HTTP Headers Echo
See every header your browser sends before a site runs a single line of JavaScript.
Where this comes from
The request that fetched the page is reflected back from the edge, header by header. These are what every site receives before any of its JavaScript runs, which is the point worth making: fingerprinting is usually described as something scripts do, and a substantial part of it arrives before a script has executed. Most values are unremarkable alone and the combination is not — language preferences, accepted encodings and client hints together narrow a visitor considerably. Two are worth reading directly. Accept-Language comes from your operating system rather than your connection, so it survives a VPN untouched. Sec-GPC is the one privacy signal with legal force behind it.
What the results mean
- Accept-Language
- Your language preferences in order. From the operating system, so a VPN does not change it.
- Sec-CH-UA
- Client hints, replacing the user agent string. Detailed ones must be requested, which is the design.
- Sec-Fetch-Site
- Whether the request came from the same site, another, or was typed. Lets a server reject what it did not expect.
- Cookie and Authorization
- Not reflected. The allowlist exists because this page invites screenshots.
Common problems and fixes
- Why is my cookie not shown?
- Deliberately. The endpoint reflects an allowlist, and returning credentials on a page designed to be screenshotted and shared would be a bad trade for a small amount of completeness.
- The headers differ from my developer tools
- Different navigation types send different headers. A reload, a followed link and a typed address each produce a slightly different set.
- Some headers I did not send are listed
- Those are added by the edge — CF-Ray and CF-IPCountry among them. They are labelled rather than presented as yours.
Frequently asked questions
What can a site learn before its JavaScript runs?
Rather a lot. Language preferences, accepted encodings, client hints, the page you came from and your IP all arrive with the request itself, which is why blocking scripts reduces tracking without eliminating it.
Does a VPN change my headers?
Barely. It changes the address the request comes from and nothing about the headers, so Accept-Language continues to report the preferences your operating system holds.
What is Sec-GPC?
Global Privacy Control, an opt-out signal recognised under California and several other state privacy laws. Unlike Do Not Track, businesses covered by those laws are required to honour it.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/my-http-headers/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="HTTP Headers Echo" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/my-http-headers/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.