# Response headers for AI clients

Response headers describe formats, discovery links and request policy. Check both what a header declares and whether the server behaves accordingly.

Response headers are the metadata a server sends with every page, and the right ones let an AI client work without parsing the full HTML. They are the cheapest place to make a site more legible to automated clients, because a client reads them before it reads the body. The reason headers matter is order. A client fetches the response, reads the status and headers first, and decides what to do next from them. If the headers already say where the structured data is and what formats are available, the client can skip the expensive step of parsing a page built for human display.

## Content type

Content-Language and a clean content type remove ambiguity about what the client is reading. A response that states its language and its exact content type leaves no guesswork about how to parse it or which version of a page it received.

## Link and Vary

A Link header can point a client straight at a site's machine-readable resources, such as an API catalog or a markdown version of the page, so the client finds them without crawling. A Vary header that includes Accept tells caches and clients that the site can return different formats for the same URL, which is what makes markdown content negotiation reliable. A missing Vary header breaks content negotiation, because a cache can then serve the wrong format to the next client that asks. A Cache-Control immutable directive set on the wrong response can also stop a client from seeing an update.

## Rate limits

RateLimit-Policy states the quota a server enforces, and RateLimit adds the remaining allowance per client where the server tracks one, so a well-behaved client can throttle itself instead of guessing. Sending a RateLimit-Policy header does not by itself prove the server enforces the stated quota. Checking enforcement means sending requests past the stated limit and confirming the server responds accordingly, not reading the header alone. This site sends the policy header on every response and enforces it, and it keeps no per-client counter, so it sends no RateLimit header.

## Verification

As of July 2026 the [IETF draft](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/), revision 11 from May 2026, remains active without yet becoming a standard. Checking a site's headers means requesting a page and reading the response headers directly, then confirming the behaviour they describe, such as a different response for a different Accept value or a request that is actually throttled once a stated limit is passed. The fix for a missing or wrong header is usually small and lives at the edge, which on turva.dev is a Cloudflare Worker that sets these headers on every response.

## Frequently asked

**Which response headers help AI agents?**

A Link header points an agent at machine-readable resources such as an API catalog or a markdown version of the page. A Vary header that includes Accept makes markdown content negotiation reliable. A RateLimit-Policy header, and a RateLimit header where the server tracks a per-client allowance, let a well-behaved agent throttle itself, and Content-Language with a clean content type removes ambiguity.

**Why do response headers matter to agents?**

An agent reads the status and headers before the body and decides what to do from them. If the headers already say where the structured data is and what formats are available, the agent can skip parsing a page built for human display.

**Which header makes markdown content negotiation reliable?**

A Vary header that includes Accept. It is what keeps the negotiation reliable when the same URL can return more than one representation of the page.

## Sources

- [Web linking, RFC 8288](https://www.rfc-editor.org/rfc/rfc8288.html)
- [API catalog, RFC 9727](https://www.rfc-editor.org/rfc/rfc9727.html)
- [RateLimit header fields, IETF draft](https://datatracker.ietf.org/doc/draft-ietf-httpapi-ratelimit-headers/)
- [HTTP semantics, RFC 9110](https://www.rfc-editor.org/rfc/rfc9110.html)

## Related

- [Serving Markdown to AI clients](/guides/markdown-for-agents)
- [When AI clients cannot read rendered pages](/guides/prerendering-for-agents)
- [The /.well-known directory for agent discovery](/guides/well-known-for-agents)