Why do my headers look different in curl than in a browser?

curl sends a minimal set, typically Host, User-Agent, and Accept with a wildcard. Browsers add content negotiation, fetch metadata, client hints, and referrer information. That difference is exactly how our homepage decides to return plain text to curl and HTML to a browser.

Can a website see my HTTP headers?

Yes. Every header on this page went to the server as part of the request. Headers are not encrypted separately from the body, but under HTTPS the whole request including headers is encrypted in transit, so only the destination server and any proxy you trust it through can read them.

What is the difference between Referer and Origin?

Referer is the full URL of the source page, trimmed by the browser's referrer policy. Origin is only the scheme, host, and port, and is sent on cross-origin requests and all POSTs. Origin exists for CORS decisions, where the path is irrelevant.

Are X-Forwarded-For headers reliable?

Only the portion your own trusted proxy appended. A client can send an arbitrary X-Forwarded-For value, so a server that reads the first entry blindly can be lied to. Read it right to left, trusting only the hops you control.

Why is Referer spelled wrong?

A typo in RFC 1945 in 1996 that was never corrected, because fixing it would have broken every implementation. The Referrer-Policy header, added much later, uses the correct spelling.

What HTTP Headers Does My Browser Send?

See the exact HTTP request headers your browser just sent, each with a one-line explanation; Cookie and Authorization are redacted.

Headers your browser sent (5)

The list your browser attached to this request, in alphabetical order and exactly as received.

Header	Value	What it does
accept	/	The content types your browser can display, with quality values. Our homepage reads it to decide between HTML and plain text.
accept-encoding	gzip, br	The compression formats your browser can decode, usually gzip, br and zstd.
connection	Keep-Alive	Whether the TCP connection stays open for more requests. HTTP/2 and HTTP/3 do not use it.
host	whatsmyip.fyi	The site name you asked for. One server can answer for many sites, so this picks the right one.
user-agent	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)	Free text in which your browser names itself, its engine and your operating system. Any client can claim anything here.

What carried them

How the request travelled.

Method

GET

Protocol

HTTP/2

TLS

TLSv1.3

Headers our edge added (6)

Your browser did not send these. The proxy in front of this site inserted them, which is why they carry the address and country the edge resolved. An origin server should trust them only from a proxy it controls.

Header	Value	What it does
cf-connecting-ip	216.73.216.7	Added by our edge. It carries the real client address that opened the connection.
cf-ipcountry	US	The country our edge associates with your address, resolved from the routing table.
cf-ray	a367afc5c8dd5cd4	An identifier for this request inside our edge network, useful when reporting a problem.
cf-visitor	{"scheme":"https"}	The scheme the browser used to reach the edge, as JSON.
x-forwarded-proto	https	Added by a proxy in front of the origin. Values a client supplies are not trustworthy.
x-real-ip	216.73.216.7	A proxy convention carrying the client address as a single value.

Same data as JSONRedaction is applied before rendering and before the JSON is built.

Getting the same data from a script

The API endpoint /api/v1/headers returns the same set as JSON, with the same redaction applied:

curl -s https://whatsmyip.fyi/api/v1/headers | jq .

That is useful for checking what a corporate proxy, a mobile carrier’s transparent proxy, or your own reverse proxy inserts or rewrites on the way out.

Headers you will not see here

The request line, HTTP/2 and HTTP/3 pseudo-headers, and TLS handshake details are not headers in the classic sense and are shown on the home page report. Response headers, the ones the server sends back, are also not on this page; your browser’s network panel shows those.

About this tool

This page echoes back the HTTP request headers your browser sent to load it, in the order received, with a plain explanation of each one. Cookie and Authorization values are redacted before anything is rendered, because they carry session tokens. Use it to check what a proxy or CDN adds, to debug Accept-Language and content negotiation, or to see which client hints your browser exposes.

How to read the result

Host: The hostname from the request line, and the way one server with many sites picks which site to serve. Under TLS it should match the SNI value from the handshake.
User-Agent: Your browser introducing itself in free-form text that names the browser, engine, and OS. It is not authenticated, and Chromium freezes parts of it and moves the real detail into the Sec-CH-UA headers.
Accept, Accept-Encoding, Accept-Language: Content negotiation: Accept lists the MIME types the client can read with quality values, Accept-Encoding lists the compression it can decode, and Accept-Language drives locale selection. Our homepage reads Accept to decide between HTML and plain text.
Referer: The URL of the page that linked here. Modern browsers default to the strict-origin-when-cross-origin policy, so a cross-site request sends only the origin and not the full path.
Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest: Fetch metadata that the browser sets on its own, stating the relationship between the requesting page and the target, the request mode, and the destination type. Servers use them to reject cross-site requests that should not exist.
CF-Connecting-IP and X-Forwarded-For: Added by the proxy in front of the origin: CF-Connecting-IP carries the true client address at the Cloudflare edge, while X-Forwarded-For accumulates a comma-separated chain of proxies. A client can send any X-Forwarded-For value it likes, so trust only the part your own proxy appended.
Cookie and Authorization (redacted): We do not render these values. They carry session tokens, which are close to a password, and printing one on a page that can be screenshotted or shared is a credential leak.

Questions people ask

Why do my headers look different in curl than in a browser?: curl sends a minimal set, typically Host, User-Agent, and Accept with a wildcard. Browsers add content negotiation, fetch metadata, client hints, and referrer information. That difference is exactly how our homepage decides to return plain text to curl and HTML to a browser.
Can a website see my HTTP headers?: Yes. Every header on this page went to the server as part of the request. Headers are not encrypted separately from the body, but under HTTPS the whole request including headers is encrypted in transit, so only the destination server and any proxy you trust it through can read them.
What is the difference between Referer and Origin?: Referer is the full URL of the source page, trimmed by the browser's referrer policy. Origin is only the scheme, host, and port, and is sent on cross-origin requests and all POSTs. Origin exists for CORS decisions, where the path is irrelevant.
Are X-Forwarded-For headers reliable?: Only the portion your own trusted proxy appended. A client can send an arbitrary X-Forwarded-For value, so a server that reads the first entry blindly can be lied to. Read it right to left, trusting only the hops you control.
Why is Referer spelled wrong?: A typo in RFC 1945 in 1996 that was never corrected, because fixing it would have broken every implementation. The Referrer-Policy header, added much later, uses the correct spelling.

Last reviewed 2026-09-05.