412 instead of silently overwriting someone else's edit. req If-Modified-SinceDate-based revalidation: send the body only if it changed after this time, otherwise 304. Used when the server offers Last-Modified but no ETag. req If-Unmodified-SinceDate-based write guard: apply the request only if the resource has not changed since this time, otherwise 412. req If-RangeMakes a range request conditional: if the ETag or date still matches, send the range (206); if not, send the whole resource (200). Exactly what a resumed download needs. req RangeAsks for only part of the resource. Multiple ranges are allowed and produce a multipart/byteranges body. req AuthorizationCredentials for the origin server: a scheme plus its parameters. Bearer for OAuth/JWT, Basic for base64 user:pass, Digest, or a vendor signing scheme. res WWW-AuthenticateSent with 401 to say how to authenticate: which schemes, which realm, and — for OAuth — why the token was rejected. A 401 without it is technically malformed. req Proxy-AuthorizationCredentials for an intermediate proxy rather than the origin. Hop-by-hop: it is consumed by the proxy and not forwarded. res Proxy-AuthenticateThe proxy's authentication challenge, sent with 407. req CookieAll cookies the browser has decided apply to this request, joined by ; . Sent automatically — which is exactly why CSRF exists. res Set-CookieStores one cookie; repeat the header for more. HttpOnly hides it from JavaScript, Secure restricts it to HTTPS, SameSite=Lax|Strict|None controls cross-site sending, and Partitioned binds it to the top-level site (CHIPS). req OriginThe scheme/host/port the request came from, with no path — deliberately less revealing than Referer. Sent on all cross-origin requests and on same-origin POSTs; it is what CORS and CSRF checks key on. res Access-Control-Allow-OriginWhich origin may read this response. Either a single origin or *; a list is not allowed, so servers echo the request's Origin and add Vary: Origin. * cannot be combined with credentials. res Access-Control-Allow-CredentialsSet to true to let the browser expose a response to a credentialed (cookie or client-cert) cross-origin request. Requires an explicit origin, never *. res Access-Control-Allow-MethodsMethods permitted on the real request. Only meaningful on the preflight (OPTIONS) response. res Access-Control-Allow-HeadersRequest headers the real request may carry. Anything beyond the CORS-safelisted set (including Content-Type: application/json and Authorization) must be listed here or the preflight fails. res Access-Control-Expose-HeadersWhich response headers JavaScript is allowed to read cross-origin. Without it a fetch() sees only the seven safelisted ones — this is why your custom X-Total-Count comes back undefined. res Access-Control-Max-AgeHow many seconds the browser may cache this preflight result. Browsers cap it well below whatever you send (Chrome at 2 hours, Firefox at 24). req Access-Control-Request-MethodSent by the browser on a preflight to ask whether this method would be allowed. You never set it yourself. req Access-Control-Request-HeadersSent by the browser on a preflight, listing the non-safelisted headers the real request wants to use. res Timing-Allow-OriginLets the named origins read detailed Resource Timing numbers (DNS, TLS, transfer size) for this resource. Without it cross-origin timings are zeroed. res Content-Security-PolicyThe main XSS defence: a per-directive allowlist of where scripts, styles, images, frames and connections may come from. A nonce or hash on script-src plus strict-dynamic is the modern shape; 'unsafe-inline' undoes most of the benefit. res Content-Security-Policy-Report-OnlyEvaluates a policy and reports violations without blocking anything. How you roll out a CSP without breaking the site on day one. res Strict-Transport-SecurityHSTS: tells the browser to use HTTPS for this host for the next max-age seconds, upgrading even user-typed http:// URLs. includeSubDomains and preload extend it — and are hard to undo, so commit deliberately. res X-Frame-OptionsClickjacking defence: DENY or SAMEORIGIN stops the page being framed. Superseded by CSP frame-ancestors, but still worth sending for old browsers. The ALLOW-FROM variant never worked reliably. res X-Content-Type-Optionsnosniff stops the browser second-guessing your Content-Type, which is how a user-uploaded .txt gets executed as script. Effectively mandatory; there is no reason to omit it. res Referrer-PolicyControls how much of the current URL is leaked in the Referer header of outgoing requests. strict-origin-when-cross-origin is the modern browser default; no-referrer is the strictest. res Permissions-PolicyAllow-lists powerful browser features (camera, microphone, geolocation, payment, fullscreen) per origin, for the page and anything it frames. Successor to Feature-Policy. res Cross-Origin-Opener-Policysame-origin severs the window.opener relationship with cross-origin documents, isolating your browsing context. Together with COEP it unlocks SharedArrayBuffer and precise timers. res Cross-Origin-Embedder-Policyrequire-corp refuses to load any cross-origin subresource that has not explicitly opted in. The other half of cross-origin isolation — and a common cause of images suddenly failing to load. res Cross-Origin-Resource-PolicyDeclares who may embed *this* resource: same-origin, same-site, or cross-origin. The opt-in that COEP looks for. res Origin-Agent-ClusterRequests that this document get its own agent cluster keyed by origin rather than site, improving isolation at the cost of losing synchronous cross-origin DOM access. res Expect-CTRequired Certificate Transparency logging for the site's certificate. Obsolete — CT enforcement is now unconditional in major browsers. Deprecated res X-XSS-ProtectionControlled a legacy browser XSS auditor. Removed from every current browser, and its mode=block behaviour introduced vulnerabilities of its own — send 0 or nothing, and use CSP instead. Deprecated res X-Permitted-Cross-Domain-PoliciesRestricted Adobe Flash and PDF cross-domain policy files. Only still relevant for embedded PDF readers; none is the safe value. Non-standard res Reporting-EndpointsNames the URLs that browser-generated reports (CSP violations, deprecations, crashes) should be posted to. res Report-ToThe earlier JSON-object form of reporting-group configuration. Superseded by Reporting-Endpoints. Deprecated res NELNetwork Error Logging: asks the browser to report failed requests to this origin (DNS, TLS and connection failures your server never sees) to a reporting group. req Sec-Fetch-SiteBrowser-set: the relationship between initiator and target — same-origin, same-site, cross-site or none (user-typed). The strongest single signal for a server-side CSRF check. req Sec-Fetch-ModeBrowser-set: the request mode — navigate, cors, no-cors, same-origin or websocket. Lets a server reject a document endpoint being loaded as an image. req Sec-Fetch-DestBrowser-set: what the result will be used as — document, script, image, style, font, empty, and so on. req Sec-Fetch-UserSent as ?1 only when a navigation was triggered by real user activation — a click, not script. req Sec-PurposeMarks a speculative request such as a prefetch or prerender, so the server can avoid counting it as a real visit or performing side effects. res Accept-CHLists which client hints the server would like the browser to send on subsequent requests to this origin. Hints are opt-in precisely to limit passive fingerprinting. req Sec-CH-UAThe low-entropy brand/major-version list that replaces User-Agent parsing. Deliberately includes a nonsense brand to break naive string matching. req Sec-CH-UA-Mobile?1 on a mobile device, ?0 otherwise. Sent by default, unlike the high-entropy hints. req Sec-CH-UA-PlatformThe operating system name, e.g. "macOS" or "Windows". Sent by default. req Sec-CH-Prefers-Color-SchemeThe user's light/dark preference, so the server can send the right theme on the first byte instead of flashing. Must be requested via Accept-CH. req DPRDevice pixel ratio, so the server can pick an image density. Superseded by the Sec-CH-DPR spelling. Deprecated req Save-Dataon when the user has asked for reduced data usage. A cue to send smaller images or skip prefetching — and worth adding to Vary if you act on it. req DownlinkApproximate downlink bandwidth in Mbit/s, rounded for privacy. Experimental and Chromium-only. Non-standard req ECTEffective connection type — slow-2g, 2g, 3g or 4g — derived from observed round-trip time and throughput. Experimental and Chromium-only. Non-standard req RTTApproximate round-trip time in milliseconds, rounded to 25 ms for privacy. Experimental and Chromium-only. Non-standard req HostThe authority being addressed. Mandatory in HTTP/1.1 — it is what makes virtual hosting possible. HTTP/2 and HTTP/3 use the :authority pseudo-header instead. req+res ConnectionHop-by-hop connection options — keep-alive, close, or the name of a header to strip before forwarding. Forbidden in HTTP/2 and HTTP/3. req+res Keep-AliveHints at how long an idle persistent connection will be held open and how many requests it will serve. Informational only, and never standardised. Non-standard req+res Transfer-EncodingHow the body is framed on this hop — in practice always chunked, used when the length is unknown up front. Disagreements between this and Content-Length are the basis of request-smuggling attacks. Not allowed in HTTP/2 or HTTP/3. req+res UpgradeProposes switching to another protocol on this connection — the WebSocket handshake, or HTTP/1.1 to h2c. A successful switch answers 101. req ExpectThe only defined value is 100-continue: hold the body until the server signals it will accept the request. Useful before large uploads; a refusal is 417. req TETransfer codings the client will accept, and whether it can handle trailer fields. Hop-by-hop. res Alt-SvcAdvertises the same resource on another endpoint or protocol — how a server steers clients onto HTTP/3 after a first HTTP/2 connection. req Alt-UsedNames the alternative service the client actually connected to, so the origin can tell which endpoint served the request. req+res PriorityExtensible prioritisation: u sets urgency 0–7 (lower is more urgent) and i marks the response as incremental (usable as it arrives). req Early-DataSet to 1 by an intermediary to warn the origin that this request arrived in TLS early data and may be a replay. Answer 425 if that is not acceptable. req+res ViaThe chain of proxies a message passed through, appended to by each hop. Useful for spotting an unexpected middlebox and for loop detection. req ForwardedThe standardised replacement for the X-Forwarded-* family: original client IP, protocol and host in one structured field. req X-Forwarded-ForDe-facto list of client and proxy IPs, leftmost being the original client. Never trust it beyond the hops you control — anything further left is attacker-controlled. Non-standard req X-Forwarded-HostThe Host the client originally requested, before a proxy rewrote it. Non-standard but universally implemented. Non-standard req X-Forwarded-ProtoThe scheme of the original request. This is how an app behind a TLS-terminating load balancer knows it is 'really' on HTTPS. Non-standard req X-Real-IPA single client IP, set by nginx and similar proxies. Simpler than X-Forwarded-For and just as untrustworthy from untrusted hops. Non-standard req Max-ForwardsLimits how many proxies a TRACE or OPTIONS request may traverse; each hop decrements it. A traceroute for HTTP. res LocationWhere to go next on a 3xx, or where the newly created resource lives on a 201. Relative URLs are permitted and resolved against the request target. res RefreshAsks the browser to reload or navigate after N seconds — the header form of the meta refresh tag. Never standardised but supported everywhere; a 3xx is almost always better. Non-standard res LinkTyped relationships to other resources, in the same vocabulary as HTML <link>. Used for preload hints, pagination (next/prev), canonical, and the blocked-by reference on a 451. res Retry-AfterHow long to wait before retrying, as seconds or an HTTP date. Belongs on 429 and 503, and on a 3xx when the resource is temporarily elsewhere. req Sec-WebSocket-KeyA random 16-byte nonce, base64-encoded, that the server hashes back into Sec-WebSocket-Accept. It proves the peer understood the handshake — it is not security. res Sec-WebSocket-AcceptThe server's computed answer to Sec-WebSocket-Key, sent with 101 to complete the handshake. req+res Sec-WebSocket-VersionThe WebSocket protocol version; 13 is the only one in use. A server that disagrees replies 400 listing the versions it supports. req+res Sec-WebSocket-ProtocolSubprotocols the client offers, and the single one the server selects. Where application-level protocol negotiation happens. req+res Sec-WebSocket-ExtensionsFrame-level extensions being negotiated — in practice permessage-deflate for compression. req+res DateWhen the message was generated, in IMF-fixdate format. Caches use it as the baseline for freshness arithmetic. res ServerIdentifies the origin server software. Often trimmed or removed in production, since a precise version number is free reconnaissance for an attacker. req User-AgentThe client's self-description. Decades of compatibility spoofing have made it nearly meaningless for feature detection; client hints are the modern replacement. req RefererThe URL of the page that produced this request — famously misspelled in the original specification and never fixed. How much of it is sent is governed by Referrer-Policy. req FromAn email address for whoever is responsible for the requesting agent. Intended for crawlers so an operator can be contacted; almost never sent by browsers. res AllowThe methods this resource supports. Required on a 405, and the useful part of an OPTIONS response. req PreferAsks for optional server behaviour the client can live without — return=minimal, respond-async, or a soft wait= deadline. The server may ignore it entirely. res Preference-AppliedConfirms which of the client's Prefer hints were actually honoured. req Idempotency-KeyA client-generated unique key so a retried POST is executed once. Not yet an RFC, but the de-facto convention across payment APIs — the server stores the key with the result and replays it. Non-standard req Last-Event-IDSent by an EventSource when it reconnects, carrying the last server-sent event it received so the stream can resume without gaps. res Server-TimingSurfaces server-side timings (database, cache, render) in the browser's network panel and to the Performance API. Purely diagnostic — and visible to anyone, so don't leak internals. res SourceMapPoints at the source map for a minified script or stylesheet, as an alternative to a trailing //# sourceMappingURL comment. res Service-Worker-AllowedWidens the scope a service worker script may claim beyond its own directory — the fix for the classic 'scope not allowed' registration error. req Service-Worker-Navigation-PreloadMarks the parallel network request a service worker's navigation preload started, so the server can tailor the response. req Upgrade-Insecure-Requests1 tells the server the client would rather be redirected to the HTTPS version than load mixed content. Pairs with the CSP directive of the same name. req DNT'Do Not Track'. Never gained legal force, is a fingerprinting signal in itself, and has been removed from browsers. Deprecated. Deprecated req Sec-GPCGlobal Privacy Control: 1 signals an opt-out of sale or sharing of personal data. Unlike DNT it is recognised under some privacy laws, notably in California. req X-Requested-WithLegacy XMLHttpRequest marker added by jQuery and friends. Sometimes still used as a weak CSRF signal, because setting it cross-origin triggers a preflight. Non-standard res X-Powered-ByAdvertises the framework or runtime behind the response. Pure information disclosure — disable it (app.disable('x-powered-by') in Express). Non-standard res X-Robots-TagApplies robots directives (noindex, nofollow, noarchive) to any resource, including PDFs and images that cannot carry a meta tag. Non-standard req+res X-Request-IdA correlation id threaded through logs and services. Purely conventional — X-Correlation-Id and W3C traceparent do the same job. Non-standard req+res traceparentW3C Trace Context: version, trace id, parent span id and flags in one field. The interoperable basis of distributed tracing across vendors. req+res tracestateVendor-specific tracing key/value pairs that travel alongside traceparent. res X-RateLimit-LimitConventional (not standardised) rate-limit budget for the current window. The IETF's in-progress standard spells this RateLimit. Non-standard res X-RateLimit-RemainingConventional count of requests left in the current rate-limit window. Non-standard res X-RateLimit-ResetConventional marker for when the rate-limit window resets — ambiguously a Unix timestamp in some APIs and a seconds-from-now delta in others, which is exactly why it was never standardised. Non-standard MIME types 94 .txt text/plainUnstructured text. Always add ; charset=utf-8 — the historical default was ISO-8859-1. .html text/htmlHTML documents. Browsers render this; anything else risks being shown as source. .css text/cssStylesheets. Browsers refuse to apply a stylesheet served as text/plain when nosniff is set. .js text/javascriptJavaScript. This is the registered type; application/javascript and text/ecmascript are obsolete aliases. Note .csv text/csvComma-separated values. Accepts a header=present|absent parameter that almost nobody sets. .tsv text/tab-separated-valuesTab-separated values — safer than CSV when fields contain commas. .md text/markdownMarkdown source. Takes an optional variant= parameter (e.g. GFM). .xml text/xmlXML intended to be readable as text. For machine-to-machine XML prefer application/xml. .ics text/calendariCalendar events and free/busy data — what a calendar invite attachment is. .vcf text/vcardContact cards (vCard). — text/event-streamServer-Sent Events. A long-lived response of data: lines consumed by EventSource; never buffer or compress it in a proxy. Note .ttl text/turtleTerse RDF Triple Language — human-writable RDF for linked data. .jpg image/jpegLossy photographic raster. Still the safest universal fallback. .png image/pngLossless raster with alpha. The right choice for screenshots, logos and anything with sharp edges. .gif image/gifPalette-limited raster with simple animation. Superseded for animation by WebP, AVIF and actual video. .webp image/webpLossy and lossless raster with alpha and animation. Universally supported now and typically 25–35% smaller than JPEG. .avif image/avifAV1-based still image: excellent compression, HDR and wide gamut. Encoding is slow; decode support is broad. .svg image/svg+xmlVector graphics as XML. Because SVG can carry script, never serve user-uploaded SVG from your main origin without sanitising it. Note .apng image/apngAnimated PNG. Same container as PNG, so it degrades to a still frame in old decoders. .bmp image/bmpUncompressed Windows bitmap. Large; effectively legacy. .tif image/tiffContainer format for high-quality and multi-page raster images. Common in scanning and print, unsupported in browsers. .ico image/vnd.microsoft.iconWindows icon container, holding several sizes. image/x-icon is the older unregistered spelling still emitted by many servers. Note .heic image/heicHEIF container with HEVC-coded images — what an iPhone camera produces by default. Patent-encumbered and not supported by browsers. .jxl image/jxlJPEG XL: strong compression and lossless JPEG re-encoding. Browser support remains partial. .mp3 audio/mpegMP3 audio. Universally playable; patents have expired. .m4a audio/mp4MP4 container carrying audio only, usually AAC. .aac audio/aacRaw AAC in an ADTS stream. Inside an MP4 container it is audio/mp4 instead. .ogg audio/oggOgg container holding Vorbis or Opus. Add ; codecs=opus when it matters — a .opus file is Ogg Opus. Note .flac audio/flacLossless compressed audio. Roughly half the size of WAV with no quality loss. .wav audio/wavUncompressed PCM in a RIFF container. Widely sent as audio/wav; audio/vnd.wave is the registered name and audio/x-wav a legacy alias. .weba audio/webmWebM container with audio only, typically Opus. What MediaRecorder produces for audio in Chromium. .mid audio/midiNote and control events rather than sampled sound. audio/x-midi is the common legacy alias. .mp4 video/mp4MP4 container, usually H.264 or H.265 video with AAC audio. The safest cross-platform choice. Note .webm video/webmWebM container with VP8/VP9/AV1 video and Vorbis or Opus audio. Royalty-free; not supported by older Safari. .ogv video/oggOgg container with Theora video. Effectively obsolete. .mpeg video/mpegMPEG-1 / MPEG-2 program stream. Legacy. .mov video/quicktimeApple QuickTime container. Structurally close to MP4 but not always browser-playable. .avi video/x-msvideoMicrosoft AVI container. Legacy, and unregistered — hence the x- prefix. .ts video/mp2tMPEG-2 Transport Stream — the segment format behind HLS. Note .3gp video/3gpp3GPP mobile container, historically used by feature phones. .json application/jsonJSON. Always UTF-8 — the media type defines no charset parameter, so ; charset=utf-8 is redundant (and harmless). .jsonld application/ld+jsonJSON-LD: JSON with a @context that maps keys to IRIs. What search engines read for structured data. .ndjson application/x-ndjsonNewline-delimited JSON — one complete JSON value per line, so a stream can be parsed incrementally. Also seen as application/jsonl. Note — application/json-patch+jsonRFC 6902 patch document: an array of add/remove/replace/move operations against a JSON document. — application/merge-patch+jsonRFC 7386 merge patch: a partial document where null means delete. Simpler than JSON Patch but cannot express array edits. — application/problem+jsonRFC 9457 problem details: a standard error shape with type, title, status and detail. Saves inventing another error envelope. — application/vnd.api+jsonJSON:API — a convention for resource documents, relationships and pagination. The media type is part of the spec's negotiation rules. — application/graphql-response+jsonThe registered media type for a GraphQL-over-HTTP response, distinguishing a GraphQL error payload from an arbitrary JSON body. .xml application/xmlXML for machine consumption. Prefer this over text/xml, whose charset defaulting rules are a trap. .xhtml application/xhtml+xmlHTML served under strict XML parsing rules — a single well-formedness error aborts the whole page. .rss application/rss+xmlRSS 2.0 feed. .atom application/atom+xmlAtom syndication feed — the standardised alternative to RSS. .yaml application/yamlYAML. Registered by RFC 9512; text/yaml and application/x-yaml are the older informal spellings. .toml application/tomlTOML configuration files. .sql application/sqlSQL script or statements. .pdf application/pdfPortable Document Format. Pair with Content-Disposition to choose between inline viewing and download. .zip application/zipZIP archive. Note that many modern formats (docx, xlsx, epub, jar) are ZIP files with a specific internal layout. .gz application/gzipA gzip-compressed file. Distinct from Content-Encoding: gzip, which compresses the transfer rather than describing the file. Note .zst application/zstdZstandard-compressed file. Also a transfer coding (Content-Encoding: zstd), now supported by major browsers. .tar application/x-tarUncompressed tar archive. .tar.gz is a tar inside a gzip. .7z application/x-7z-compressed7-Zip archive. Unregistered, hence the x- prefix. .rar application/vnd.rarRAR archive. application/x-rar-compressed is the older spelling. .wasm application/wasmWebAssembly binary module. WebAssembly.instantiateStreaming refuses anything not served with this exact type. Note .bin application/octet-streamArbitrary bytes — 'I don't know what this is'. Browsers download rather than render it, which makes it the safe default for untrusted uploads. — application/x-www-form-urlencodedClassic HTML form encoding: percent-encoded key=value pairs joined by &. Cannot carry files, and is CORS-safelisted (so no preflight). .webmanifest application/manifest+jsonWeb app manifest — name, icons, theme colour and display mode for an installable PWA. .epub application/epub+zipEPUB e-book: a ZIP of XHTML, CSS and metadata. .jwt application/jwtA JSON Web Token as a compact header.payload.signature string. Rarely used as a Content-Type — JWTs usually travel in the Authorization header. .m3u8 application/vnd.apple.mpegurlHLS playlist. application/x-mpegURL is the widely-deployed legacy spelling. .mpd application/dash+xmlMPEG-DASH media presentation description — the manifest for DASH adaptive streaming. .asc application/pgp-signatureDetached OpenPGP signature. .doc application/mswordLegacy binary Word document (Word 97–2003). .docx application/vnd.openxmlformats-officedocument.wordprocessingml.documentWord document (Office Open XML) — a ZIP of XML parts. .xls application/vnd.ms-excelLegacy binary Excel workbook (Excel 97–2003). .xlsx application/vnd.openxmlformats-officedocument.spreadsheetml.sheetExcel workbook (Office Open XML). .ppt application/vnd.ms-powerpointLegacy binary PowerPoint presentation. .pptx application/vnd.openxmlformats-officedocument.presentationml.presentationPowerPoint presentation (Office Open XML). .odt application/vnd.oasis.opendocument.textOpenDocument text document (LibreOffice Writer). .ods application/vnd.oasis.opendocument.spreadsheetOpenDocument spreadsheet (LibreOffice Calc). .odp application/vnd.oasis.opendocument.presentationOpenDocument presentation (LibreOffice Impress). .pb application/x-protobufSerialised Protocol Buffers. Unregistered and inconsistent in the wild — application/protobuf and application/vnd.google.protobuf are also used. Note — application/grpcgRPC over HTTP/2. Usually seen with a suffix such as application/grpc+proto. .woff2 font/woff2Brotli-compressed web font. The only format worth shipping to modern browsers. .woff font/woffOlder web font wrapper using zlib compression. Only needed for very old browsers. .ttf font/ttfTrueType font. Serve WOFF2 on the web — a raw TTF is roughly twice the bytes. .otf font/otfOpenType font, typically with PostScript outlines. .ttc font/collectionTrueType/OpenType collection: several fonts sharing one file. — multipart/form-dataForm submissions containing files. Each part carries its own Content-Disposition and Content-Type, separated by the boundary parameter. — multipart/byterangesThe body of a 206 response answering a multi-range request — one part per range, each with its own Content-Range. — multipart/mixedIndependent parts in one body. Common in email; occasionally used for batch API requests. — multipart/alternativeThe same content in several formats, best-first — how an email carries both plain-text and HTML bodies. .gltf model/gltf+jsonglTF 3D scene as JSON, referencing external buffers and textures. .glb model/gltf-binaryglTF packed into a single binary file with its buffers and textures embedded. .stl model/stlTriangle mesh for 3D printing and CAD interchange. Methods 16 GET Safe Idempotent Cacheable Retrieve a representation of the target resource. The workhorse of the web, and the only method browsers use for ordinary navigation — so it must never have side effects. HEAD Safe Idempotent Cacheable Identical to GET but the server returns only the headers. Use it to check existence, size or freshness without pulling the body — and note the headers must match what GET would have sent. POST Cacheable Submit data for the resource to process however it sees fit — create a record, run a search too large for a query string, trigger a job. The catch-all method, and deliberately unconstrained. PUT Idempotent Replace the target resource entirely with the enclosed representation, creating it if absent. Idempotent because you send the whole desired state — repeating it changes nothing further. DELETE Idempotent Remove the association between the target URL and its resource. Idempotent: deleting twice leaves the same end state, even though the second call may answer 404. PATCH Apply a partial modification described by a patch document (JSON Patch, JSON Merge Patch, or your own format). Not idempotent in general — 'increment by one' is a legal patch. OPTIONS Safe Idempotent Ask what the server supports for a target — answered with an Allow header. Its most visible use today is the CORS preflight, which browsers send automatically before non-simple cross-origin requests. TRACE Safe Idempotent Echo the received request back so the client can see what intermediaries changed — an application-level loopback. Commonly disabled, because reflecting headers enabled the old Cross-Site Tracing attack. CONNECT Ask a proxy to open a TCP tunnel to the target authority, after which the connection carries opaque bytes. This is how HTTPS works through a forward proxy. PROPFIND Safe Idempotent WebDAV Retrieve properties of a WebDAV resource or, with a Depth header, of its members. Answers 207 Multi-Status. PROPPATCH Idempotent WebDAV Set or remove properties on a WebDAV resource, atomically. MKCOL Idempotent WebDAV Create a WebDAV collection — a directory. COPY Idempotent WebDAV Duplicate a WebDAV resource to the URL given in the Destination header. MOVE Idempotent WebDAV Move or rename a WebDAV resource to the URL in the Destination header. LOCK WebDAV Take or refresh a lock on a WebDAV resource, returning a lock token that subsequent writes must present. UNLOCK Idempotent WebDAV Release a WebDAV lock identified by its token. About HTTP Reference A searchable offline reference for HTTP status codes, request and response headers, MIME types and methods.
What it does Look up any status code, header, MIME type or method and get a straight explanation of what it means and when to use it — searchable, and available with no connection at all. It covers the practical detail that matters in day-to-day work: which methods are safe and idempotent, what a preflight request actually checks, and how the caching headers interact.
The distinctions people look up repeatedly 401 versus 403 — 401 means you are not authenticated, 403 means you are, and still not allowed. 301 versus 308 — both permanent, but 308 forbids changing the method on redirect, while 301 is widely implemented as turning POST into GET. 502 versus 504 — a bad response from upstream, against no response in time.
Common questions
What is the difference between 401 and 403? 401 Unauthorized means authentication is missing or invalid — log in and try again. 403 Forbidden means you are authenticated and still not permitted, so retrying will not help.
Which HTTP methods are idempotent? GET, HEAD, PUT, DELETE, OPTIONS and TRACE — repeating them has the same effect as making the request once. POST and PATCH are not.
What triggers a CORS preflight? Anything beyond a simple request: a method other than GET, HEAD or POST, custom headers, or a content type outside the three form types. The browser sends an OPTIONS request first.
Does this work offline? Yes. The whole reference is cached on first visit, which is the point — it is most useful when you are debugging without good connectivity. Related tools