Cheat sheet

HTTP Headers

Essential HTTP headers for security, caching, and performance.

Strict-Transport-Security (Enforce HTTPS)

Content-Security-Policy (Control allowed resources)

X-Content-Type-Options: nosniff (Prevent MIME sniffing)

X-Frame-Options: DENY/SAMEORIGIN (Anti-clickjacking)

Cache-Control: public, max-age=3600 (Browser caching)

ETag: '<hash>' (Resource versioning)

Expires: <date> (Legacy cache control)

Vary: Accept-Encoding (Cache variants)

User-Agent (Client info)

X-Forwarded-For (Original client IP)

X-Request-ID (Traceable request identifier)

Accept-Language (Client locale preference)