What Are HTTP Headers?
HTTP headers are key-value pairs of metadata sent alongside every web request and response. They are invisible to most users but contain a wealth of information about the browser, the server, and the content being transferred.
Every time your browser loads a webpage, it sends request headers. The server reads them and responds with response headers. Both types carry important information about how the connection should work.
See exactly what your browser sends with our HTTP Headers Checker.
Common Request Headers and What They Reveal
User-Agent
The most identifying request header. It tells the server exactly which browser and operating system you are using, down to the version number. Example: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/124.0
This header alone can narrow down your identity significantly and is a major component of browser fingerprinting.
Accept-Language
Your preferred languages in order of preference. Example: en-GB,en;q=0.9,fr;q=0.8. Combined with other headers, this helps identify your region and native language.
Referer
The URL of the page you were on before clicking the link. If you click a link on a forum to visit a website, that website sees the forum URL in the Referer header. This is how website analytics track traffic sources — and why our Dereferer tool exists.
Cookie
Any cookies stored for that domain are sent automatically with every request. This includes session tokens, tracking IDs, and personalisation preferences.
Accept-Encoding
Tells the server which compression formats your browser supports. Typically gzip, deflate, br. This header enables faster page loads through compressed responses.
Important Security Response Headers
Response headers from the server can significantly affect your security. Use our HTTP Headers Checker to inspect any website's response headers.
Content-Security-Policy (CSP)
Tells the browser which sources are allowed to load scripts, images, and styles. A strong CSP prevents cross-site scripting (XSS) attacks by blocking malicious injected scripts.
Strict-Transport-Security (HSTS)
Tells the browser to always use HTTPS for this domain, even if the user types HTTP. Prevents SSL stripping attacks and man-in-the-middle interception.
X-Frame-Options
Prevents your website from being embedded in an iframe on another site. This blocks clickjacking attacks where an attacker overlays an invisible version of your site over another page.
Referrer-Policy
Controls how much referrer information is sent when users navigate away from your site. Setting this to no-referrer or strict-origin protects your users' privacy.
X-Content-Type-Options
Setting this to nosniff prevents browsers from guessing the content type of a response and executing it as something unexpected. Stops a class of content-sniffing attacks.
Check Your Website's Security Headers
Our HTTP Headers Checker lets you enter any URL and see all response headers in one view. Security-critical headers are highlighted so you can quickly identify what your site is missing.
Related Tools
- What Is My IP — See all headers your browser sends
- Dereferer — Remove the Referer header from links you share
- Browser Fingerprint Checker — Full privacy audit including headers