HTTP Request Headers Viewer

How to use the HTTP Request Headers Viewer

Open the page: the headers your browser sent appear in the table within a moment, with the method, HTTP version and HTTPS status above it.

Read the label under each header name to see whether it came from your browser, was added by the CDN or a proxy, or by something else such as an extension.

Use the Show menu to list only one kind of header, and press Refresh after changing a browser setting.

Press Copy as text or Download JSON to save the list, or Open raw JSON to see the headers of a full page load.

See your HTTP request headers

Every time your browser asks a server for something, it sends HTTP request headers: lines such as User-Agent, Accept-Language and Sec-Fetch-Site that describe the browser, what it accepts and why it is making the request. This viewer lists the HTTP request headers our server actually received from you, in the order it received them, with the request method, the HTTP version and whether HTTPS was used. Each header is labelled with who most likely added it, and common ones get a one-line explanation.

Example

The background request from a recent Chromium-based browser on Windows looks roughly like this. Values differ between browsers and versions.

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Accept: application/json
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://formatterhq.com/http-request-headers
X-Forwarded-For: 203.0.113.7
X-Forwarded-Proto: https

Browser headers and headers added by the CDN

Our site is delivered through a content delivery network (CDN). Your browser connects to the CDN, which opens its own connection to our server and passes your request on. The list therefore mixes headers from different sources, and the tool labels them:

Browser: User-Agent, Accept, Accept-Language, Accept-Encoding, Referer, Origin, Cookie, the Sec-Fetch-* metadata and the Sec-CH-UA client hints. A CDN may normalise a few of them, such as Accept-Encoding.
CDN / proxy: X-Forwarded-For (your address, followed by any proxies), X-Forwarded-Proto, X-Real-IP, Via, Forwarded and request IDs. They are added on the way, and they are how our server learns your real address. Company proxies and some security products add their own.
Last hop: Connection, Keep-Alive and TE describe a single connection, so the values you see were set by the CDN, not your browser.
App / extension / proxy: everything else, for example a header added by a browser extension, an app or software on your network.

The HTTP version shown is the one used between the CDN and our server; your browser may be using HTTP/2 or HTTP/3 to reach the CDN at the same time. HTTP/2 pseudo-headers such as :method and :path are not listed as headers; the method appears at the top instead.

Background request or page load

The table is filled by a request the page makes after it loads, because the page itself is cached and cannot contain your headers. That background request sends Sec-Fetch-Mode: cors, Sec-Fetch-Dest: empty and Accept: application/json. A normal page load sends navigate, document, a longer Accept list for HTML and Upgrade-Insecure-Requests: 1. Click Open raw JSON to load the same address as a page in a new tab and see those values.

Cookies and credentials stay hidden

The request carries the cookies your browser keeps for this site, just like a normal page request. The tool tells you how many were sent and their names, never their values. An Authorization header shows only its scheme, such as Bearer or Basic, and headers whose names contain token, secret, session, signature, password or API key are listed with the value hidden. The list is built for your request only, it is not saved, and the response is marked so that no cache keeps it.

What you can use it for

Check which languages your browser really asks for when a site shows the wrong one.
Confirm the user agent and client hints after changing a setting or using device emulation; the User Agent Parser decodes the string.
See whether Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1) is switched on.
Spot headers injected by an extension, antivirus software or a company proxy.
Understand how X-Forwarded-For carries your address through the CDN, the same address shown on What Is My IP Address.

Debugging the server's answer rather than the request? The HTTP status codes reference explains what each response code means.

Frequently asked questions

What are HTTP request headers?

They are name and value lines a client sends with every HTTP request, before any body. They tell the server which host is wanted, what the client is, which formats, languages and compression it accepts, and carry cookies and credentials.

Why don't I see Sec-CH-UA headers?

Only Chromium-based browsers send user agent client hints, and only over HTTPS. Firefox and Safari do not send them. By default you get the brand, mobile and platform hints; detailed hints such as the full version are sent only when a site asks for them.

Why is the Cookie value hidden?

Cookie values can include sign-in sessions, so the server never echoes them back, not even to you. You see how many cookies were sent and their names, which is enough to check whether a cookie reaches the server.

Why does the protocol say HTTP/1.1 when my browser uses HTTP/2?

The version shown is the one between the CDN and our server. Your browser talks to the CDN, which may use HTTP/2 or HTTP/3 on its side and a different version for the connection to our server.

Why does X-Forwarded-For contain more than one address?

Each proxy that passes the request on adds the address it received the request from. The first entry is normally the original client and the following ones are proxies, but only entries added by proxies you trust are reliable, because a client can send its own X-Forwarded-For header.

Do other websites receive the same headers?

Yes. Your browser sends the same kind of headers to every site you visit, with cookies only for the site they belong to. Values such as Sec-Fetch-Site and Referer change with the page that made the request.