HTTP Request Headers Viewer
HTTP headers are metadata sent between your browser and web servers with every request and response. Request headers (sent by your browser) tell the server about your capabilities, preferences and identity. Response headers (sent by the server) instruct your browser on how to handle the content.
Common Request Headers
- User-Agent β Browser and OS identification string.
- Accept-Language β Your preferred languages for content, in order of preference (e.g. "en-US,en;q=0.9").
- Accept β MIME types the browser can handle (HTML, JSON, images, etc.).
- Accept-Encoding β Compression formats supported (gzip, br, deflate).
- Referer β The URL of the previous page that linked to the current request.
- Cookie β Session cookies stored for the domain.
- Authorization β Credentials for authenticated requests (never visible in this tool for security).
- Cache-Control β Caching directives for the request.
Security-Relevant Headers
Security headers protect users from attacks. Key response headers include: Content-Security-Policy (prevents XSS), Strict-Transport-Security (enforces HTTPS), X-Frame-Options (prevents clickjacking), and X-Content-Type-Options (prevents MIME sniffing).
Browser Limitations
JavaScript running in a browser page cannot read the full set of request headers it sends, due to security restrictions. A complete header dump requires a server-side echo endpoint. Tools like curl or browser DevTools Network tab show the complete picture.