Syllabus Lesson 1 of 156 · What a website knows the moment you arrive
What a website knows the moment you arrive

What your browser hands over

Why it matters Before you click anything, type anything or accept anything, a website already knows a surprising amount about your device. Knowing what it sees is the first step to deciding what you are happy to share.

Think of visiting a website like walking into a shop. Before you say a word, the shopkeeper can see your coat, hear your accent and notice which door you came in by. You did not hand over your name, but you did not arrive as a blank either.

Two ways a website learns about you

A website is really two things working together. The server is a computer somewhere else that sends you the page. The page is what arrives in your browser, and it often carries small programs that run on your device.

Request: the message your browser sends to a server to ask for a page, a picture or any other file. Loading one web page usually sends dozens of requests.

Header: a labelled line of extra information attached to every request, like the details written on the outside of an envelope. For example Accept-Language: en-GB says which languages you prefer.

Script: a small program that a page brings along and your browser runs. On the web these are written in a language called JavaScript.

What the server sees with every request

  • Your IP address: the network address your request came from (the next lesson explains it).
  • User-Agent: a header naming your browser, its version and your operating system, for example "Firefox on Windows".
  • Accept-Language: the languages you prefer, in order.
  • Referer: often, the page you came from (a later lesson in this module covers it).
  • Cookies: any small notes the site stored on your device earlier (the next module is all about them).

Chromium-based browsers (such as Chrome and Edge) also send short headers that start with Sec-CH-UA, called client hints. They name the browser brand and platform, and a site can ask for more detail if it wants it (checked October 2026).

What the page's own script can read

Once the page arrives, its scripts can ask your browser questions directly, with no request needed. Here is a sample of what a script might read on a typical laptop:

Question the script asksExample answer
Which browser and system?Firefox, macOS
Which languages?en-GB, en
How big is the screen?1440 by 900
What time zone?Europe/London
How many processor cores?8
Is it a touch screen?No

None of these is a secret on its own, and each one has an honest use. The time zone lets a calendar show the right hour; the screen size lets a page lay itself out neatly. The privacy question is what happens when someone collects all of them and keeps them. That is the subject of the fingerprinting module later in this leg.

A common misconception

Many people believe that "if I have not logged in, the site knows nothing about me". As you can see, a site knows plenty about your device without a login. What it usually does not know is your name. The rest of this leg shows how trackers try to close that gap, and how you can stop them.

Try it

Open your browser's developer tools (DevTools): press F12, or Ctrl+Shift+I on Windows and Linux, or Cmd+Option+I on a Mac. In Safari, first switch on "Show features for web developers" in Settings, Advanced. DevTools is a built-in panel that shows what a page is doing. Looking is always safe: nothing you see there is sent anywhere.

  1. Open any page, for example the home page of a site you trust, then open DevTools.
  2. Click the Console tab. This is where you can ask the browser questions yourself.
  3. Type navigator.language and press Enter. You will see your preferred language.
  4. Type screen.width and press Enter, then Intl.DateTimeFormat().resolvedOptions().timeZone. Every page you visit can read these same answers.
  5. Now click the Network tab and reload the page. Click the first row, then look for Request Headers. You will see your User-Agent and Accept-Language, exactly as the server received them.

If a browser warns you about pasting code into the Console, that is a good warning: only type short questions like these, never code someone else asks you to paste.

Recap

  • The server sees your IP address and request headers such as User-Agent and Accept-Language.
  • The page's scripts can also read things like screen size, time zone and language directly.
  • Each detail is ordinary on its own; the privacy risk comes from collecting and keeping them together.
  • Not logging in hides your name, not your device.

Spotted a problem in this lesson? Report it

Code · runs in your browser
Output

        

      

      
      

        Syllabus