What are HTTP headers?

HTTP headers are metadata fields that your browser sends automatically with every request to a web server. They describe your browser, your preferences, the content types you accept and the context of the request.

Headers are invisible during normal browsing. They work silently in the background of every page load, image, script and API call. The server needs some of them to work: it uses Accept-Encoding to pick a compression format and Accept-Language to pick the page language. The same data also helps trackers. For the strategic overview of where header fingerprinting fits with other techniques, see our complete browser fingerprinting guide and the online privacy check overview.

Which HTTP headers reveal the most?

User-Agent, Accept-Language and the User-Agent client hints reveal the most. The table shows what each header tells a server.

HeaderWhat it revealsExample value
User-AgentBrowser name and version, operating system name and versionMozilla/5.0 (Windows NT 10.0; Win64; x64) … Chrome/…
Accept-LanguagePreferred languages and region, which reveal your locale and possibly your nationalityde-DE,de;q=0.9,en;q=0.8
Accept-EncodingWhich compression formats your browser supportsgzip, deflate, br
DNT (Do Not Track)Whether you switched on the old Do Not Track signal1
Sec-CH-UA headersClient hints from Chromium-based browsers that report browser brand, major version, mobile or not, and platform"Chromium";v="…", "Google Chrome";v="…"
Sec-GPCGlobal Privacy Control signal, the successor to DNT1

User-Agent

The User-Agent header reports your browser and operating system. Chrome has reduced it since 2022: the minor version numbers and the platform version are now frozen values, so the string carries less detail than before.

Accept-Language

Accept-Language lists your preferred languages with weights (q values). A rare combination, such as Lao plus German plus English, narrows you down quickly. MDN notes that Safari always sends only one language, and Chrome does the same in incognito mode, to reduce fingerprinting.

DNT (Do Not Track)

Ironically, switching on DNT can make you more unique, because only part of users send it. The DNT standard has been discontinued and is deprecated in favour of Global Privacy Control (Sec-GPC). Treat this as a rule of thumb: how much DNT or GPC adds depends on how common it is among the visitors of a site.

Sec-CH-UA client hints

Chromium-based browsers send three low-entropy client hints by default: Sec-CH-UA (brand and major version), Sec-CH-UA-Mobile and Sec-CH-UA-Platform. More detailed high-entropy hints, such as the device model or full version, are sent only when the server asks for them with an Accept-CH header and the browser allows it.

How is an HTTP headers fingerprint built?

A server combines header values, and often their order, into one profile. By combining User-Agent with Accept-Language and Sec-CH-UA headers, trackers can identify your browser, operating system and locale with high confidence.

  • Values: the exact strings in each header.
  • Order: every browser sends its headers in a typical order. A script that claims to be Chrome but sends headers in a different order stands out.
  • HTTP/2 settings: Akamai researchers showed in 2017 that HTTP/2 clients can be fingerprinted passively from their SETTINGS and WINDOW_UPDATE frames, stream priorities and the order of pseudo-headers.
  • Structured methods: FoxIO's JA4H, part of the JA4+ suite, turns HTTP request properties into a hash for security tools.

When combined with canvas fingerprinting, WebGL fingerprints and the TLS fingerprint (JA3/JA4), HTTP headers add extra uniqueness to your overall browser profile. Bot detection also checks whether all layers agree.

Server-side vs client-side browser fingerprinting: where do headers fit?

HTTP headers are a server-side, passive signal. The server collects them from every HTTP request without running code in your browser.

Client-side browser fingerprinting works differently. A JavaScript file calls browser APIs, for example canvas, WebGL, audio, installed fonts, screen size or timezone, and sends the results back. Libraries such as FingerprintJS combine many of these values into one unique identifier. Server-side and client-side data are often joined: the headers give a quick first profile, the JavaScript APIs add detail, and the IP address and cookies link visits.

Server-side (headers)Client-side (JavaScript APIs)
Needs JavaScriptNoYes
Blocked by script blockersNoOften
DetailBrowser, OS, language, encodingGraphics, fonts, audio, hardware, screen
Typical useBot detection, content negotiationTracking, fraud prevention

Do incognito mode, a proxy or a VPN change your headers?

Mostly not. Incognito mode deletes cookies after the session, but the browser still sends the same User-Agent and client hints. One small exception: in incognito mode Chrome lists only one language in Accept-Language.

A VPN or proxy changes the IP address the website sees. It does not rewrite the headers your browser builds. Some proxies even add their own headers, which can expose that a proxy is in use. Automation tools and bots often fail here: a script may copy a Chrome User-Agent but send a different set or order of headers, which bot detection on a CDN can spot.

Does an HTTP headers fingerprint identify you?

Not on its own in most cases. Millions of people use the same browser version with the same language, so the header set of a common setup is shared by many users. Rare languages, old browsers, unusual extensions that add headers or edited User-Agent strings make it more distinctive. Headers are passive data: the server gets them without running any script, so blocking JavaScript does not hide them.

How can you reduce HTTP header exposure?

Use a browser that sends standard or reduced header values, and do not edit headers by hand.

  • Brave normalises some header values to reduce fingerprint uniqueness. Since version 1.39 it reports only your most preferred language and randomises its weight.
  • Firefox with privacy hardening sends fewer identifying values. Mozilla reports that the fingerprinting defences in Firefox 145 cut the share of users seen as unique almost in half in Private Browsing and Enhanced Tracking Protection Strict.
  • Tor Browser sends standardised header values. It reports all Windows systems as Windows 10, all macOS systems as OS X 10.15, all Android devices as Android 10 and other systems as Linux, and limits requested languages to a small set. Our Tor Browser privacy guide and privacy browser comparison cover the trade-offs.
  • Avoid User-Agent switcher extensions. A faked User-Agent that does not match your TLS fingerprint or client hints makes you stand out more.
  • Keep only the languages you need in your browser settings.

How can you check what your browser sends?

Open the developer tools (F12), go to the Network tab, click any request and look at "Request Headers". This shows the full header list.

The SpeedIQ privacy check shows the values that also appear in your headers, as JavaScript sees them: User Agent, language, Do Not Track and cookies, next to timezone, screen, hardware and a Canvas hash. It does not list the raw request headers. The results stay in your browser. Run the SpeedIQ test to compare these values with your expectations.

FAQ

What is an HTTP headers fingerprint?

It is a profile built from the headers your browser sends with every request, such as User-Agent, Accept-Language and client hints, including their order.

Can websites see my HTTP headers without JavaScript?

Yes. Your browser sends headers with every request, so the server receives them even when JavaScript is blocked.

Does Do Not Track protect my privacy?

No. DNT is deprecated and websites can ignore it. It can even add a bit of uniqueness to your headers.

Does a VPN change my HTTP headers?

No. A VPN changes your IP address, but your browser still sends the same User-Agent, language and other headers.

What are Sec-CH-UA headers?

They are User-Agent client hints sent by Chromium-based browsers. By default they report brand, major version, mobile status and platform.

Sources