Strict-Transport-Security (HSTS)
Baseline: max-age=63072000; includeSubDomains; preload
Enforces HTTPS for all connections, preventing protocol downgrade attacks and cookie hijacking.
HTTP Headers Reference & Builder
Reference for common HTTP headers and a builder to format header blocks. Covers Cache-Control, Content-Security-Policy, HSTS, CORS, Referrer-Policy, and more. Educational tool only — does not modify server responses.
Your data stays in your browser.
This is an educational reference and formatting tool only. It generates header text blocks for your server config. It does not connect to or modify any server.
Header Configuration Builder
Private-by-default, local browser execution. Generate raw blocks and server configs.
Ready
Error:
Warnings:
Header Name
Header Value
Multi-Format Exports
Copy-ready header blocks for raw HTTP, JavaScript fetch, nginx, Apache .htaccess, Express.js, and Vercel/Cloudflare JSON.
Raw HTTP Block
How to use the HTTP Headers Tool
- Add headers. Use the builder to add header name/value rows (default: Content-Type / application/json).
- Pick a format. Switch tabs (Raw HTTP, Fetch, Nginx, Apache, Express, JSON) to view the matching block.
- Copy block. Click Copy in the code header to paste the formatted block into your server config.
Important: This tool only generates header text for your server configuration files. It does NOT modify actual HTTP responses or connect to any server.
Essential HTTP Security Headers & Production Baselines
Testing your APIs with our JWT Decoder and URL Encoder often requires understanding these core security policies.
Content-Security-Policy (CSP)
Restricts which resources the browser may load and execute, preventing XSS and data-injection attacks by whitelisting trusted sources.
Example: default-src 'self'; script-src 'self'
X-Frame-Options
Baseline: DENY or SAMEORIGIN
Defends against clickjacking by controlling whether the page can be embedded in frames or iframes by other sites.
Permissions-Policy
Disables sensitive browser features such as camera and microphone access, e.g. camera=(), microphone=().
Reduces the attack surface by turning off features the site does not use.
Frequently Asked Questions
- No. This is an educational reference and formatting tool only. It generates header text blocks that you can copy and use in your server configuration (nginx, Apache, Cloudflare Workers, etc.). It does not connect to or modify any server.
- The reference covers: Cache-Control, Content-Type, Content-Security-Policy (CSP), Strict-Transport-Security (HSTS), X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Access-Control-Allow-Origin (CORS), and many more.
- The builder lets you add header name/value rows and outputs formatted header blocks for nginx, Apache, Express, fetch, and raw HTTP, updating live as you type.
- Once the page is loaded, the tool works offline because all logic runs client-side.
- Use
Cache-Control: public, max-age=31536000, immutablefor versioned static assets (CSS, JS, images) so browsers and CDNs cache them for up to a year. For non-versioned assets, usepublic, max-age=600, must-revalidateto balance freshness and caching. - X-Frame-Options (
DENY,SAMEORIGIN) is the older header that controls framing. CSPframe-ancestorsis the modern replacement and covers more sources. When both are present, modern browsers prioritizeframe-ancestors. Useframe-ancestors 'self'ornonein your CSP alongsideX-Frame-Options: DENYfor legacy browser support. - For cross-origin requests, send
Access-Control-Allow-Origin(e.g.*or a specific origin),Access-Control-Allow-Methods,Access-Control-Allow-Headers, andAccess-Control-Max-Ageto cache preflight responses. For credentialed requests, use a specific origin (not*) withAccess-Control-Allow-Credentials: true.
HTTP Headers Reference & Builder
HTTP headers sit at the center of every request and response exchanged between a client and a server. They control caching, authentication, content negotiation, CORS, security policies, and connection behavior, yet their names, syntax, and default values are easy to forget under deadline pressure. The HTTP Headers Reference & Builder in DevPouch 2.0's web category combines a searchable reference of standard headers with a live builder that emits ready-to-use header blocks for fetch, cURL, Axios, and raw HTTP clients.
Instead of jumping between MDN pages, RFC documents, and scattered blog posts, developers can look up request, response, and entity headers in one place. Each entry covers header syntax, typical values, browser support, and common pitfalls such as case sensitivity and invalid directive combinations. The builder then lets you select headers, toggle options such as credentials or cache directives, and copy a complete header set directly into your code or API client.
Use Cases
- Look up standard HTTP request, response, and entity headers with syntax, defaults, and browser support notes.
- Build and test CORS, cache-control, and security header sets before deploying changes to staging or production.
- Generate header blocks for fetch, cURL, Axios, and raw HTTP request clients in seconds.
- Audit response headers for missing security directives such as X-Content-Type-Options and Content-Security-Policy.
- Share reference links and generated headers with teammates during code review, onboarding, and incident triage.
How-To
- Open the HTTP Headers Reference & Builder from the web category tool list in DevPouch 2.0.
- Browse or search headers by name, category, or keyword to view syntax and default values.
- Select the headers you need and toggle options such as credentials, cache behavior, or security directives.
- Copy the generated header block into your fetch, cURL, Axios, or raw HTTP request code.
- Paste the request into your client, inspect the response headers, and refine the set as needed.
Accurate headers reduce failed requests, improve caching efficiency, and close common security gaps. Use this reference and builder whenever you design APIs, integrate third-party services, or troubleshoot HTTP traffic across browsers, mobile clients, and origin servers.