HTTP Header Detection: Reading the Server and X-Powered-By Lines

## Why it matters

The HTML your browser downloads tells you almost nothing about what's running on the server. A page can run on Express, nginx, Apache, PHP 8.2, or Java and the markup will never mention it. Headers are where server-side stacks announce themselves: the Server header names the web server; X-Powered-By names the framework or language; Via tracks proxies along the way.

Making the fetch explicit and user-triggered is a deliberate privacy choice. It's the extension's only request to a page origin, it goes to the same site you're already on, and it happens on your click, not automatically.

## How it works

When you click "Check HTTP headers" in Scalpel Stack, it fetches the current page's own URL exactly once. The request omits credentials and discards the response body, keeping the lookup cheap and private. The response headers are read and compared against the fingerprint database: Server, X-Powered-By, X-Generator, and Via frequently reveal backend technologies.

Headers are authoritative but only visible after an explicit fetch. A content script cannot read response headers from a page load the browser already made, which is why header detection requires a second, separate request initiated by the user.

## What does not matter

A header can be removed or spoofed by the administrator, so its absence proves nothing and its presence can be misleading. Some sites strip all server headers for security; others emit a false header to misdirect fingerprinters. A missing header doesn't mean the technology isn't there, just that it's not advertising itself via this channel.

A CDN in front of the origin can rewrite or replace headers entirely, sometimes masking the real server behind it. A Server: Cloudflare header does not mean the origin is Cloudflare. It means Cloudflare is the visible layer.

## Code example

Here is what a typical header-detection response looks like:

HTTP/1.1 200 OK
Server: nginx/1.25.3
X-Powered-By: Express
X-Generator: WordPress 6.4.2
Via: 1.1 varnish
Copy

A parser matching these against the fingerprint database would flag:

• nginx from the Server header
• Express from X-Powered-By
• WordPress and version 6.4.2 from X-Generator
• Varnish cache layer from Via

## How Scalpel Stack shows it

After you click "Check HTTP headers", a small chip appears next to the technology count reading "headers included". Any evidence that came from a response header carries the headers vector badge. Expanding a tech row shows the exact header line that matched, so you can verify it in your own DevTools.

The fetch runs once per click and is cached for the session, so a second click on the same site does not make another request.