中文 · EN
privacybasics

What Your Browser Says With Every Request: HTTP Header Leaks

Beyond your IP, every HTTP request carries a built-in self-introduction — language, encodings, and more — and together the headers form a profile: what they reveal and how to minimize the exposure.

When people think of privacy leaks, cookies and IP addresses come first. But there's a self-identification happening every moment of every session: HTTP request headers. Each request carries a dozen-plus header fields that, pieced together, form a remarkably complete profile.

What Common Headers Reveal

Open the Network panel in DevTools on any request and watch these high-signal headers:

User-Agent — the browser and operating system declaring themselves: Chrome/130.0.0.0 Windows NT 10.0 states the engine, the version, and the OS in one string. It's also a foundational fingerprinting dimension (see Browser Fingerprinting Explained).

Accept-Language — your language preference list: zh-CN,zh;q=0.9,en;q=0.8. It reveals more than that you read Chinese; the specific combination and priority ordering of languages is itself a highly discriminating signal.

Accept-Encoding — the compression algorithms you support: gzip, deflate, br. The combination varies subtly between browser versions and can supplement a fingerprint.

Sec-CH-UA family — the newer Client Hints headers: browser brand, platform, mobile or not. A structured format introduced by Chrome, and more honest than the UA (the UA can be edited; these headers come from the browser's core).

Referer — the page you clicked through from. When a request goes to a third-party service, this header hands your browsing path straight to them.

Add the TLS-layer JA3/JA4 fingerprint (the handshake exposes your TLS implementation), and without a single cookie the server can already assemble: this visitor runs Windows + Chrome 130, on a Chinese-language system, knows a little English, and arrived from a specific page.

What Servers See That You Don't

Beyond the headers, the TCP/IP stack throws in extras:

  • TCP window size and options: expose the operating system family (the defaults differ across Linux/Windows/macOS)
  • The initial IP TTL: another source of OS fingerprinting
  • TLS extension order: each browser engine orders its extension list differently — JA4 is computed from exactly this

JavaScript can't touch these layers and browser settings can't turn them off — one level deeper than the headers, and the reason "changing your UA doesn't help": declared strings can be edited, stack behavior can't.

Minimization: What You Can Actually Do

Trim the language list: keep only the languages you truly need in browser settings. A lone zh-CN puts you in a vastly larger crowd than zh-CN,en-US,en,ja.

Referer policy: modern browsers by default send only the origin cross-site (strict-origin-when-cross-origin); as a further step, an extension can force no-referrer everywhere.

Stay mainstream: the disguise value of your UA and Client Hints comes from rarity — the default config of the latest Chrome is the biggest crowd, and a niche browser makes you more conspicuous, not less.

Accept the stack's reality: TCP/TLS-layer leaks can't be fixed at the browser level. If you genuinely need to resist this, the direction is fingerprint browsers or dedicated network-stack spoofing — beyond what an ordinary user needs to bother with.

Verify the result: after changing your config, run the IPchase fingerprint test and watch the language list, UA, and consistency score change.

Why Sites Collect This

None of this is inherently sinister: Accept-Language switches the interface language, Accept-Encoding picks the compression, the UA drives feature fallback — all legitimate. What turns sour is taking statistical signals that were meant to be anonymous and feeding them into cross-site tracking and profiling.

That's why privacy legislation worldwide (GDPR, China's PIPL) keeps a close eye on header data: the combination of IP + request headers + fingerprint is enough to constitute "personally identifiable information," and sites need a lawful basis to process it.

Summary

  • Every HTTP request self-identifies a dozen times over: language, UA, referring page and more
  • TCP/TLS stack traits (window size, JA3/JA4) run deeper than headers and can't be switched off in the browser
  • What an ordinary user can do: trim the language list, tighten Referer, stay mainstream
  • To see exactly how exposed you are, one run of the fingerprint test says it all

Check your own network: run a full disguise check on the homepage, or try the fingerprint test.

Keep reading

Three Right Ways to Batch-Look Up IP Geolocation

Server inventories, proxy pool audits, log analysis — the scenarios, methods, and result-reading techniques for resolving the ownership of dozens or hundreds of IPs at once.

Subnetting and CIDR Notation: A Practical Working Guide

From /24 to /30 — how to read, calculate, and carve up CIDR notation, with a manual verification method so subnetting stops being rote memorization at work.

Where Cross-Border Latency Comes From: Submarine Cables, Detours, and Congestion

Why does Singapore to the US start at 160ms physically? Breaking down the four sources of cross-border network latency — the speed of light and cable paths, routing detours, congestion queuing, device forwarding — plus how to use ping to pinpoint which segment is at fault.