HTTP header

An HTTP header is a short line of extra information that a browser and a website send each other with every page request, invisible to the visitor. You never see headers on the page, but they shape how your site loads and how safe it is.

What is an HTTP header?

Written as a name and a value, headers tell each side things the page itself does not say: what type of file is coming, how long it may be cached, which language the visitor prefers or which security rules apply.

When you open a page, your browser sends a request to the web serverA web server is the program, such as Apache, Nginx or LiteSpeed, that answers when a visitor opens your site and sends back the page and files.. That request carries request headers, such as the browser name, the languages it accepts and any cookies. The server answers with a status codeAn HTTP status code is a three-digit number a website sends back with every page request to say how it went, such as 200 for OK or 500 for an error. and response headers, followed by the page itself.

Each header is a single line. Content-Type: text/html says the answer is a web page. Cache-Control: max-age=3600 says the browser may reuse it for an hour. Location is used for redirects, and Set-Cookie stores a cookie in the visitor’s browser.

For site owners the response headers matter most, because your server configuration, PHPPHP is a programming language that builds your web pages on the computer that hosts your site, just before they reach the visitor. WordPress runs on it. and your own plugins decide what they say.

What HTTP headers mean for a PHP or WordPress site

On a PHP site, headers come from three places: the web server, PHP itself and the code that runs on top of it, such as WordPressWordPress is free software for building and editing a website in your browser. It is written in PHP, so it builds each page when someone visits. and its plugins. Depending on the expose_php setting in php.iniphp.ini is the settings file for PHP on your hosting. It sets limits, such as how much memory a script may use, how big an upload may be and if errors show., PHP adds a header called X-Powered-ByX-Powered-By is a hidden label a website can send along that tells anyone who asks which software it runs, such as PHP/8.1. that names the language and often the exact version. The web server may add a Server header with similar details.

That is useful for debugging and unhelpful for privacy. Anyone scanning the internet can read the header, see an old PHP versionA PHP version is a numbered edition of PHP, like 8.3. Each edition is looked after for a limited time, then gets security fixes only, then nothing. and know which known vulnerabilities to look for. Removing the header does not fix an old version, but it stops you from announcing it.

Headers are also where security headersSecurity headers are hidden instructions your site sends with each page that tell the visitor's browser which protections to switch on. live. They tell the browser to refuse certain risky behavior, for example loading scripts from unknown sources or showing your site inside someone else’s frame.

How to check your headers

The quickest way is your browser. Open the developer tools, choose the Network tab, reload the page and click the first request in the list. Under Response Headers you see every line your server sent. A terminal gives the same result with curlcURL is a tool that lets software, such as PHP, fetch information from other websites and services, for example to check for updates or send an order. -I and your address.

Look for four things. First, does X-Powered-By or Server show a version number? Second, is a redirect from http to https in place? Third, does the Cache-Control line match what you expect? Fourth, are security headers present at all?

If you want a quick answer about the PHP part, you can check your PHP version with the free tool, which reads the public headers of your site and tells you which PHP version is visible from the outside.

When to act on what you find

A version number that points to an unsupported release is a reason to plan an update. A missing security header is lower urgency, but worth adding when you next touch the server configuration. Headers that suddenly change after a hostingWeb hosting is the service that keeps your website's files on a computer that is always online, so visitors can open your site at any time. move or an update are a sign that something in the setup differs from before, and that deserves a look.

If your site runs an old PHP version, we update PHP in WordPress by moving it to a supported release, with a test on a copy first. If the headers show your site is behaving strangely and pages fail to load, the status codes in the same response often point to the cause.