An HTTP header is metadata exchanged between a browser and a server during HTTP communication, separate from the body (the actual content). Think of it like a postal analogy: the body is the letter inside the envelope, and the headers are the sender, recipient, and date printed on the envelope.
HTTP headers are divided into request headers (browser to server) and response headers (server to browser). Common request headers include User-Agent (browser type), Accept (acceptable data formats), and Cookie (stored cookie data). Common response headers include Content-Type (data format), Cache-Control (caching rules), and Location (redirect destination URL).
The redirect mechanism behind short URLs is built entirely on HTTP headers. When you access a short URL, the server returns a 301 or 302 status code with the original URL set in the Location header. The browser reads the Location value and automatically navigates to that page. This process typically completes in under 50 milliseconds.
Security-related HTTP headers are also important. Strict-Transport-Security (HSTS) enforces HTTPS connections, X-Frame-Options prevents clickjacking, and Content-Security-Policy (CSP) mitigates XSS attacks. Properly configuring these headers significantly strengthens a website's security posture.
You can inspect HTTP headers using your browser's developer tools (F12, then the Network tab). To check where a short URL redirects without actually visiting the destination, look at the Location header in the developer tools. Related books are available on Amazon.