The User-Agent is an HTTP request header that tells a server what client is making the request, such as a browser, script, or crawler. It often includes the application name, version, and operating system, but the value is self-reported rather than verified by the network.
That makes User-Agent useful for logging and compatibility, but weak as a trust signal. Attackers can forge it to impersonate legitimate browsers or well-known bots, hide automation, or bypass simple filters that rely on header strings alone. In real attacks, spoofed User-Agent values are often used during recon scans to probe for exposed files, credentials, cloud keys, and other secrets. Defenders should treat the header as advisory, not proof, and validate identity with stronger controls such as source IP allowlists, reverse DNS checks, TLS or bot-provenance signals, rate limiting, and content access controls. Good secret hygiene also reduces impact if a scan reaches sensitive paths.