Every time a browser and a server talk, they exchange more than the page itself. Alongside the content travels a set of headers — small labelled lines of metadata that describe the request and the response. Headers are invisible to most users, but they quietly control caching, security, content type, and much of how the web behaves.
What headers are
An HTTP message has two parts: the body, which is the actual content, and the headers, which describe it. A request from a browser carries headers saying what it wants and what it can accept; a response from a server carries headers describing what it is sending and how the browser should treat it. Each header is a name and a value — a short instruction or piece of information that both sides understand.
Describing the content
Some headers exist to explain the body. The Content-Type header states the MIME type — whether the response is HTML, an image, JSON, or something else — so the browser knows how to handle it. Getting this wrong causes visible failures: a stylesheet sent with the wrong type may be ignored entirely. Related headers describe the content’s length and encoding, helping the browser receive and interpret it correctly.
Controlling caching
A major job of headers is caching — deciding what the browser may store and reuse rather than fetching again. Caching headers can tell the browser to keep a file for a long time, which is ideal for versioned assets like stylesheets and images that never change under the same name, or to always revisit the server, which suits documents that change often. Good caching is one of the most effective performance tools available, and it is configured almost entirely through headers.
Headers that harden security
Another group of headers strengthens security by instructing the browser to enforce certain rules. A Content-Security-Policy limits where scripts, styles, and other resources may load from, reducing the impact of injected code. Strict-Transport-Security tells the browser to insist on encrypted connections. Others prevent a page from being framed by other sites or stop the browser from second-guessing a file’s declared type. These headers do not change the content; they change how safely the browser handles it.
Requests carry headers too
Headers are not only sent by servers. A browser’s request includes headers describing what it can accept — which formats, which languages — and information like which page linked to the current one. Servers can use these to tailor the response, for example returning a modern image format to a browser that says it supports one. This back-and-forth of capabilities and preferences happens on every request, entirely in the headers.
Why they are worth knowing
You rarely see headers, but they explain a lot of otherwise puzzling behaviour: why a change did not appear until you cleared the cache, why a file downloaded instead of displaying, why a resource was blocked. Learning to read the headers on a request and response turns those mysteries into something you can inspect and fix. They are the quiet control layer beneath the visible web.