DNT(do-not-track), possible values: 
    
    
    "!" — under construction
    "?" — dynamic
    "G" — gateway to multiple parties
    "N" — not tracking
    "T" — tracking
    "C" — tracking with consent
    "P" — tracking only if consented
    "D" — disregarding DNT
    "U" — updated
    

|  ` Tk: ? ` |  Permanent  |   
[ Upgrade ](/wiki/Upgrade_header "Upgrade header") |  Ask the client to upgrade to another protocol.  Must not be used in HTTP/2  [14]  |  ` Upgrade: h2c, HTTPS/1.3, IRC/6.9, RTA/x11, websocket ` |  Permanent  |  [ RFC ](/wiki/RFC_\(identifier\) "RFC \(identifier\)") [ 9110 ](https://datatracker.ietf.org/doc/html/rfc9110)  
Vary  |  Tells downstream proxies how to match future request headers to decide whether the cached response can be used rather than requesting a fresh one from the origin server.  | 

  * Example 1: ` Vary: * `
  * Example 2: ` Vary: Accept-Language `

|  Permanent  |  [ RFC ](/wiki/RFC_\(identifier\) "RFC \(identifier\)") [ 9110 ](https://datatracker.ietf.org/doc/html/rfc9110)  
Via  |  Informs the client of proxies through which the response was sent.  |  ` Via: 1.0 fred, 1.1 example.com (Apache/1.1) ` |  Permanent  |  [ RFC ](/wiki/RFC_\(identifier\) "RFC \(identifier\)") [ 9110 ](https://datatracker.ietf.org/doc/html/rfc9110)  
Warning  |  A general warning about possible problems with the entity body.  |  ` Warning: 199 Miscellaneous warning ` |  Obsolete  [21]  |  [ RFC ](/wiki/RFC_\(identifier\) "RFC \(identifier\)") [ 7234 ](https://datatracker.ietf.org/doc/html/rfc7234) , [ 9111 ](https://datatracker.ietf.org/doc/html/rfc9111)  
WWW-Authenticate  |  Indicates the authentication scheme that should be used to access the requested entity.  |  ` WWW-Authenticate: Basic ` |  Permanent  |  [ RFC ](/wiki/RFC_\(identifier\) "RFC \(identifier\)") [ 9110 ](https://datatracker.ietf.org/doc/html/rfc9110)  
X-Frame-Options  [56]  |  [ Clickjacking ](/wiki/Clickjacking "Clickjacking") protection: ` deny ` \- no rendering within a frame, ` sameorigin ` \- no rendering if origin mismatch, ` allow-from ` \- allow from specified location, ` allowall ` \- non-standard, allow from any location  |  ` X-Frame-Options: deny ` |  Obsolete  [57]  |   
  
###  Common non-standard response fields  [  [ edit
](/w/index.php?title=List_of_HTTP_header_fields&action=edit&section=10 "Edit
section: Common non-standard response fields") ]

Field name  |  Description  |  Example   
---|---|---  
Content-Security-Policy,  
X-Content-Security-Policy,  
X-WebKit-CSP  [58]  |  [ Content Security Policy ](/wiki/Content_Security_Policy "Content Security Policy") definition.  |  ` X-WebKit-CSP: default-src 'self' `  
Expect-CT  [59]  |  Notify to prefer to enforce [ Certificate Transparency ](/wiki/Certificate_Transparency "Certificate Transparency") .  |  ` Expect-CT: max-age=604800, enforce, report-uri=" [ https://example.example/report ](https://example.example/report) " `  
NEL  [60]  |  Used to configure network request logging.  |  ` NEL  :  {  "report_to"  :  "name_of_reporting_group"  ,  "max_age"  :  12345  ,  "include_subdomains"  :  false  ,  "success_fraction"  :  0.0  ,  "failure_fraction"  :  1.0  }  `  
Permissions-Policy  [61]  |  To allow or disable different features or APIs of the browser.  |  ` Permissions-Policy: fullscreen=(), camera=(), microphone=(), geolocation=(), interest-cohort=()  [62]  `  
[ Refresh ](/wiki/HTTP_refresh "HTTP refresh") |  Used in redirection, or when a new resource has been created. This refresh redirects after 5 seconds. Header extension introduced by Netscape and supported by most web browsers. Defined by HTML Standard  [63]  |  ` Refresh: 5; url=  [ http://www.w3.org/pub/WWW/People.html ](http://www.w3.org/pub/WWW/People.html) `  
Report-To  [64]  |  Instructs the user agent to store reporting endpoints for an origin.  |  ` Report-To  :  {  "group"  :  "csp-endpoint"  ,  "max_age"  :  10886400  ,  "endpoints"  :  [  {  "url"  :  "https-url-of-site-which-collects-reports"