HTTP Headers Test

Every time your browser fetches something, it sends a short block of plain text ahead of the actual request. The first line says what is being asked for; the lines under it are headers, each a name, a colon and a value. Host says which site is wanted, User-Agent says what is asking, and Accept-Language says which languages would be preferred. The server reads them before it decides what to send back.

The browser writes almost all of them for you. Your page cannot add a Host header, and it cannot remove Accept-Encoding, because those names sit on a list the fetch specification calls forbidden header names. The list exists to stop a script lying about where a request came from or what it can read. What is left are the headers that describe your client, and those are the ones worth seeing.

User-Agent is the loudest. It carries your browser, its version, the rendering engine and your operating system, and it is delivered in full to every host you contact. Accept-Language is quieter but often more revealing, because the combination of languages you have enabled is a narrower set than the browser version. A machine listing one uncommon language among the hundreds a browser could offer stands out.

Referer, spelled with the historical typo and all, tells the destination which page you came from. Its scope is limited by the referrer policy: the common default sends the full address for same-origin requests and only the bare origin when going to another site, which is why the panel above lists both. Sec-Fetch-Site does a similar job more reliably, marking a request as same-origin, same-site or cross-site.

The user agent test breaks the first of those into its parts, and the browser information test checks the string against the browser’s actual behaviour, since the two do not always agree.

Chromium browsers have been trimming the user agent to reduce how much it gives away. Instead of one detailed string, they send a short generic one and expose the specifics through User-Agent Client Hints: a set of Sec-CH-UA headers carrying the brand list, whether the device is mobile, and the platform name. A site reads the low-entropy hints for free; the rest, such as the exact platform version and the CPU architecture, arrive only after the site asks for them explicitly.

The brand list is worth a second look. Chromium deliberately inserts a randomised entry such as Not_A Brand into every version of it, so that code which scans blindly for a known brand breaks. That is a deliberate anti-sniffing measure, and it is why parsing client hints with a simple string match fails on some versions.

Firefox and Safari have not adopted the system. On those browsers the panel above reports the hints as not exposed, and the classic user agent string remains the only source. The client hints test goes into the full set, including the ones the browser will only hand over on request.

This is the honesty clause, and it matters. When a browser sends a request, it assembles the header block internally and hands it to the network stack. That block is never exposed back to the page. There is no API that returns the headers of the request that loaded the page, and no way to ask what the server received. Anything that claims otherwise is either reading something else or guessing.

So this tool reports what the browser is willing to say about itself, drawn from navigator and from the defaults the fetch specification documents. Where a value simply is not available to a script, the panel says so instead of filling the gap. Accept-Encoding, for example, is set by the browser and hidden from script, and it is listed that way.

The one reliable way to see a real header block is to look from the other side. A server you control, or a proxy you run, logs exactly what arrived. That is a developer’s method rather than a page’s, and it is the honest answer to the question this tool can only approximate.

Most of the use is ordinary and invisible. A site picks a language from Accept-Language, serves a compressed response based on Accept-Encoding, logs the user agent for support and analytics, and checks Sec-Fetch values to reject cross-site form posts. None of that is sinister, and it is why the headers exist at all.

The privacy angle is aggregation. A user agent alone places you among millions. Combined with a language list, a platform version and a set of features the browser supports, the crowd shrinks quickly. That combination is the same one the fingerprint test measures, and headers are usually the easiest part of it for a site to read because nothing has to be computed or asked for.