HTTP response headers are a batch of key-value pair metadata that the server sends before returning the body, covering content type, caching policy, security policy (such as CSP, HSTS), cross-origin control (CORS), and X-prefixed custom fields; the browser parses some fields but completely ignores unrecognized custom fields, and never displays them to the user.