User-Agent
request headerrouting & context
Identifies the client software making the request — browser, bot, library or command-line tool.
Every browser sends a User-Agent string, and for historical reasons nearly all of them start with Mozilla/5.0. Browsers are now freezing and reducing these strings for privacy, moving detail into User-Agent Client Hints (Sec-CH-UA-*). For bots and scripts, a descriptive User-Agent with contact details is good manners.
Syntax
User-Agent: <product>/<version> [<comment>]
Defined in RFC 9110 §10.1.5 — User-Agent.
Examples
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/141.0.0.0 Safari/537.36
Chrome on Windows
User-Agent: my-sync-bot/1.2 (+https://example.com/bot)
a well-behaved custom client
User-Agent: curl/8.5.0
curl's default
Good to know
- Detect features, not browsers — UA sniffing breaks on new versions and spoofed strings.
- Anyone can send any User-Agent. Verify crawlers like Googlebot by reverse DNS, not by the string.
- Some APIs (GitHub's, for one) reject requests without a User-Agent.
Who sets User-Agent
Browsers set User-Agent themselves. HTTP libraries send a default you can override — curl -A "my-bot/1.0 (+https://example.com/bot)" https://example.com/, or a User-Agent entry in your client's headers.
Check it
In the browser, open DevTools → Network, pick a request and look under Request Headers. From the command line, curl's verbose mode prints every header it sends, prefixed with >:
curl -sv https://example.com/ -o /dev/null 2>&1 | grep '^>'
Frequently asked questions
Can JavaScript change the User-Agent?
Barely. The Fetch standard allows it and Firefox honours a User-Agent set in fetch, but Chrome and Safari ignore it. In Node.js and other server-side clients you can set it freely.