Custom Header Guide & Detector

X-* headers carry the hidden context of every HTTP request — tracing, caching, forwarding, rate limits and security posture. Custom Header Guide is a searchable reference plus a detector that scans your own header dumps and classifies every name it finds.

Stop guessing what X-Cache or X-RateLimit-Remaining mean; look them up and see them in your traffic.

The reference and the detector share the same data: the 18+ headers documented in the table are exactly the ones the detector recognizes as “known customs.” Anything else gets sorted into standard (a fixed list of the usual suspects like Host, Content-Type, Cookie and Authorization) or unknown — the bucket worth reading closely, since it is where SDKs, proxies and forgotten debug headers show up.

• 18+ reference entries — category, purpose, example for each header.
• Live search — filter the table by name, category or description as you type.
• Header detector — paste a raw dump and classify every Name: value pair it contains.
• Standard vs custom vs unknown — three clear buckets with per-category counts.
• Occurrence counting — repeated headers in the same paste are tallied, not just listed once.
• Case-insensitive matching — x-request-id and X-Request-ID resolve to the same entry.
• Copyable result — a plain-text summary ready to paste into a ticket or runbook.

1. Search the reference for any X-* header by name, category or keyword (try “rate”, “forward” or “cache”).
2. Paste a header dump, curl -v output, or any log excerpt with Name: value lines into the detector box.
3. Detect. Every header name is extracted, matched case-insensitively, and classified as custom, standard or unknown.
4. Read the counts. The stats row shows how many distinct headers landed in each bucket.
5. Copy the classification as a small text report for documentation or an incident writeup.

Example 1 — Cache debugging. X-Cache: HIT on every asset proves the CDN is serving from edge; MISS everywhere points to a cache-busting query string or a misconfigured TTL.

Example 2 — TLS behind a proxy. X-Forwarded-Proto tells you whether a request actually arrived over HTTPS even when the application server itself only sees plain HTTP from the load balancer.

Example 3 — SDK hygiene. An unknown X-Awesome-* header showing up in production traffic usually means a client SDK or analytics beacon you never audited — the detector’s unknown bucket surfaces it immediately instead of hiding it in a wall of headers.

Example 4 — Rate-limit troubleshooting. Paste a batch of response headers from a flaky integration and check X-RateLimit-Remaining alongside Retry-After to confirm whether 429s are expected backpressure or a real bug.

• No lookup loops — one searchable reference instead of hunting through vendor docs for each header.
• See your own traffic — classify the headers you actually send and receive, not a generic list.
• Find surprises fast — unknown headers surface on their own instead of blending into the noise.
• Consistent naming — case-insensitive matching means casing differences never split one header into two buckets.
• Private by design — detection runs entirely in your browser; nothing you paste is ever uploaded.