HTTP headers

How this check works

When your browser requested this page, it sent a block of headers ahead of anything else. Our server captured every one of them, lowercased the names, sorted them alphabetically and printed them in the table above, along with the request method and the HTTP protocol version the connection used. Nothing is filtered out, and nothing is added by us; the table is the request as it reached us.

Headers with a known meaning carry a note in the third column. Headers that indicate a proxy or a tool are marked, and the summary above the table lists them separately, because they are the ones that matter for anyone checking a proxy setup. The same data is available as JSON, so a script or a command-line client can see what it is sending in a form that is easy to diff.

The page is deliberately plain. Headers are the one part of a request that cannot be hidden from the server, so the list is also the passive part of your browser's fingerprint: the information a site collects from every visit without running a line of script. The browser fingerprint test hashes that passive set and shows it next to the script-collected signals.

How to read your result

Group the rows by what they do.

The proxy rows are the ones to act on. A browser never sends them. If any appear, something between your browser and our server inserted them. X-Forwarded-For, Forwarded, X-Real-IP and Client-IP commonly contain the address of the client the proxy is forwarding for, which is to say your real address; compare the value with the IP shown on the proxy checker and, if they differ, your real address is being handed to every site you visit. Via and X-Proxy-ID do not carry your address but announce that a proxy exists, which strict sites treat as a signal. The anonymity score deducts 10 points when any of these is present.

Referer and origin tell a site where you came from. On a fresh visit typed into the address bar there is no referer; following a link from another site sends that site's address, trimmed according to the referring site's policy. Sec-Fetch-Site says whether the request was same-origin, same-site, cross-site or user-initiated, which sites use to detect embedding and cross-site requests.

Accept-Language is more revealing than it looks. It lists the languages you configured in preference order, with regional variants. A list that starts with a language unusual for the IP's country is a soft mismatch; English first is accepted everywhere. The value is also a fingerprinting input, since the exact list and order vary between people.

Client hints appear only in Chromium browsers. The low-entropy ones, brands, mobile flag and platform, are sent with every request. Higher-entropy ones such as the full version list, architecture, bitness and model are sent only if a site has asked for them in a previous response, so what you see here is the default set.

Do Not Track and Global Privacy Control are honored by few sites, and because few people enable them, their presence makes a browser slightly more distinctive. That is not an argument against them, just a fact to know when reading a fingerprint.

How to fix it

Proxy headers present

1. Identify the source. If you set a proxy in the browser or system, it is that proxy. If you set nothing and see Via or X-Forwarded-For, your ISP or network runs a transparent proxy or cache, common on mobile carriers and in offices.
2. For a proxy you control, switch it to a mode that adds no headers, often called elite or high-anonymity. For a commercial proxy, ask the provider for an elite port or a different pool; the behavior is per proxy, not per browser.
3. For a transparent ISP proxy, a VPN is the way around it: the tunnel carries your requests past the proxy, which only sees encrypted traffic.
4. Reload this page. The proxy summary should say none, and the proxy row in the anonymity score should pass.

Headers that contradict the rest of the setup

1. A user agent that names one platform while sec-ch-ua-platform names another means an extension or profile is rewriting one of them. Remove the override or use a profile that sets both together.
2. An Accept-Language that does not fit the IP's country is fixed in the browser's language settings: Chrome and Edge under Settings, then Languages; Firefox under Settings, then General, then Language; Safari follows the system language list in System Settings.

Referer exposure

1. To stop sending the page you came from to other sites, set the browser's referrer policy to strict-origin-when-cross-origin, which current browsers use by default, or to no-referrer through an extension or Firefox's network.http.referer settings in about:config. Site owners can set a Referrer-Policy header for their own outgoing links.

For developers and scripts

1. Request the JSON version of this page from your tool to see exactly which headers it sends. A script that claims a browser user agent but sends no Accept-Language, no Sec-Fetch headers and no client hints is easy for a site to tell apart from a browser.
2. Add headers explicitly with your client's options, for example the -H flag in curl, and compare the JSON output before and after.

Limits of this check

• We see only what reaches our server. A CDN or edge network in front of a site can strip, rewrite or add headers before the site sees them. What you see here is the view from an origin server without such a layer, which is the most complete view but not necessarily the one a given site gets.
• Request headers only. Response headers, which come back from the server, are not part of the request and are not shown; your browser's developer tools show both.
• Cookies are site-scoped. Only cookies set by this site appear, and on a first visit there are none. The row cannot tell you what cookies other sites hold.
• Header order is lost. We sort alphabetically for readability. Some fingerprinting systems use the original order of headers as a signal, which differs between browsers; that order is not reproduced here.
• Encrypted transport hides headers from the network, not from the server. HTTPS prevents anyone on the path from reading these headers; it does not prevent the site you are visiting from reading them, which is the point of this page.
• Proxy detection is header based. A proxy that adds no headers is invisible to this check; the network type of its address is covered by the proxy checker and the IP checker.

What a transparent proxy header leak looks like

A transparent proxy sits between you and the internet and forwards your requests under its own address, then writes your original address into X-Forwarded-For or Forwarded so the destination can still log who asked. The destination sees two addresses: the proxy's, as the connection source, and yours, in the header. For caching proxies at an ISP this is harmless bookkeeping. For a proxy you bought to change your apparent location it defeats the purpose entirely, since the first thing a careful site reads is that header. The proxy headers glossary entry lists each header, who adds it and what value it carries.

Why the header list differs between browsers

Each browser engine has its own defaults: which Accept types it lists, whether it sends client hints, which Sec-Fetch headers it includes, how it formats Accept-Language, whether it sends a priority header on HTTP/2 or HTTP/3. Versions change these over time. The differences are large enough that a server can usually name the browser family from the header set alone, even with the user agent removed. That is why rewriting the user agent is not enough to look like another browser, and why the passive fingerprint on the browser fingerprint page is hashed separately from the script-collected one.

Reading headers from a script or the command line

If you maintain a scraper, a monitoring tool or an integration, the JSON output of this page is the quickest way to see what you are sending. Point the tool at this page with an Accept header of application/json and compare the result with what a browser sends: a browser sends a dozen headers in a recognizable pattern, and a bare client sends two or three. Sites that gate access on looking like a browser check exactly that difference. Honest tools do better to identify themselves plainly and respect rate limits than to imitate a browser incompletely.