HTTP Headers Every Developer Should Know (Not Just the Obvious Ones)

Request headers are sent by the client (browser, API consumer) to tell the server about the request context: what content types it accepts (Accept), authentication credentials (Authorization), what host it's connecting to (Host), caching preferences (Cache-Control, If-None-Match), the origin of the request (Origin), and browser/client information (User-Agent). Response headers are sent by the server to tell the client how to handle the response: the content type (Content-Type), caching rules (Cache-Control, ETag, Last-Modified), security policies (Content-Security-Policy, Strict-Transport-Security), allowed CORS origins (Access-Control-Allow-Origin), and cookie instructions (Set-Cookie).

The essential security headers are: Strict-Transport-Security (HSTS) to force HTTPS connections; Content-Security-Policy (CSP) to restrict which resources the page can load, preventing XSS; X-Content-Type-Options: nosniff to prevent MIME type sniffing; X-Frame-Options or frame-ancestors CSP directive to prevent clickjacking; Referrer-Policy to control what referrer information is sent with links; and Permissions-Policy to restrict browser feature access (camera, microphone, geolocation). HSTS and CSP are the highest-impact ones. SecurityHeaders.com provides a free scanner showing which headers your site is missing and why they matter.

The server sets Cache-Control in the response to instruct caches how long to store the response: max-age=3600 means cache for one hour, no-cache means revalidate with the server before using cached version, no-store means never cache. ETag provides a fingerprint of the content — when the browser has a cached version, it sends If-None-Match: [etag] with the next request; if the content hasn't changed, the server returns 304 Not Modified without sending the body. Last-Modified and If-Modified-Since work similarly using timestamps. For static assets with versioned filenames (bundle.abc123.js), use max-age=31536000, immutable to cache for a year with no revalidation.