HTTP headers · Request
User-Agent
User-Agent identifies the client software that made the request.
Key facts
| Type | Request |
|---|---|
| Syntax | <code>Product/version (comment)</code> |
| Examples | Browser, bot, library, CLI |
| Reliability | Self-declared and spoofable |
| Uses | Analytics, compatibility, crawler rules |
| Client Hints | UA-CH supplements it in Chromium |
| Standard | RFC 9110 §10.1.5 |
A self-declared string
The header is a sequence of product tokens and comments. Browsers historically stuffed it with compatibility markers, which made parsing fragile and fingerprinting easy. Chromium now freezes parts of the string and offers Client Hints for structured data such as platform and model.
Anyone can send any value. Treat User-Agent as a hint for analytics or compatibility, never as proof of identity or as an access-control mechanism. A crawler that claims to be Googlebot is not Googlebot until its IP is verified.
Bots and server behaviour
Servers use the string to distinguish crawlers, feed readers and API clients. robots.txt rules are matched against the token, and the same token appears in crawler logs. Because it is easy to spoof, a blocklist based only on User-Agent stops naive scrapers and nothing else.
For your own clients, send a clear product token and a contact URL. That identifies you honestly and lets site owners contact you instead of blocking you.
Frequently asked questions
Can I rely on User-Agent for feature detection?
Only as a last resort. Feature detection in code is more reliable; UA strings are frozen, reduced or spoofed.
Does Googlebot verify its User-Agent?
Google publishes IP ranges; site owners should reverse-DNS or check those ranges rather than trusting the string.