HTTP Headers Check

Run this tool

Input or start condition: The low-risk current browser or connection check loads automatically.

Accepted input or signal: Current browser capability, Submitted lookup target.

Possible output: The safe allowlisted request headers received by the site's first-party diagnostic endpoint.; A parsed summary of the User-Agent header plus language, encoding, and Fetch Metadata values.

Key limitation: A browser extension, enterprise policy, VPN, or proxy can remove or rewrite non-sensitive request metadata.

What this checks

• The safe allowlisted request headers received by the site's first-party diagnostic endpoint.
• A parsed summary of the User-Agent header plus language, encoding, and Fetch Metadata values.
• Low- and high-entropy Sec-CH-UA client hints that the browser chose to send on this request.

How to interpret results

• Header values describe one request and can change with browser settings, extensions, privacy modes, proxies, or navigation context.
• Sec-Fetch values help explain where a request originated and what resource type the browser expected.
• Missing client hints are common because browsers and servers negotiate them selectively.

Common issues

• A browser extension, enterprise policy, VPN, or proxy can remove or rewrite non-sensitive request metadata.
• Accept-Language expresses ordered preferences and may not match the operating-system region or physical location.

What request headers tell a website

HTTP request headers carry format preferences and browser context before a page is returned. User-Agent and client hints describe compatibility, Accept headers describe usable response formats, and Fetch Metadata indicates whether the request is a navigation or another resource request.

This checker reflects the request that reached the site's own endpoint. It is therefore useful when debugging why a server selected a language, encoding, or browser-specific response.

Safe interpretation and privacy limits

No single header proves a user's identity or physical location. Values may be generalized, modified, or absent, and several people can share the same browser-header profile.

The endpoint returns only an explicit diagnostic allowlist. Sensitive authentication and routing headers are excluded rather than displayed or forwarded back to the page.

Privacy note

The endpoint returns only a safe allowlist and sets the response to no-store. Cookies, authorization values, forwarding headers, and infrastructure-specific headers are not echoed.

Frequently Asked Questions

Which HTTP request headers does this check show?

It shows a safe allowlist used for browser diagnostics: User-Agent, Accept, Accept-Language, Accept-Encoding, DNT, Priority, Upgrade-Insecure-Requests, Sec-Fetch metadata, and available Sec-CH-UA client hints.

Why are some client hints missing?

Client hints depend on browser support, request context, and server opt-in. A missing Sec-CH-UA field usually means it was not sent on this request; it does not by itself indicate a browser problem.

Does the result expose cookies or authorization headers?

No. Cookies, authorization values, forwarding headers, and infrastructure-specific headers are excluded from the response even when they exist on the request.