Common HTTP Headers List
Grab a clean, copy-ready list of the most widely used HTTP request and response header names. Ideal for documentation, API tooling, dropdowns, and quick reference.
Common HTTP headers(69 headers)
Includes standard IANA-registered headers and widely adopted de facto headers (X-* prefixed); excludes full header-line syntax, values, and HTTP status codes.
How to use this list
Copy HTTP header names in seconds
Takes ~5 seconds- 1Choose a format
Pick text, JSON, or HTML output depending on your project needs.
- 2Copy or download
Use the copy button to grab it to your clipboard or download the file.
- 3Paste into your workflow
Drop the header names into docs, API validators, dropdown menus, or seed files.
Common use cases
- Back-end and front-end developers building or documenting HTTP APIs
- DevOps engineers configuring proxies, CDNs, and CORS policies
- Technical writers creating API reference docs or onboarding guides
Examples
Text output — one header name per line.
Authorization
Authorization
JSON output for scripts or validation logic.
"Authorization"
["Accept", "Authorization", "Cache-Control", ...]
HTML output for a header selector dropdown.
Authorization
<option value="Authorization">Authorization</option>
A clean list of common HTTP header names
Use this list when you need a reliable, copy-ready set of HTTP header field names for documentation, tooling, or UI dropdowns.
Looking for a comprehensive common HTTP headers list you can paste straight into your project? This page provides the most widely used standard HTTP request and response header names — from everyday fields like Content-Type, Authorization, and Cache-Control to CORS headers like Access-Control-Allow-Origin and security headers like Strict-Transport-Security and Content-Security-Policy. The text format is ideal for documentation, quick reference sheets, or pasting into a spreadsheet. The JSON array works well for API validators, linters, and seed files that need a known-good set of header names. The HTML format generates <option> tags you can drop directly into a select menu for request builders or developer tools. The list covers IANA-registered standard headers as well as widely adopted de facto headers with the X- prefix, but intentionally omits full header-line syntax and values so you get clean field names with no noise. Whether you are building an HTTP inspector, writing onboarding documentation, or configuring a proxy allowlist, this list gives you a deterministic, authoritative starting point you can trust.
Covers both sides of the HTTP exchange — headers sent by clients and those returned by servers.
- Request headers like Authorization and Host
- Response headers like ETag and Set-Cookie
- General headers like Cache-Control and Date
Switch between text, JSON, and HTML formats with one click to match your workflow.
- Plain text list
- JSON array
- HTML <option> tags
Includes the full set of CORS headers and common security-related response headers.
- Access-Control-Allow-Origin and friends
- Content-Security-Policy
- Strict-Transport-Security
HTTP header list best practices
Keep header names consistent in casing and document which headers your API actually uses.
- Use canonical title-case header names (e.g., Content-Type, not content-type) to match HTTP spec conventions.
- When building an allowlist for a proxy or CORS policy, start from this list and remove headers you do not need rather than building from scratch.
- Document custom or proprietary headers separately from standard ones to keep your API reference clear.
Frequently asked questions
Does this list include X- prefixed headers?>
Are full header values or MIME types included?>
Can I use this list to build a CORS or proxy allowlist?>
Related Developer lists
Copy common application/* MIME types in text, JSON, or HTML format for API content negotiation, downloads, and file validation.
Copy common audio MIME types in text, JSON, or HTML format for uploads, playback support checks, and processing pipelines.
Copy a practical common MIME types list in text, JSON, or HTML format for uploads, APIs, validation, and content handling.
Copy common compressed and archive file extensions in text, JSON, or HTML format. Useful for file validators, dropdowns, and developer references.
Copy common document file extensions with format names in text, JSON, or HTML format. Ideal for developers, docs, and file type references.
Copy common executable and installer file extensions by platform in text, JSON, or HTML format for quick reference, docs, and developer tools.
Copy all HTTP 2xx success codes in text, JSON, or HTML format for API docs, tests, and monitoring workflows, ready to paste.
Copy all HTTP 3xx redirect codes in text, JSON, or HTML format for API docs, tests, and monitoring workflows, ready to paste.
Copy all HTTP 4xx client error codes in text, JSON, or HTML format for API docs, tests, and monitoring workflows.
Copy all HTTP 5xx server error codes in text, JSON, or HTML format for API docs, tests, and monitoring workflows.
Copy a clean http request methods list (GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS, TRACE, CONNECT) in text, JSON, or HTML for API docs and tooling.
Copy the complete IANA-registered HTTP status codes list in text, JSON, or HTML format for APIs, docs, testing, and observability workflows.
Copy common image MIME types in text, JSON, or HTML format for upload validation, image processing, and media tooling.
Copy all 6 native JSON data types from RFC 8259 in text, JSON, or HTML format for quick reference, docs, and dropdown menus.
Copy common regex and string escape sequences in text, JSON, or HTML format. Includes \n, \t, \r, \\, \0, \uXXXX, and more.
Copy common video MIME types in text, JSON, or HTML format for upload policies, streaming workflows, and player support checks.