What a User Agent String Contains

Every HTTP request your browser sends includes a User-Agent header that identifies the client software making the request. The string typically contains the browser name and version, the rendering engine, the operating system, and device type. A Chrome browser on Windows sends something like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36. This single header line reveals your browser family, version, OS, and platform architecture.

Mobile browsers add device identifiers. An iPhone running Safari includes iPhone; CPU iPhone OS 17_5 like Mac OS X. Android devices include Android version and device model, like Linux; Android 14; Pixel 8. These identifiers tell servers exactly what hardware and software combination is requesting the content.

Search engine crawlers announce themselves explicitly. Googlebot identifies as Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html). Bingbot, Yandexbot, and other crawlers include their name and a URL to their documentation. This transparency allows servers to treat crawlers differently from regular users.

Mobile vs Desktop Detection

Servers use the User-Agent string to decide which version of a site to serve. If the string contains "Mobile," "Android," or "iPhone," the server responds with a mobile-optimized layout. If the string indicates a desktop browser, the server sends the full-width design. This server-side detection happens before any HTML is sent to the client.

The recommended approach is responsive design, which serves the same HTML to all devices and uses CSS media queries to adjust layout. This eliminates the need for User-Agent detection entirely because the same code works for all screen sizes. However, some situations require device-specific serving: servingAMP pages to mobile devices, delivering lightweight pages to slow connections, or redirecting mobile users to an app download page.

If you implement device detection, use it conservatively and always provide a way for users to override the detected version. A "View Desktop Site" link should be available on every mobile page. Locking users into a detected experience without an override option frustrates users who have non-standard browsers or who intentionally want the other version.

Bot Identification and Crawler Access

Googlebot identifies itself with a string that includes the name "Googlebot" and a link to Google's crawler documentation. You can verify that a crawler is legitimate by performing a reverse DNS lookup on the IP address and checking that the hostname resolves to a googlebot.com or google.com domain:

# Verify Googlebot's identity
nslookup 66.249.66.1
# Should resolve to a *.googlebot.com or *.google.com hostname

# Check the reverse DNS
dig -x 66.249.66.1 +short
# Should return something like crawl-66-249-66-1.googlebot.com

Impersonating a search engine crawler is a violation of Google's spam policies. If your server detects a User-Agent string claiming to be Googlebot but the reverse DNS does not verify, block the request. This prevents scrapers from harvesting your content under the guise of being a search engine.

Our user agent checker parses any User-Agent string and displays exactly what information it reveals about the client. This helps you understand what data your site's visitors are exposing with every request they make.

Cloaking Risks and Detection

Cloaking is the practice of serving different content to search engine crawlers than to regular users. Using User-Agent detection to show Googlebot a different page than what human visitors see violates Google's webmaster guidelines. Google explicitly warns against this and penalizes sites that implement cloaking, ranging from ranking demotions to complete removal from the index.

Legitimate User-Agent detection is not cloaking. Serving a mobile-optimized page to mobile User-Agents while serving a desktop page to desktop browsers is standard responsive behavior. The key distinction is intent: cloaking aims to deceive search engines about the content, while device detection serves appropriate experiences for different clients.

Google uses a two-phase crawling approach to detect cloaking. First, Googlebot requests the page with its known User-Agent string. Then, Googlebot makes a second request with a regular browser User-Agent string (like Chrome's). If the content differs between these two requests, it triggers a cloaking investigation. Ensure that your site serves the same core content regardless of the requesting User-Agent.

User-Agent Fingerprinting and Privacy

The User-Agent string is one component of browser fingerprinting. Combined with screen resolution, installed fonts, browser plugins, time zone, and language settings, the User-Agent helps create a unique identifier that tracks users across sites without cookies. Privacy-focused browsers like Brave and Firefox restrict the User-Agent string to reduce fingerprinting. Brave randomizes certain values on each request, making consistent tracking difficult.

Privacy regulations like GDPR and CCPA apply to User-Agent data because it can identify individual users. If your server logs User-Agent strings and associates them with user accounts or IP addresses, you are collecting personal data that falls under privacy regulations. Include User-Agent logging in your privacy policy disclosure and data retention policies.

The User-Agent Client Hints API is the modern replacement for User-Agent sniffing. Instead of sending the full User-Agent string with every request, the browser provides reduced information by default and allows servers to request specific details through the Accept-CH header. This approach preserves functionality while reducing passive fingerprinting:

// Server requests additional client hints
Accept-CH: Sec-CH-UA-Mobile, Sec-CH-UA-Platform, Sec-CH-UA

// Browser responds with structured data
Sec-CH-UA-Mobile: ?1
Sec-CH-UA-Platform: "Android"
Sec-CH-UA: "Chromium";v="125", "Google Chrome";v="125"

User-Agent Detection in PHP

Server-side User-Agent detection uses PHP's $_SERVER['HTTP_USER_AGENT'] variable. Parse it with regex patterns or dedicated libraries to extract browser, OS, and device information:

<?php
$ua = $_SERVER['HTTP_USER_AGENT'] ?? '';

// Detect mobile
$isMobile = preg_match('/Mobile|Android|iPhone|iPad/i', $ua);

// Detect specific browsers
$isChrome = preg_match('/Chrome/i', $ua) && !preg_match('/Edg/i', $ua);
$isSafari = preg_match('/Safari/i', $ua) && !preg_match('/Chrome/i', $ua);
$isFirefox = preg_match('/Firefox/i', $ua);

// Detect crawlers
$isBot = preg_match('/Googlebot|Bingbot|Yandexbot|Baiduspider/i', $ua);

if ($isBot) {
    // Serve crawler-optimized content
} elseif ($isMobile) {
    // Serve mobile experience
} else {
    // Serve desktop experience
}
?>

For production applications, use a dedicated User-Agent parsing library like JayBizzle/Crawler-Detect or matomo/device-detector instead of raw regex. These libraries maintain up-to-date patterns for thousands of devices and browsers, handling edge cases that manual regex patterns miss.