How to send custom request headers with Wget

HTTP request fields carry metadata beyond the URL. In GNU Wget, --header adds outgoing HTTP request fields and can be repeated to send several headers.

Request headers travel to the server; response headers travel back with its reply. Displaying response headers with --server-response, or making a HEAD request to retrieve response metadata without a body, does not set custom request fields.

Public echo services such as httpbin receive every header you send. Never send live credentials, tokens, session cookies, or private routing values to them; use dummy values for testing and a server you control for sensitive requests.

1. Send one dummy custom header to the public echo service.

   $ wget -qO- --header='X-ID: eu1' \
     https://httpbin.org/headers
   {
     "headers": {
       "Accept": "*/*",
       "Accept-Encoding": "identity",
       "Host": "httpbin.org",
       "User-Agent": "Wget/1.25.0",
       "X-Id": "eu1"
     }
   }

   Each --header option takes one quoted header line containing the field name, colon, and value, with no newline. Here -q suppresses transfer messages and -O- prints the response body, whose JSON echoes the received request fields. Header name capitalization and additional fields can vary.

2. Add more headers by repeating --header in the same command.

   $ wget -qO- --header='X-ID: eu1' \
     --header='X-Role: sync' \
     https://httpbin.org/headers
   {
     "headers": {
       "Accept": "*/*",
       "Accept-Encoding": "identity",
       "Host": "httpbin.org",
       "User-Agent": "Wget/1.25.0",
       "X-Id": "eu1",
       "X-Role": "sync"
     }
   }

   Repeat the option once per header instead of packing unrelated fields into one long string.

3. Clear earlier user-defined headers with an empty --header before sending the final header set.

   $ wget -qO- --header='X-ID: stage' \
     --header='' \
     --header='X-ID: prod' \
     https://httpbin.org/headers
   {
     "headers": {
       "Accept": "*/*",
       "Accept-Encoding": "identity",
       "Host": "httpbin.org",
       "User-Agent": "Wget/1.25.0",
       "X-Id": "prod"
     }
   }

   An empty --header removes the user-defined headers added earlier in the same command, which is useful when a copied command or shell alias started with the wrong custom fields.

4. Override the Host request field for a server you control.

   $ wget -qO- --header='Host: app.example.test' \
     http://127.0.0.1:8080/headers

   This command assumes a local HTTP server that echoes received headers at http://127.0.0.1:8080/headers. For another server, the URL names the reachable destination and Host names the desired HTTP virtual host. Changing Host does not change DNS resolution or the connection destination.

   For HTTPS, the URL hostname still controls TLS Server Name Indication (SNI) and certificate hostname verification. A Host override alone cannot select a different TLS name or fix a certificate mismatch when the URL uses an IP address. With certificate verification enabled, the HTTPS URL must use a hostname covered by the server certificate.

5. Confirm that the echo response contains the requested Host value.

   {
     "headers": {
       "Host": "app.example.test",
       "User-Agent": "Wget/1.25.0",
       "Accept": "*/*",
       "Accept-Encoding": "identity",
       "Connection": "Keep-Alive"
     }
   }

   The echoed Host is app.example.test even though the connection went to 127.0.0.1. For the public tests, X-Id and X-Role show the dummy values received by httpbin; X-Id becomes prod after the empty-header reset.