HTTP header
The name-and-value lines sent with every web request and response, where a client describes itself and where proxies leave or remove their traces.
An HTTP request is mostly introduction. Before any content moves, the client sends a block of headers, plain name-and-value lines, declaring who it is, what it will accept, where it came from and how it would like the answer packaged. The server replies with its own block. Everything the two sides negotiate, they negotiate here, one line per fact.
A handful of them do nearly all the work that matters in proxy contexts. Host names which site you want, which is how one address serves thousands of domains. The user agent line states what software is asking. Accept-Language declares which languages you prefer. Referer says which page you clicked through from. The Cookie line carries whatever state was stored on earlier visits. And the forwarding family, X-Forwarded-For and Via, is where an intermediary can record its own involvement, the mechanics the anonymity grades are measured on.
Two of those deserve a proxy user's particular attention because they contradict geography so cheaply. Accept-Language is sent with every request, and a browser announcing en-US on every page while exiting through a Madrid address is a mismatch served to the site in the first packet of headers, no fingerprinting required. The same goes for a Referer chain that shows you arriving from a language edition your claimed country would not see. The address tells one story; the headers volunteer another.
Order tells a third. The specification treats headers as an unordered set, but real software emits them in a fixed habitual sequence, and the habits differ: a browser produces one ordering, each HTTP library another. Defences compare the claimed identity against the observed sequence, which costs nothing and catches copied header VALUES pasted into a client that emits them in its own order. HTTP/2 complicates the picture, lowercasing names and compressing the block, and adds its own negotiation details that fingerprint just as well.
Headers are also where cost hides. Accept-Encoding is the line that requests compression, and forgetting it on a per-gigabyte plan means paying full price for text that would have shrunk severalfold. Each request repeats the whole block, which on high-volume work adds up to real traffic. Small lines, but they are sent millions of times.
Frequently asked questions
Which HTTP headers matter most when using a proxy?
Outbound: the user agent line, Accept-Language and Cookie, because they must agree with the identity and location your exit claims. Inbound to the site: X-Forwarded-For and Via, because whether your proxy adds them is exactly what separates transparent, anonymous and elite grades. Reading back what actually arrived, via any echo endpoint, settles both in one request.
Can headers reveal I am using a proxy even if my IP is clean?
Yes, two ways. A proxy that adds forwarding headers announces itself regardless of the address quality. And your own headers can contradict the exit: a language preference, a referer chain or a time-zone-dependent value inconsistent with the claimed country reads as a visitor wearing someone else's address, which is precisely what it is.
Does header order really get checked?
By serious defences, routinely. Software emits headers in a characteristic sequence, browsers one way, each library its own way, and comparing the sequence against the claimed user agent is a free consistency test. Copying a browser's header values into a script without reproducing the browser's ordering fails it, which is one reason value-perfect requests still get classified as automation.
Do headers cost bandwidth?
They are resent on every request, so at volume they are a real line item, and the bigger effect is what one of them controls: Accept-Encoding negotiates compression, and omitting it means receiving pages uncompressed at several times the size. On per-gigabyte residential billing, that one missing line is among the most expensive defaults in scraping.
Back to the full glossary.