HTTP Headers Inspector

Every HTTP request your browser sends includes headers that reveal information about you - your browser, OS, language, referrer, and more. This tool shows exactly what your browser is sending.

Fetching your request headers…

What Are HTTP Headers?

HTTP headers are metadata fields sent with every web request and response. When you visit a website, your browser automatically includes headers that reveal your user agent, preferred language, accepted content types, referrer URL, and more. Servers use these headers to deliver the right content, but they can also be used to track and fingerprint you.

Why Are HTTP Headers a Privacy Concern?

Headers can expose identifying metadata. TheUser-Agent header reveals your browser, operating system, and device type, though browsers may reduce this detail. TheAccept-Language header exposes language preferences, not proof of nationality. Forwarding headers such as X-Forwarded-For may be added by an HTTP proxy or Zunavek’s own CDN. Their presence alone does not show that a VPN leaked an address.

How to Reduce Header Leakage

  • If you use an HTTP proxy, review which forwarding headers it adds. An ordinary VPN cannot rewrite headers inside end-to-end HTTPS.
  • For sites you control, set an appropriate Referrer-Policy to limit referrer information sent on outgoing requests.
  • Review your browser’s privacy controls and compare observed headers before and after changes.
  • Read each browser’s documentation before changing user-agent or client-hint settings; unusual values can also distinguish a browser.

See MDN’s forwarding-header documentation for how proxies add addresses and why the trusted proxy chain matters.

Learn more in our guide: Privacy Browser Settings.

Related Tools & Guides

Frequently Asked Questions

Can websites see all my HTTP headers?

Yes. Every server you connect to receives the full set of headers your browser sends. This includes your user agent, language, accepted content types, cookies, and any custom headers your extensions or VPN add.

What is the most dangerous header for privacy?

The X-Forwarded-For header is the most dangerous because it can expose your real IP address when a proxy or CDN is misconfigured. The Referer header is also risky because it reveals the previous page you visited.

Does using HTTPS hide my headers?

HTTPS encrypts your headers in transit, so third parties cannot read them. However, the destination server still receives all headers in plain text. HTTPS protects against interception, not against the server itself.