01What are HTTP headers for?
With every request, your browser attaches HTTP headers: key-value pairs describing what it is asking for and what it can accept — format, language, compression, browsing context. The server uses them to tailor its response: this is content negotiation.
This page is a mirror of your request: it shows exactly what a server receives from you. It is the classic tool to debug an HTTP client, check what a script or application really sends, inspect a reverse proxy, or understand why a website answers in the wrong language.
02The most common headers
- User-Agent
- Identifies the browser, its version and the operating system. Historically a catch-all, it is being scaled down in favor of Client Hints.
- Accept
- Content formats the client can handle (HTML, JSON, images…), with preferences.
- Accept-Language
- The user's preferred languages, in order. This is how a multilingual site picks its default language.
- Accept-Encoding
- Accepted compression algorithms (gzip, br, zstd) to reduce response size.
- Referer
- URL of the page the click came from. Truncated or absent depending on the origin site's privacy policy.
- Cookie
- Cookies stored for this site, sent back with every request.
- Sec-Fetch-*
- Security metadata set by the browser itself (impossible to forge from JavaScript): context, destination and origin of the request.
- Sec-CH-UA
- Client Hints: the structured replacement for the User-Agent — browser, platform, mobile or not.
03From the command line
As plain text, this page returns the list of your headers — handy to see what a script really sends, or to test a custom header with the -H flag:
$ curl its-my-ip.com/headers user-agent: curl/8.5.0 accept: */* $ curl -H "X-Debug: 1" its-my-ip.com/api/headers { "headers": { "x-debug": "1", … }, "connection": { "httpProtocol": "HTTP/2", … } }
04Frequently asked questions
What do my headers reveal about me?
Individually, not much: a browser, languages, accepted formats. But their exact combination (versions, order, preferences) contributes to fingerprinting: a signature that can identify your browser among millions, without any cookie. Modern browsers are gradually reducing these variations.
What is the User-Agent?
It is the header through which the browser introduces itself: name, version, rendering engine and operating system. Its odd syntax (every browser claims to be Mozilla) is a legacy of the 90s. It is progressively being replaced by Client Hints (Sec-CH-UA), which are more structured and less chatty.
What is HTTP/3?
HTTP/3 is the latest version of the web's protocol. It drops TCP in favor of QUIC, a transport built on UDP: faster connection setup, better resilience to packet loss and network switches (Wi-Fi to cellular). If this page shows HTTP/3, your browser and network already support it.
Why do some headers start with Sec-?
The Sec- prefix is reserved: these headers can only be set by the browser itself and can never be modified by a page's JavaScript. Servers can therefore trust them to detect the real context of a request, for instance to block certain cross-site attacks.
What are the headers “added by the proxy”?
This site is served behind Cloudflare. Like any proxy, it adds technical headers for the server: your original IP (CF-Connecting-IP), a request identifier (CF-Ray), the protocol used… Your browser never sent them: they are listed separately so they don't skew the reading.