| [ Web Proxy ] |
| Viewing: https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Sec-Speculation-Tags | [Back] [Original] |
Get to know MDN better
This feature is not Baseline because it does not work in some of the most widely-used browsers.
Want more browser support for this feature? Tell us why.
Experimental: This is an experimental technology
Check the Browser compatibility table carefully before using this in production.
The HTTP Sec-Speculation-Tags request header contains one or more tag values from the speculation rules that resulted in the speculation. This allows a server to identify which rule(s) caused a speculation and potentially block them.
For example, a CDN may automatically insert speculation rules, but block speculations for resources not cached in the CDN to avoid unintended consequences. The Sec-Speculation-Tags header allows the CDN to differentiate between the rules it has inserted (which should be blocked in this case) and speculation rules added by the site owner (which should not be blocked).
| Header type | Request header |
|---|---|
| Forbidden request header | Yes (Sec- prefix) |
Sec-Speculation-Tags: <tag-list>
<tag-list>A comma-separated list of tags indicating Speculation Rules API rules that may have initiated this request. See Speculation rules JSON representation for the syntax reference.
<script type="speculationrules">
{
"prefetch": [
{
"urls": ["next.html", "next2.html"]
}
]
}
</script>
If a speculation happens due to a speculation rule with no tag, then null is sent in the Sec-Speculation-Tags header.
Sec-Speculation-Tags: null
<script type="speculationrules">
{
"prefetch": [
{
"tag": "my-rule",
"urls": ["next.html", "next2.html"]
}
]
}
</script>
If a speculation happens due to a speculation rule with a tag, the tag name is sent in the Sec-Speculation-Tags header.
Sec-Speculation-Tags: "my-rule"
The tag can be set at multiple levels:
<script type="speculationrules">
{
"tag": "my-ruleset",
"prefetch": [
{
"tag": "my-rule",
"urls": ["next.html", "next2.html"]
}
]
}
</script>
All matching tags are sent in the Sec-Speculation-Tags header, so in this case, both "my-ruleset" and "my-rule" would be sent:
Sec-Speculation-Tags: "my-ruleset", "my-rule"
<script type="speculationrules">
{
"prefetch": [
{
"tag": "my-rule",
"urls": ["next.html", "next2.html"],
"eagerness": "moderate"
}
]
}
</script>
<script type="speculationrules">
{
"prefetch": [
{
"tag": "cdn-rule",
"urls": ["next.html", "next.html"],
"eagerness": "conservative"
}
]
}
</script>
In this example, if the speculation is initiated by the user hovering over the link for 200 milliseconds ("eagerness": "moderate"), then only the my-rule tag will be sent in the header:
Sec-Speculation-Tags: "my-rule"
However, if the link is clicked immediately, without waiting for the 200 millisecond hover, then both rules would have triggered a speculation, therefore both tags will be included in the header:
Sec-Speculation-Tags: "my-rule", "cdn-rule"
<script type="speculationrules">
{
"prefetch": [
{
"urls": ["next.html", "next2.html"],
"eagerness": "moderate"
}
]
}
</script>
<script type="speculationrules">
{
"prefetch": [
{
"tag": "cdn-rule",
"urls": ["next.html", "next.html"],
"eagerness": "conservative"
}
]
}
</script>
Similar to the previous example, if the link is clicked immediately without waiting for the 200 millisecond hover, both rules would have triggered a speculation, therefore both tags will be included in the header. However, because the first rule does not include a tag field, it is represented in the header with a null value:
Sec-Speculation-Tags: null, "cdn-rule"
| Specification |
|---|
| HTML # the-sec-speculation-tags-header |
This page was last modified on Sep 27, 2025 by MDN contributors.
Reason: CORS disabledReason: CORS header 'Access-Control-Allow-Origin' does not match 'xyz'Reason: CORS header 'Access-Control-Allow-Origin' missingReason: CORS header 'Origin' cannot be addedReason: CORS preflight channel did not succeedReason: CORS request did not succeedReason: CORS request external redirect not allowedReason: CORS request not HTTPReason: Credential is not supported if the CORS header 'Access-Control-Allow-Origin' is '*'Reason: Did not find method in CORS header 'Access-Control-Allow-Methods'Reason: expected 'true' in CORS header 'Access-Control-Allow-Credentials'Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Headers'Reason: invalid token 'xyz' in CORS header 'Access-Control-Allow-Methods'Reason: missing token 'xyz' in CORS header 'Access-Control-Allow-Headers' from CORS preflight channelReason: Multiple CORS header 'Access-Control-Allow-Origin' not allowedAcceptAccept-CHAccept-EncodingAccept-LanguageAccept-PatchAccept-PostAccept-RangesAccess-Control-Allow-CredentialsAccess-Control-Allow-HeadersAccess-Control-Allow-MethodsAccess-Control-Allow-OriginAccess-Control-Expose-HeadersAccess-Control-Max-AgeAccess-Control-Request-HeadersAccess-Control-Request-MethodActivate-Storage-AccessAgeAllowAlt-SvcAlt-UsedAttribution-Reporting-EligibleAttribution-Reporting-Register-SourceAttribution-Reporting-Register-TriggerAuthorizationAvailable-DictionaryCache-ControlClear-Site-DataConnectionContent-DigestContent-DispositionContent-DPRContent-EncodingContent-LanguageContent-LengthContent-LocationContent-RangeContent-Security-PolicyContent-Security-Policy-Report-OnlyContent-TypeCookieCritical-CHCross-Origin-Embedder-PolicyCross-Origin-Embedder-Policy-Report-OnlyCross-Origin-Opener-PolicyCross-Origin-Resource-PolicyDateDevice-MemoryDictionary-IDDNTDownlinkDPREarly-DataECTETagExpectExpect-CTExpiresForwardedFromHostIdempotency-KeyIf-MatchIf-Modified-SinceIf-None-MatchIf-RangeIf-Unmodified-SinceIntegrity-PolicyIntegrity-Policy-Report-OnlyKeep-AliveLast-ModifiedLinkLocationMax-ForwardsNELNo-Vary-SearchObserve-Browsing-TopicsOriginOrigin-Agent-ClusterPermissions-PolicyPermissions-Policy-Report-OnlyPragmaPreferPreference-AppliedPriorityProxy-AuthenticateProxy-AuthorizationRangeRefererReferrer-PolicyRefreshReport-ToReporting-EndpointsRepr-DigestRetry-AfterRTTSave-DataSec-Browsing-TopicsSec-CH-Device-MemorySec-CH-DPRSec-CH-Prefers-Color-SchemeSec-CH-Prefers-Reduced-MotionSec-CH-Prefers-Reduced-TransparencySec-CH-UASec-CH-UA-ArchSec-CH-UA-BitnessSec-CH-UA-Form-FactorsSec-CH-UA-Full-VersionSec-CH-UA-Full-Version-ListSec-CH-UA-MobileSec-CH-UA-ModelSec-CH-UA-PlatformSec-CH-UA-Platform-VersionSec-CH-UA-WoW64Sec-CH-Viewport-HeightSec-CH-Viewport-WidthSec-CH-WidthSec-Fetch-DestSec-Fetch-ModeSec-Fetch-SiteSec-Fetch-Storage-AccessSec-Fetch-UserSec-GPCSec-Private-State-TokenSec-Private-State-Token-Crypto-VersionSec-Private-State-Token-LifetimeSec-PurposeSec-Redemption-RecordSec-Speculation-TagsSec-WebSocket-AcceptSec-WebSocket-ExtensionsSec-WebSocket-KeySec-WebSocket-ProtocolSec-WebSocket-VersionServerServer-TimingService-WorkerService-Worker-AllowedService-Worker-Navigation-PreloadSet-CookieSet-LoginSourceMapSpeculation-RulesStrict-Transport-SecuritySupports-Loading-ModeTETiming-Allow-OriginTkTrailerTransfer-EncodingUpgradeUpgrade-Insecure-RequestsUse-As-DictionaryUser-AgentVaryViaViewport-WidthWant-Content-DigestWant-Repr-DigestWarningWidthWWW-AuthenticateX-Content-Type-OptionsX-DNS-Prefetch-ControlX-Forwarded-ForX-Forwarded-HostX-Forwarded-ProtoX-Frame-OptionsX-Permitted-Cross-Domain-PoliciesX-Powered-ByX-Robots-TagX-XSS-Protection100 Continue101 Switching Protocols102 Processing103 Early Hints200 OK201 Created202 Accepted203 Non-Authoritative Information204 No Content205 Reset Content206 Partial Content207 Multi-Status208 Already Reported226 IM Used300 Multiple Choices301 Moved Permanently302 Found303 See Other304 Not Modified307 Temporary Redirect308 Permanent Redirect400 Bad Request401 Unauthorized402 Payment Required403 Forbidden404 Not Found405 Method Not Allowed406 Not Acceptable407 Proxy Authentication Required408 Request Timeout409 Conflict410 Gone411 Length Required412 Precondition Failed413 Content Too Large414 URI Too Long415 Unsupported Media Type416 Range Not Satisfiable417 Expectation Failed418 I'm a teapot421 Misdirected Request422 Unprocessable Content423 Locked424 Failed Dependency425 Too Early426 Upgrade Required428 Precondition Required429 Too Many Requests431 Request Header Fields Too Large451 Unavailable For Legal Reasons500 Internal Server Error501 Not Implemented502 Bad Gateway503 Service Unavailable504 Gateway Timeout505 HTTP Version Not Supported506 Variant Also Negotiates507 Insufficient Storage508 Loop Detected510 Not Extended511 Network Authentication Requiredbase-uriblock-all-mixed-contentchild-srcconnect-srcdefault-srcfenced-frame-srcfont-srcform-actionframe-ancestorsframe-srcimg-srcmanifest-srcmedia-srcobject-srcprefetch-srcreport-toreport-urirequire-trusted-types-forsandboxscript-srcscript-src-attrscript-src-elemstyle-srcstyle-src-attrstyle-src-elemtrusted-typesupgrade-insecure-requestsworker-srcaccelerometerambient-light-sensoraria-notifyattribution-reportingautoplaybluetoothbrowsing-topicscameracaptured-surface-controlch-ua-high-entropy-valuescompute-pressurecross-origin-isolateddeferred-fetchdeferred-fetch-minimaldisplay-captureencrypted-mediafullscreengamepadgeolocationgyroscopehididentity-credentials-getidle-detectionlanguage-detectorlanguage-modellocal-fontslocal-networklocal-network-accessloopback-networkmagnetometermicrophonemidion-device-speech-recognitionotp-credentialspaymentpicture-in-pictureprivate-state-token-issuanceprivate-state-token-redemptionpublickey-credentials-createpublickey-credentials-getscreen-wake-lockserialspeaker-selectionstorage-accesssummarizertranslatorusbweb-sharewindow-managementxr-spatial-trackingYour blueprint for a better internet.
Portions of this content are 19982026 by individual mozilla.org contributors. Content available under a Creative Commons license.
| Web Proxy Viewer | New URL | Original Page |