What Are HTTP Headers?
HTTP headers are metadata fields transmitted automatically with every request your browser sends to a web server. They contain technical information about your browser, your preferences, the type of content you can accept, and the context of your request. Headers are invisible to users during normal browsing — they operate silently in the background of every page load, image request, and API call.
While headers serve legitimate technical purposes — telling servers what languages you prefer, what types of files your browser can handle, and what security policies to apply — they also transmit information that can be used to identify and track you.
Key HTTP Headers and What They Reveal
The User-Agent header is the most well-known identifying header. It contains your browser name and version, operating system name and version, and often additional information about your rendering engine and device type. A typical User-Agent string might identify your device as running Chrome 124 on Windows 11, immediately narrowing the field of possible users.
The Accept-Language header lists the languages your browser prefers, in order of priority. This is set based on your operating system language settings and any additional languages you have configured in your browser. A User-Agent showing a browser on a system with English as primary language and Thai as secondary is significantly more specific than either attribute alone.
The Accept header specifies the content types your browser can handle — HTML, JSON, images, and so on. While less distinctive than User-Agent or Accept-Language, it varies between browsers and versions in ways that can contribute to fingerprinting.
The Referer header tells the server which page you came from when following a link. This can expose browsing history to sites you visit, revealing that you came from a competitor's website or a specific article.
The DNT (Do Not Track) header was designed to let users signal that they do not wish to be tracked. However, virtually no advertising networks honor it, and its presence itself has become a fingerprinting signal — since most users have it disabled, enabling it makes you more identifiable rather than less.
The User-Agent Header in Detail
The User-Agent string deserves particular attention because of its tracking implications. Historically, User-Agent strings became extremely long and detailed as browser vendors tried to maintain compatibility with servers that served different content based on browser capabilities. Today they contain information that is far more detailed than technically necessary.
A modern Chrome User-Agent on Windows might look like: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36. This single string reveals the operating system and version, the CPU architecture, the browser name and major version, and multiple historical compatibility identifiers.
Web browsers have been gradually moving to reduce User-Agent granularity. Google's Privacy Sandbox initiative includes a proposal called User-Agent Reduction that standardizes certain parts of the User-Agent string to reduce fingerprinting. However, this is a gradual process and current User-Agent strings remain highly identifying.
Client Hints: The User-Agent Replacement
User-Agent Client Hints (UA-CH) is a newer mechanism designed to replace the traditional User-Agent header with a more privacy-respecting approach. Instead of sending all browser information automatically, Client Hints allows servers to request only the specific information they need. A server that only needs to know the browser name can request just that, without receiving the operating system version, architecture, and other details.
In practice, servers that use Client Hints can still request very detailed information. The privacy benefit depends on whether servers request minimal or comprehensive hints. SpeedIQ's header analysis tool shows both your traditional User-Agent and any Client Hints that your browser exposes.
What SpeedIQ's Header Tool Shows
SpeedIQ's HTTP headers tool analyzes the headers your browser sends and presents the most privacy-relevant information in readable form. It shows your User-Agent string broken down into its components — browser, operating system, and architecture. It shows your Accept-Language settings, which reveal your language preferences and geographic context. It shows whether you have DNT enabled and what value it is set to.
The tool also shows the HTTP protocol version your browser uses — HTTP/1.1, HTTP/2, or HTTP/3 — which is itself a fingerprinting data point, as different browser versions and configurations support different protocol versions.
How to Reduce Header-Based Tracking
Completely eliminating HTTP headers is not feasible — they are a fundamental part of how the web works. However, several approaches can reduce the fingerprinting information they transmit.
The Tor Browser standardizes User-Agent strings across all Tor users, making all Tor Browser sessions appear to come from the same browser version regardless of the underlying operating system. This is the most effective approach for eliminating User-Agent-based fingerprinting.
Firefox's Resist Fingerprinting mode standardizes several headers, including the User-Agent, to reduce fingerprinting. It also removes or standardizes other headers that contribute to fingerprinting.
Some browser extensions allow User-Agent spoofing — presenting a different User-Agent string to servers than your actual browser would send. However, if your reported User-Agent is inconsistent with other fingerprinting attributes (such as JavaScript APIs only available in certain browsers), the inconsistency itself becomes identifying.
Disabling the Referer header prevents sites from seeing where you came from. Firefox and some browsers allow disabling or limiting Referer transmission in privacy settings. This primarily protects your browsing history rather than your device identity.
Frequently Asked Questions
Can I see the headers my browser sends?
Yes. In Chrome and Firefox, open Developer Tools (F12), navigate to the Network tab, reload the page, and click on any request. The Headers section shows all request headers sent by your browser and all response headers received from the server. This is useful for understanding exactly what information your browser transmits.
Does the User-Agent expose my exact OS version?
Yes. The User-Agent string typically includes the full Windows NT version number (e.g., NT 10.0 for Windows 10 and 11), the macOS version, or the Linux distribution identifier. This level of specificity, combined with browser version, significantly narrows the identifying characteristics of your User-Agent.
Is it possible to send completely fake headers?
Users cannot directly modify the headers their browser sends without using extensions or specialized tools. However, browser extensions can modify or spoof User-Agent and Referer headers. The effectiveness of this depends on consistency — a spoofed header that contradicts other fingerprinting signals may be more identifying than an honest one.
Do headers change on mobile devices?
Yes. Mobile User-Agent strings typically identify the mobile operating system and device model or category. Mobile browsers also send additional headers related to mobile-specific capabilities. This makes mobile User-Agent strings at least as identifying as desktop ones, and in some cases more so because fewer distinct mobile browser versions exist in the wild.