What HTTP Headers Reveal
Browsers send headers so websites can process requests, select content, and manage sessions. Some values also reveal browser characteristics or navigation context. Understanding their purpose helps you distinguish normal web behavior from information you may prefer to limit.
HTTPS encrypts headers and content while they travel to the TLS endpoint. The receiving website or TLS-terminating proxy can read them. A network observer can still see some connection metadata, such as destination addresses.
Headers Worth Reviewing
User-Agent
The User-Agent string describes browser and platform compatibility. It is not a device ID, and many users send the same value. Browsers may reduce its detail; a changed or spoofed value can also disagree with other signals.
Referer and Navigation Context
The Referer header depends on referrer policy. The modern default, strict-origin-when-cross-origin, sends the origin for cross-origin requests at the same security level, the fuller URL for same-origin requests, and no referrer on an HTTPS-to-HTTP downgrade. It does not normally send a search query or full page path to an unrelated HTTPS site. See MDN's Referrer-Policy reference.
A site can choose another policy, and URLs can contain sensitive data. Site owners should avoid placing secrets in URLs and select an appropriate policy, such as no-referrer where referral information is unnecessary. Browser behavior and the request context still matter when inspecting a result.
Accept-Language
This header lists language preferences so sites can choose content. Uncommon combinations can help distinguish browsers when combined with other signals. Removing languages you do not need may reduce detail, but switching everyone to English does not guarantee anonymity and can make sites less usable.
X-Forwarded-For: Proxy Metadata
A proxy or load balancer may add X-Forwarded-For to describe client or proxy addresses. Its presence alone does not show that a browser supplied an address or bypassed a VPN. Values can be forged unless the server validates the trusted proxy chain. See MDN's proxy trust guidance.
Client Hints
Supporting browsers send a limited set of User-Agent Client Hints by default. A server can request additional hints with Accept-CH, subject to browser support and policy. These requests do not generally produce a user-facing device-information permission prompt. See MDN's Client Hints guide.
Low and High Entropy
Default UA hints can include browser brands, mobile status, and platform. Requested high-entropy UA hints can add details such as architecture, platform version, or model where supported. Low entropy means less distinguishing detail; it does not mean a request is anonymous.
Device memory is a separate hint, not an exact RAM inventory. The Device Memory specification rounds and bounds the reported value to reduce precision. A reported value such as 8 is an approximation, not proof of installed hardware.
GREASE Brands
UA Client Hints can include intentionally unusual brand entries so sites avoid depending on a fixed brand list. These entries are a compatibility mechanism, not evidence of malware or an individual tracking ID.
Headers and Browser Fingerprinting
Fingerprinting combines signals to try to recognize a browser across visits. Headers may contribute alongside screen properties, fonts, graphics output, or account information. Recognition depends on the population being compared and how stable those signals remain.
The simulator illustrates signal combinations; it does not measure your uniqueness among real users:
Experiment: Build a Browser Fingerprint
Combine example signals that fingerprinting systems may use. This demo does not inspect your browser.
Combining signals can help distinguish browsers, but rarity depends on their actual values, correlations, and the comparison population. Checkbox count cannot establish uniqueness or identity.
Canvas and WebGL
Scripts can compare rendered graphics or reported graphics capabilities. Differences in software, fonts, drivers, and hardware can affect results, while multiple devices can produce matching outputs. Recognition accuracy depends on the signals and population tested. These JavaScript signals are separate from HTTP headers.
Clearing Cookies and Recognition
Clearing cookies removes one source of identifiers. It may leave other storage or observable browser properties unchanged, so a site may still attempt to link visits. Fingerprinting alone does not guarantee that it can recognize a particular person or restore a previous cookie.
ETags and Cache Identifiers
An ETag normally identifies a resource version. On a later request, the browser can return it in If-None-Match so the server can avoid sending unchanged content. It is not inherently a user ID; a server can misuse a personalized validator for recognition. Browser cache isolation and retention affect that possibility. See MDN's ETag reference.
Browser Privacy Controls
Built-in tracking and fingerprinting protections differ by browser, platform, and release. Check the controls available in the browser you use rather than relying on a universal ranking.
- Brave: Its documented farbling design varies selected outputs by site and session while keeping them consistent for repeated reads in that context. See Brave's design explanation.
- Tor Browser: Uses network routing and browser defenses to reduce linkability. Accounts, customizations, and behavior can still identify activity.
- Other browsers: Review tracking protection, cookie isolation, and fingerprinting controls in current documentation. Protections can reduce particular signals without blocking every form of recognition.
Global Privacy Control
Sec-GPC: 1 signals an opt-out preference concerning sale or sharing of personal data. It is a preference signal, not a technical request blocker. Check your browser's setting; sending it does not itself stop headers from reaching a site.
Content-Blocking Extensions
Content blockers can prevent matched requests, so those requests and their headers are not sent. Coverage depends on filters and browser capabilities. Privacy Badger uses a pretrained tracker list by default; local learning is optional, not its default behavior. See EFF's explanation of the change.
Practical Header Privacy Checks
- Keep your browser updated and review its built-in tracking protections.
- Limit unnecessary extensions and language preferences; check that sites you need still work.
- Use browser data-clearing controls when you want to remove cached and stored site data.
- Inspect request headers before and after a change, using the same request context.
Site owners should also review referrer policy, unnecessary Client Hints requests, and how their infrastructure handles forwarded addresses. Visitors cannot control headers that a destination's own proxies add.
Header Privacy Quick Reference
HTTP Header Privacy Reference
| Feature | ||||
|---|---|---|---|---|
| User-Agent | Browser and platform details; varies by UA reduction | Contributes to fingerprinting | Review built-in fingerprinting protections and UA reduction | Low |
| Accept-Language | Preferred Languages, Locale | Contributes to fingerprinting | Limit unnecessary language preferences without breaking usability | Low |
| Referer | Origin or referring URL, depending on policy | Depends on policy and URL content | Site owners: use an appropriate Referrer-Policy | Low |
| ETag (If-None-Match) | Resource validator; can be misused as an identifier | Depends on use and cache isolation | Clear cached site data when needed; review tracking protection | Low |
| Client Hints | Browser/platform; requested hints may add detail | Medium (Fingerprinting) | Review browser support and fingerprinting controls; no universal prompt | Medium |
| X-Forwarded-For | Client/proxy addresses, if added by a proxy | Sensitive; provenance matters | Trust only values added by configured reverse proxies; do not infer VPN bypass | Medium |
User-Agent Reduction and Remaining Signals
Chromium has reduced detail in its legacy User-Agent string while retaining the header. Client Hints support and User-Agent behavior vary across browsers. See Chromium's UA reduction documentation.
Reducing header detail addresses only part of tracking. Cookies, accounts, JavaScript-visible properties, and information you submit remain relevant. Use our HTTP Headers Inspector to inspect one request, and the fingerprinting guide for related signals.
Frequently Asked Questions
What are HTTP headers?
HTTP headers carry request and response metadata, such as content type, browser information, and language preferences. Which headers appear depends on the browser, request, website policy, and intermediaries.
Which HTTP header leaks the most personal information?
The Referer header can expose the previous page URL, subject to the browser and site referrer policy. X-Forwarded-For is proxy metadata that a reverse proxy or load balancer may add; its presence alone does not prove that a visitor sent their IP address or bypassed a VPN.
Can I stop sending HTTP headers entirely?
No. Headers are required for the web to function - without them, servers cannot process your requests, deliver the correct content, or maintain sessions. The goal is not to eliminate headers but to minimize the unique, identifying information they contain.
What is browser fingerprinting via headers?
Fingerprinting combines browser and device signals to try to distinguish visits. Headers can contribute, alongside JavaScript-visible properties. A fingerprint is not necessarily unique or stable, though clearing cookies alone may leave many signals unchanged.
Does HTTPS protect my headers from being read?
HTTPS encrypts HTTP headers and bodies in transit to the TLS endpoint. The destination server, and any proxy terminating that TLS connection, can read them. Network observers may still see connection addresses and other transport metadata.
How do I check what headers my browser is sending right now?
Use Zunavek’s HTTP Headers Inspector to inspect headers received for its test request. Request context matters: a navigation, an API call, and a request after Client Hints negotiation may carry different headers. Proxies can also add or modify values.