Skip to content
ScanMyPrivacy
Menu

Privacy and leak tests

Full Privacy ScanDNS Leak TestWebRTC Leak TestBrowser Fingerprint TestAm I Using a VPN?HTTP Headers ViewerUser Agent CheckerOpen Port Checker

Online safety assistant

Website Safety CheckerSuspicious Link CheckerScam and Phishing Message CheckerBrowser Security GuideMobile App Safety CheckPersonal Security Checkup

IP and network lookups

IP LookupMy IP LocationWhat Is My Public IP?What Is My IPv6 Address?Reverse DNS LookupDNS Lookup
Online safety Guides API About

Free HTTP header viewer

HTTP Request Headers Viewer

Every website receives these headers automatically before you click anything. Here is exactly what yours says.

Your request headers

This is the raw request our server received from your browser just now.

What we test, what we do not, and what we store

Full method →

We test

  • The request headers your browser sent to our server for this one request

We do not test

  • Cookies and authorisation headers, which are hidden deliberately
  • What other websites receive: that depends on the site, your settings and extensions

What we store

  • Nothing is written to a log or database
  • Anonymous usage counts only: which tool was completed and a coarse result category, never what you typed, your IP address or your results. Nothing is sent if your browser signals Global Privacy Control or Do Not Track.

Third parties that see data: None beyond our hosting provider, which carries the request and may keep its own connection records.

What are HTTP headers?

When your browser asks for a web page, it sends a request made of a method and address followed by a list of headers: short Name: value lines that describe the request. The server reads them to decide what to send back (which language, which compression, which format) and many sites also log them or use them to recognise visitors.

The headers that reveal the most

HeaderWhat it can reveal
User-AgentBrowser, version, operating system and often device type.
Accept-LanguageYour preferred languages in order, which hints at your country and background.
Sec-CH-UA*Client Hints in Chromium browsers: brand, platform and mobile flag.
RefererThe page you came from. Browsers trim it to the site name by default, but older setups send the full address.
CookieIdentifiers previously set by that site. (Hidden on this page for your safety.)
DNT / Sec-GPCYour tracking preferences. Global Privacy Control is legally recognised in some US states.
X-Forwarded-ForAdded by proxies and CDNs: the chain of addresses a request travelled through.

What headers do not include

Your IP address is not a header. It comes from the network connection itself, which is why the box above lists it separately. The headers you see may include extras added in transit: a CDN or reverse proxy such as Cloudflare adds its own fields (CF-Connecting-IP, X-Forwarded-For) before the request reaches us.

How to read the list

Headers fall into a few families. Content negotiation headers (Accept, Accept-Encoding, Accept-Language) say what formats and languages you can handle. Identity headers (User-Agent and the Sec-CH-UA family) describe your browser. Context headers (Referer, Origin, Sec-Fetch-*) describe where the request came from and why, which servers use to reject suspicious requests. Connection headers (Host, Connection) describe the transport. Only the first two families identify you, and the more detailed they are, the more they help fingerprint you.

The same page loaded over HTTP/2 or HTTP/3 shows lower-case header names and may omit some connection headers, because the newer protocols handle them differently. That is normal.

Privacy tips

  • Use a browser that reduces header detail (Firefox, Safari and Brave trim the user agent and block the most detailed hints).
  • Be careful with extensions that change your user agent: unusual combinations make you easier to fingerprint.
  • Enable Global Privacy Control to send Sec-GPC: 1.
  • If you are building a site, send a strict Referrer-Policy and avoid putting secrets in URLs, because URLs can leak through the Referer header.

To see what scripts can read beyond headers, run the browser fingerprint test.

Last reviewed 2026-10-26. Found a mistake? Report a correction (how we handle them).

Fix it and learn more

How Websites Track You Without CookiesCookies are only one way sites follow you. IP addresses, fingerprints, tracking IDs and logins work too. What they are and how to limit them.What Is Browser Fingerprinting?Browser fingerprinting identifies you without cookies by combining screen size, fonts and graphics. How it works, who uses it and how to reduce it.

Also check your…

User Agent CheckerDecode your user agent and see what your browser tells sites.Browser Fingerprint TestHow unique is your browser? Computed on your device, never uploaded.Am I Using a VPN?Check whether sites see you as a VPN, proxy or data-centre connection.Full Privacy ScanRun every check at once and get a 0–100 privacy score with fixes.

Frequently asked questions

Can websites see my cookies in these headers?

A website sees only the cookies it set itself. We hide the Cookie header on this page so that nothing sensitive is shown on screen, and we do not store it.

Why do I see headers I never set?

Your browser adds most of them automatically. Proxies, VPN clients and CDNs can add more in transit.

Is it safe to share a screenshot of this page?

The headers do not contain passwords or cookies here, but they do show your browser and language details. The IP address mentioned above is also visible, so crop it out before posting.

How do I stop sending the User-Agent header?

You cannot remove it entirely without breaking many sites, but you can reduce its detail with browsers that freeze or simplify it, or use Tor Browser, where every user sends the same one.