HTTP

Every page you open and every API you call speaks HTTP. Here is what actually travels between your browser and the server.

HTTP (HyperText Transfer Protocol) is a simple idea: the client sends a request, and the server sends back a response. Both are just text, followed optionally by a body. Once you have seen the raw shape of them, the rest of the web stops feeling like magic.

A request

When you visit a page, your browser sends something like this:

GET /index.html HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Accept: text/html

The first line has three parts: the method (GET), the path (/index.html), and the protocol version. Everything after it is headers — key/value pairs that describe the request.

Methods

Method	Means
`GET`	Fetch a resource. Should not change anything.
`POST`	Send data to be processed (a form, a new record).
`PUT`	Replace a resource at a known location.
`PATCH`	Partially update a resource.
`DELETE`	Remove a resource.

GET and HEAD are called safe methods because they only read. A browser will happily retry them; it is more careful with POST because it might do something twice.

A response

HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 1270

<!DOCTYPE html>...

The number 200 is the status code. The body comes after a blank line.

Status codes

2xx — success. 200 OK, 201 Created, 204 No Content.
3xx — redirection. 301 (moved permanently), 302/307 (temporary), 304 Not Modified (use your cache).
4xx — the client got it wrong. 400, 401 (not authenticated), 403 (forbidden), 404 (not found), 429 (too many requests).
5xx — the server got it wrong. 500, 502 (bad gateway), 503 (unavailable).

Tip: a 405 Method Not Allowed means the URL exists but does not accept the method you used — for example, sending a POST to a page that only serves GET.

Headers worth knowing

Content-Type — what the body is (text/html, application/json, image/png).
Content-Length — how many bytes the body is.
Cache-Control — how long the response may be reused.
Authorization — credentials for the request.
Location — where a redirect points.

HTTP/2 and HTTP/3 change how these bytes travel over the wire — multiplexing many requests over one connection, compressing headers — but the request/response model above stays exactly the same.