Connection: keep-alive, close and hop by hop headers
Connection controls what happens to the current connection after this message, and lists the headers that apply to this hop only and must not be forwarded.
At a glance
- Direction
- Both, and hop by hop: it applies to one connection rather than end to end.
- Defined in
- RFC 9110, with the HTTP/1.1 details in RFC 9112
- When absent
- HTTP/1.1 keeps the connection open by default, so no header is needed for the usual case.
- Common values
- keep-alive, close, and Upgrade when negotiating a protocol change
- Also lists
- Header names that a proxy must strip before forwarding
- Forbidden in
- HTTP/2 and HTTP/3, where a connection carrying it is malformed
- Default in HTTP/1.1
- Persistent. Sending keep-alive explicitly is redundant.
In detail
In HTTP/1.0 every request meant a new connection, and keep-alive was the opt in that changed that. HTTP/1.1 reversed the default: connections persist unless something says close. Sending keep-alive on an HTTP/1.1 message is therefore harmless but redundant, and the value that actually changes behaviour is close.
The second job is less well known. The header can list other header names, and a proxy must remove every header named there before forwarding the message. That is the mechanism that makes headers like Upgrade hop by hop: they describe this connection, and passing them along would apply them to a different one.
HTTP/2 and HTTP/3 removed the concept entirely. Multiplexing means one connection carries many streams, so a per message instruction about closing it makes no sense, and connection specific headers are forbidden. A message carrying one is treated as malformed, which is a real source of trouble when translating HTTP/1.1 messages onto an HTTP/2 connection.
Sending close is still useful in narrow cases: a client making exactly one request, or a server shedding load by refusing to keep sockets open. It is a per message instruction rather than a setting, so it has to appear on each message where you want it, and a server may close a connection whether or not anyone asked.
Persistent connections are also why a slow response blocks the ones behind it on HTTP/1.1. Requests on a single connection are answered in order, so browsers open several connections per host to work around it. That head of line blocking is the problem multiplexing solved, and it is the reason the header stopped making sense in the newer protocols.
Examples
GET /health HTTP/1.1
Host: example.com
Connection: closeConnection: Upgrade
Upgrade: websocketThe proxy must strip both before forwarding, because they describe this connection only.
Things that catch people out
- Sending this header on an HTTP/2 connection makes the message malformed, which catches out code that builds headers by hand for both versions.
- Connection: keep-alive on HTTP/1.1 does nothing, since persistence is already the default.
- A proxy that does not strip the headers listed here can forward a connection specific instruction to a connection it was never meant for.
Try it: HTTP Headers Checker
Check a live URL or paste headers you already have. It grades six security headers from A+ to F and lists every other header the response returned.
HTTP Headers Checker
LOCAL · Browser-OnlyView HTTP response headers for any URL
Enter any website URL to fetch and analyze its HTTP response headers. We'll automatically add https:// if needed.
Why Check Security Headers?
Security headers protect your website against common attacks like XSS, clickjacking, and MIME sniffing. They're set by your web server and cost nothing to implement. Missing security headers are one of the most common findings in security audits.
Related HTTP headers
All http headers →Upgrade: switching protocols on an open connection
How the Upgrade header negotiates a protocol switch, what a 101 response means, why proxies break WebSocket handshakes, and what HTTP/2 does instead.
Transfer-Encoding: chunked framing on the connection
What chunked transfer encoding does, why it is a hop by hop property, why it must never accompany Content-Length, and why HTTP/2 forbids it entirely.
Alt-Svc: advertising an alternative endpoint
How Alt-Svc advertises another protocol or endpoint for the same origin, what ma and persist do, and why it is how most sites move clients to HTTP/3.
Via: the proxies a message passed through
How Via records each intermediary, what the protocol and pseudonym fields mean, how it detects request loops, and why it is useful when debugging a cache.
Link: relationships expressed in a header
How the Link header carries relationships that markup cannot, its use for preload with early hints, and the pagination pattern that APIs build on it.
Server-Timing: server side metrics in the response
How to report server side durations to the browser, the dur and desc parameters, what it costs to expose them, and how to read them cross-origin.
Tools for this
- HTTP Request Builder Free online HTTP request builder - build and test HTTP requests with custom headers and body
- HTTP Headers Checker Free online HTTP headers checker - view HTTP response headers for any URL