Metadata for web communication
HTTP messages contain a start line, headers, and sometimes a body. Headers are named fields that describe how a request or response should be handled without becoming part of the page content itself.
A browser may send accepted content types, language preferences, cache instructions, user-agent information, and context about how a navigation began. A server sends content type, caching rules, security policies, and other response metadata.
Request headers
Accept tells the server which response formats the client understands. Accept-Language expresses language preferences. User-Agent provides compatibility information about the browser, while client hints can provide selected structured details.
Host identifies the requested site on a server that may handle many domains. Sec-Fetch headers provide context that can help a server distinguish top-level navigation from embedded or cross-site requests.
Response headers
Content-Type tells the browser how to interpret a response. Cache-Control defines whether and how it may be cached. Location supports redirects, and Content-Disposition can suggest whether a resource should display or download.
Security headers can restrict scripts and framing, disable unnecessary browser capabilities, prevent content-type guessing, and limit referrer information. They are defense-in-depth and should complement secure application code.
Cookies and authorization
Cookies are transmitted through HTTP headers, but they are not required for every site. Authentication systems may also use Authorization headers or secure session cookies. These values are sensitive and should never be exposed by a public header viewer.
IPMora does not set cookies. Its viewer displays a fixed allowlist and excludes cookie, authorization, forwarding, and platform-internal fields.
Headers and privacy
Individual headers often support ordinary compatibility. Privacy risk increases when many signals are collected, stored, and combined to recognize a browser over time.
A transparent viewer can help users understand what is present without creating that profile. The IPMora header page is rendered for the current request, uses private no-store caching, and does not save a history.