# HTTP Headers That Matter

> Read request and response headers for a living: who sets each one, who trusts it, how caching and content negotiation work, and how to audit security headers.

Canonical: https://codelivly.com/rooms/http-headers-that-matter
Last updated: 2026-11-15

| | |
|---|---|
| Level | Beginner |
| Category | Web |
| Lessons | 6 |
| Estimated time | 3 h 25 min |
| XP | 150 |

Headers decide how a browser treats a response, how long a cache keeps it and which protections are switched on. You start with the headers a client sends and why none of them can be trusted for a security decision, then read the headers a server sends back. You work through content negotiation, caching with Cache-Control, ETag and 304, and the security headers from HSTS to Content-Security-Policy. The room ends with a header audit of six hosts of a small online shop, written up as a list of fixes.

## Lessons

1. Request Headers: What the Client Says About Itself (30 min)
2. Response Headers: What the Server Says About the Answer (30 min)
3. Content Negotiation: Type, Language and Compression (30 min)
4. Caching Headers: Cache-Control, ETag and 304 (35 min)
5. Security Headers: HSTS, CSP and Their Neighbours (35 min)
6. Guided Lab: Audit the Headers of a Small Site (45 min)

## Related

- [Learning path: Web Fundamentals](https://codelivly.com/learning-paths/web-fundamentals)
- [All rooms](https://codelivly.com/rooms)