Advertise the hints your server wants (Accept-CH), gate the first render on the ones you can't render without (Critical-CH), and delegate to third-party subresources (Delegate-CH). Build every Sec-CH-UA-* request header with correct RFC 8941 structured-field encoding, and paste raw request headers to see what the browser sent — and which of them are the high-entropy ones that only appear after the site asks.
| Hint | Class | Value | Notes |
|---|
User-Agent). High-entropy hints only appear after your response has advertised them via Accept-CH. Critical-CH triggers a browser-initiated retry of the current request with the requested hints included — use it only for hints that determine the HTML itself. Old Feature-Policy: ch-... is deprecated — use Permissions-Policy: ch-... or the response Delegate-CH header.
v parameter. Booleans use ?0 / ?1.Sec-CH-UA-*. Fall back to User-Agent or the navigator.userAgentData JS API and expect nulls."Not?A_Brand";v="99") is Chromium's active anti-lock-in trick — the exact string rotates. Servers must accept unknown brands gracefully.