HTTP request headers
What Your Browser Actually Sent
The exact HTTP headers, IP, and privacy signals your browser sent to /api/headers.php on this visit. Nothing is stored.
HTTP headers
Fetching /api/headers.php...
How to read this dump
Headers are grouped into four buckets so the important ones don't drown in noise: Client hints (Sec-CH-UA-*), Sec-Fetch metadata, Standardheaders, and everything else. If a group is empty on a browser-claiming UA, that's a signal.
Common mismatches
- UA claims Chrome, no Sec-CH-UA headers → almost certainly a spoofed HTTP client.
- UA claims a browser, no Sec-Fetch-* headers → likely curl / requests.
- Accept-Language empty → almost no real browser has an empty Accept-Language.
- Accept-Encoding lacks "br" (Brotli) → Chromium, Firefox, and Safari all send it over HTTPS.
- Connection: close → browsers default to keep-alive; scripts often override.
Related tools
For a header-only bot score (no browser required), hit /api/checkfrom your HTTP client. That's a stripped-down programmatic version of what this page shows.
Frequently asked questions
→Why do I need a server endpoint for this?
Because JavaScript can't see the raw HTTP request its own browser sent. XHR / fetch APIs surface a subset (via Response objects, and only response headers), and there's no equivalent for request-side headers. The only way to see the exact headers is to have the server echo them back, which is what /api/headers.php does.
→Which headers matter most for bot detection?
User-Agent, Accept, Accept-Language, Accept-Encoding, plus the Sec-Fetch-* set (Site, Mode, Dest, User), plus the Sec-CH-UA-* client hint set on Chromium, plus Upgrade-Insecure-Requests on top-level navigations. Missing any of these on a browser-claiming UA is a strong signal.
→What is Sec-Fetch-*?
A set of headers Chromium-family browsers send with every request to describe the request's context: Sec-Fetch-Site (same-origin, same-site, cross-site, none), Sec-Fetch-Mode (navigate, cors, no-cors), Sec-Fetch-Dest (document, image, script, ...), and Sec-Fetch-User (?1 for user-initiated navigations). They exist explicitly to help servers detect bot traffic that fails to replicate them.
→What is DNT vs Sec-GPC?
DNT ('Do Not Track') is a legacy header that never got legal weight and is deprecated. Sec-GPC ('Global Privacy Control') is its successor, sent by privacy-focused browsers (Brave, Firefox Nightly) and treated as a legal signal in some US states. Real users almost never enable either; scrapers who set them deliberately can accidentally stand out.
→How do I reproduce a real browser's header set in Python / curl?
Copy the header list this page shows, verbatim, in the same order. Especially: send the Sec-Fetch-* group and the Sec-CH-UA-* group if you claim Chromium, and use Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8 for top-level navigations.