HTTP Headers Checker

What this page shows

Every time your browser loads something it sends request headers: its name and version, the languages and formats it accepts, and a few privacy and security hints. This page lists the headers our server received from your browser for one request, with a short note on what each common one means. Your user agent is at the top, ready to copy.

We leave out your cookies, any authorization header, anything named like a token or key, and the headers our CDN and hosting provider add to every request, because those describe our infrastructure rather than your client. Our CDN can also rewrite a few values on the way, such as Accept-Encoding, so they may differ slightly from what your client sent.

You can call it from a script or the command line too: curl https://www.buyproxy.org/api/tools/http-headers returns the same list as JSON, and adding your proxy to that command shows what arrives through it. Each visitor can make 20 requests a minute. Nothing is stored.

Headers that can reveal a proxy

Some proxies announce themselves. Via is added by many proxies and caches to say the request passed through them. X-Forwarded-For and Forwarded carry the address of the client that connected to the proxy, often your own IP, and X-Real-IP does the same on some servers. Others, such as X-Client-IP or Proxy-Connection, are less common but just as telling. If any of these reach us, the page flags them.

One limit: our hosting provider replaces X-Forwarded-For, X-Real-IP and Forwarded on every request, so this page can't see what your client or proxy put in those three. To check them, send a request through the proxy to a server you control and log the raw headers.

Over HTTPS, a proxy that tunnels the connection (HTTP CONNECT or SOCKS5) can't read or add headers, because they're encrypted between your client and the website. Header leaks come from plain HTTP requests and from proxies that decrypt traffic.

The headers you'll usually see

User-Agent names your browser and operating system. Accept-Language lists your preferred languages and is what most sites use to choose a page language, so when you browse through a proxy it should fit the proxy's country. The Sec-CH-UA headers (client hints) are a newer, structured version of the user agent that Chromium browsers send. The Sec-Fetch headers describe how the request was made, and Sec-GPC and DNT carry privacy preferences.

• Browser fingerprint test
• User-Agent generator
• IP address lookup

Questions