How Host works
Required on every HTTP/1.1 request; HTTP/2 and 3 carry it as the :authority pseudo-header. Servers route requests to the right site by it. Because clients control it, never build password-reset links or redirects from the Host header without checking it against your list of domains (Host header injection).
Examples
GET /docs HTTP/1.1
Host: www.example.comCheck it
# Show the request headers curl sends (lines starting with >)
curl -sv -o /dev/null https://example.com 2>&1 | grep '^>'Paste a full set of response headers into the HTTP header checker to get every header explained and common mistakes flagged.
Related headers
- X-Forwarded-For: carries the original client IP address through proxies and load balancers.
- Forwarded: the standard form of the X-Forwarded-* headers: client address, protocol and host in one header.
- Origin: tells the server which origin (scheme, host and port) a request comes from.
More requests, redirects and more headers
Location , Retry-After , User-Agent , Link , Sec-Fetch-Site , Clear-Site-Data , Server-Timing .
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What does the Host header do?
The Host request header names the domain (and port) the request is for, so one server can host many sites. Required on every HTTP/1.1 request; HTTP/2 and 3 carry it as the :authority pseudo-header. Servers route requests to the right site by it. Because clients control it, never build password-reset links or redirects from the Host header without checking it against your list of domains (Host header injection).
How do I see the Host header?
Open your browser’s dev tools, select a request in the Network tab and look under Request Headers. On the command line, "curl -v https://example.com" prints the request headers it sends, marked with ">".