HTTP headers you should recognise

Headers carry almost everything about an HTTP exchange that is not the body: content negotiation, caching instructions, authentication, and the browser security policy applied to a response. Reading them is the fastest way to explain why a request behaved differently than expected.

Debugging essentials

Content-Type determines how a body is parsed, and a mismatch explains a surprising number of parse failures. Cache-Control and ETag explain why a change did not appear. Location shows where a redirect points, and Set-Cookie flags decide whether a session survives.

Security headers

Content-Security-Policy restricts which resources may load and is the strongest defence against injected scripts. Strict-Transport-Security forces HTTPS for future visits. X-Content-Type-Options, Referrer-Policy, and X-Frame-Options close off sniffing, referrer leakage, and framing respectively.

Reading a raw dump

The first line is special: a method and path for requests, a status code for responses. Header names are case-insensitive, values may be folded across lines in older captures, and some headers legitimately repeat. Watch for Authorization and Cookie before pasting a capture anywhere.

Inspect locally

Structure a capture with HTTP Headers Parser, check for missing protections with Security Headers Analyzer, and review encoding rules in URL Encoding vs HTML Escaping.