My HTTP Headers
See exactly what your browser sends with every request
Wondering how unique your browser is? Check your browser fingerprint — the signals websites use to identify you without any cookies.
Check Your Fingerprint →What are HTTP headers?
Every time your browser opens a website, it doesn't just send a request for the page — it sends a packet of metadata alongside that request. That metadata is the HTTP headers.
You never type these headers. You never see them in normal browsing. But every server you visit reads them, and they reveal a surprising amount about you: what browser you use, what operating system you're on, what languages you speak, where you came from, whether you're behind a proxy, and what kind of content you accept.
The live widget above shows every header your browser sent to load this page. Below is a full categorized reference of common HTTP headers, what each does, and what it reveals.
What your headers reveal about you
Some HTTP headers are technically necessary — they tell the server how to format the response. Others are identity fingerprints: combined together, they make your browser uniquely recognizable across the internet, even without cookies.
- Your User-Agent alone narrows you to a few thousand people. Sometimes far fewer, depending on your browser/OS/architecture combination.
- Accept-Language reveals your country and likely native language. Sites use it to localize; trackers use it to build profiles.
- Client Hints (Sec-CH-UA-*) are newer, more precise versions of User-Agent. Enabled by default in Chromium browsers. Safari refuses to implement them on privacy grounds.
HTTP headers reference
~38 common request headers, grouped by purpose.
Identification headers
User-Agent#
Identifies your browser, version, rendering engine, and OS. The most fingerprintable single header. Combined with other data, it often makes you uniquely identifiable. Defined in RFC 9110 §10.1.5.
Sec-CH-UA#
"User-Agent Client Hints." A newer, structured replacement for User-Agent. Reveals browser brand and version in a machine-readable format. Sent by default in Chrome, Edge, and other Chromium browsers. Not sent by Safari or Firefox.
Sec-CH-UA-Platform#
Your OS family — "Windows", "macOS", "Linux", "Android", or "iOS". Sent by default in Chromium as a low-entropy hint.
Sec-CH-UA-Mobile#
?1 if you're on a mobile device, ?0 if not. Sent by default in Chromium alongside the other low-entropy Client Hints.
Language & content negotiation
Accept-Language#
Your preferred languages in priority order (e.g. en-US,en;q=0.9,fr;q=0.7). Servers use it to localize content; trackers use it to infer your country and native language.
Accept#
The MIME types your browser is willing to receive. Reveals which image formats and content types your browser supports — another fingerprinting signal.
Accept-Encoding#
Compression algorithms your browser supports (typically gzip, deflate, br, zstd). Lets the server send compressed responses to reduce transfer size.
Accept-Charset#
Character sets the client accepts. Almost always omitted by modern browsers — servers default to UTF-8 and this header became redundant.
Connection & proxy chain
X-Forwarded-For#
The chain of IP addresses your request passed through. If you're behind a proxy or VPN, your real IP can still appear here as the leftmost address. Sites can read this to bypass simple VPN masking.
X-Real-IP#
Often set by reverse proxies (nginx, Caddy) to indicate the client's true IP, separate from the proxy chain.
CF-Connecting-IP#
Cloudflare's version of "your real IP." On any Cloudflare-protected site, this is what the origin server actually sees — not the Cloudflare edge node IP.
CF-IPCountry#
Two-letter country code Cloudflare detected from your IP (e.g. US, DE, IN).
CF-Ray#
Unique ID Cloudflare assigns to each request. Useful for debugging; useless for tracking you since it changes with every request.
Via#
Indicates intermediate proxies or gateways the request passed through. Rare for normal traffic; common in corporate networks and CDN chains.
Origin & referrer
Referer#
The full URL of the page you came from. Reveals your browsing path to every site you visit. Many browsers now strip or shorten this for privacy. Note: yes, this is an official misspelling — the original 1996 spec (RFC 1945) had a typo, and it was too late to fix it.
Origin#
The scheme + host of the page making the request (no path, no query). Sent on cross-origin requests so the server can enforce CORS. Less leaky than Referer — it only reveals the site, not the specific page.
Security & fetch metadata
Sec-Fetch-Site#
Where the request originated: same-origin, same-site, cross-site, or none. Helps servers detect CSRF and SSRF attacks.
Sec-Fetch-Mode#
The mode: navigate (you clicked a link), cors, no-cors, same-origin, or websocket.
Sec-Fetch-Dest#
What the response is for: document, image, script, style, font, iframe, etc.
Sec-Fetch-User#
?1 if the request was triggered by user action (click, key press). Distinguishes user-initiated navigation from script-initiated requests.
Sec-Fetch-Storage-Access#
active or inactive — whether the request has access to unpartitioned cookies. Part of the Storage Access API (2024+), relevant for cross-site auth flows.
Caching
Cache-Control#
Instructions to caches (browser, CDN, proxy) about freshness and storage. Defined in RFC 9111.
If-None-Match#
Sent with an ETag from a previous response. The server replies 304 Not Modified if the resource hasn't changed — saves bandwidth.
If-Modified-Since#
A timestamp from your last fetch. Same idea as If-None-Match, older mechanism.
If-Match#
Only proceed if the resource matches the given ETag. Used for optimistic concurrency control in REST APIs.
Pragma#
Legacy HTTP/1.0 cache directive. Modern browsers may still send Pragma: no-cachefor backward compatibility, but it's deprecated in favor of Cache-Control.
Cookies & state
Authentication
Connection control & performance
Connection#
Usually keep-alive — keeps the TCP connection open for multiple sequential requests.
Host#
The domain you're connecting to. Required since HTTP/1.1 — allows virtual hosting on shared IPs.
Upgrade-Insecure-Requests#
1 if your browser prefers HTTPS responses over HTTP when both are available.
Save-Data#
on if the user has enabled "data saver" mode in the browser or OS. Sites can respond with lighter assets — smaller images, fewer fonts.
Priority#
Hints request priority (u= urgency, i= incremental) for HTTP/2 and HTTP/3 stream scheduling. Defined in RFC 9218.
Range#
Request only a byte range of the resource (e.g. bytes=0-1023). Used by video players, download managers, and resumable downloads.
Privacy signals
DNT (Do Not Track)#
Set to 1 if you've enabled "do not track." Mostly ignored by sites — a polite request with no legal enforcement in most countries.
Sec-GPC (Global Privacy Control)#
1 if your browser signals "do not sell or share my personal data." Unlike DNT, GPC has legal standing under California's CCPA. Sent by Firefox by default, Brave, and DuckDuckGo browser; opt-in elsewhere.
How to reduce what your headers reveal
You can't disable HTTP headers — they're required for the web to work. But you can reduce how identifying they are:
- Use Firefox with privacy.resistFingerprinting = true (about:config).
- Use the Tor Browser for the strongest defense — all Tor users present identical headers.
- Use a VPN to mask your IP — but note this doesn't change your User-Agent, Accept-Language, or other fingerprinting signals.
- Disable Client Hints in Chromium via chrome://flags/#user-agent-reduction.
- Strip Referer with a browser extension (uBlock Origin advanced mode, uMatrix).
Privacy resistance requires all users of your browser config to look identical. One-off tweaks usually make you more unique, not less.
Frequently asked questions
What HTTP headers does Chrome send?
By default, Chrome sends: Host, User-Agent, Accept, Accept-Language, Accept-Encoding, Connection, plus low-entropy Client Hints Sec-CH-UA, Sec-CH-UA-Mobile, and Sec-CH-UA-Platform, the full Sec-Fetch-* metadata family, and Upgrade-Insecure-Requests: 1.
What HTTP headers does Safari send?
Safari sends Host, User-Agent, Accept, Accept-Language, Accept-Encoding, and Connection. Safari does not send Sec-CH-UA Client Hints and strips Referer more aggressively by default.
What HTTP headers does Firefox send?
Firefox sends Host, User-Agent, Accept, Accept-Language, Accept-Encoding, Connection, and Upgrade-Insecure-Requests. Firefox does not send Client Hints.
Can I hide my HTTP headers?
Not entirely — servers need most of them to respond correctly. You can spoof or strip identifying ones using privacy-focused browsers or extensions.
Is my User-Agent unique?
Often, yes. The combination of browser + version + OS + architecture narrows most users to a few thousand worldwide.
What is X-Forwarded-For?
A header added by proxies and CDNs recording the original client IP. If you're behind a VPN, your real IP may still appear here.
Why is Referer misspelled?
The HTTP/1.0 spec (RFC 1945, 1996) contained the typo. The correct spelling is Referrer; the header name remains Referer.
Are HTTP headers private?
No. Every server you connect to sees them. Over HTTPS, the headers are encrypted in transit.
Can a website see my real IP if I use a VPN?
The IP your VPN exit node presents will be in the connection headers. WebRTC leaks and DNS leaks can sometimes expose your real IP separately.
What is the difference between Referer and Origin?
Referer is the full URL of the previous page (path + query). Origin is just scheme + host — less leaky. Browsers send Origin on cross-origin requests for CORS; Referer is sent on most navigation.