Overview

User-Agent tells the server the type and version of the client software (browser, bot, library) that sent the request. Servers use it to tailor content, gather analytics, block clients, or apply compatibility workarounds.

Details

The format is a list of product tokens (product/version) plus parenthesized comments. Modern browser UA strings are long and full of legacy cruft. Almost every browser begins with `Mozilla/5.0`, a fossil of 1990s Netscape-era content negotiation that stuck.

Servers branch mobile vs desktop layouts on the UA (User-Agent sniffing) or identify bots to control crawling. But the UA is freely changeable and untrustworthy; feature detection is far more robust than UA sniffing.

For privacy reasons browsers are freezing and shrinking the UA string, moving instead to structured User-Agent Client Hints (the Sec-CH-UA family) that expose only the information a site explicitly requests.

Syntax

User-Agent: <product>/<version> [<comment>] ...

e.g. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0 Safari/537.36

Notes

• The UA is trivially spoofed, so never base security decisions (auth, access control) on it.
• Blanket-blocking empty or unusual UAs can also block legitimate API clients and curl users.
• robots.txt and crawler policies identify bots by UA, but malicious bots impersonate browser UAs, so UA alone is not a reliable defense.

Related headers

Specification