How Accept-CH Advertises Which Hints a Site Wants

High-entropy client hints arrive only when a server asks for them. The asking happens through a response header, and its timing has consequences worth understanding before relying on it.

The request is a response header

A server lists the hints it wants in a response header naming those fields. The browser records the request against the origin and includes those hints on subsequent requests.

The list is explicit. Each hint is named individually, so there is no wildcard that grants everything and no way to request a category.

Naming fields individually is intentional. It makes the site's data requirements legible to anyone inspecting the exchange, including the browser's own policy layer.

The first request never carries them

Because the request travels in a response, the very first request to an origin cannot include hints the server has not yet asked for. There is a round trip before anything arrives.

This breaks the pattern of branching server-side on the initial navigation. Code written against the legacy header expects full information on request one and does not get it here.

Designs that must decide on the first byte need either the low-entropy set, which is always present, or a different approach entirely.

Preference is stored per origin

The browser associates the request with the origin, not with a page or a session. Later requests to the same origin carry the hints without the header being repeated.

Storage is subject to the same clearing behaviour as other origin state. A user clearing site data resets the preference and the first-request gap reappears.

That makes the gap a recurring condition rather than a one-time cost. Code must handle absent hints as a normal case, not an exceptional one.

Subresources and frames follow separate rules

Hints do not flow automatically to other origins embedded in the page. A third-party frame or asset host receives them only through explicit delegation.

This prevents a site's hint access from silently extending to every party it embeds. Delegation is the sanctioned path and it is visible in the page's own configuration.

Teams often discover this after their analytics or media host reports missing data. The fix is a delegation policy, not a change to the hint request itself.

A separate mechanism removes the round trip

For hints needed on the very first request, a companion header marks certain hints as critical, prompting the browser to retry the request with them included.

The retry costs a connection restart, so it is reserved for cases where the response genuinely cannot be produced without the hint. Using it broadly wastes the saving it provides.

The trade-off is explicit and measurable, which is the general character of this mechanism: costs are visible in the protocol rather than hidden in a string.