HTTP Link header on 27 homepages: 9 send one, 0 use it the way Google documents

FIELD TEST · 2026-09-11 · 30 domains · 27 readable · one pass

Sample and method: the same 30-site panel in use since 2026-08-15, each homepage requested once on 2026-09-11 with a desktop Chrome user agent over HTTP/2, redirects followed, no JavaScript executed. We kept every header block the server sent, including any 103 interim response, and counted only the final URL's response. Three domains answered 403 to our client — canva.com, medium.com and stackoverflow.com — leaving 27.

The HTTP Link header is the response-header form of a <link> element: a URL, a relation, and optional attributes, sent before the HTML. Nine of 27 homepages send one, carrying 39 links between them. Thirteen are preload, eleven are preconnect, and five point at /.well-known/api-catalog. The two relations Google documents reading from this header — canonical and alternate with hreflang — appear zero times.

How we measured this

One request per homepage, from outside, with no account anywhere. Everything below comes from the Link field on the final response after redirects. We split each field on the commas that sit before a <, took the rel parameter of each part, and counted. Then we fetched every URL the headers named, to see whether the thing advertised exists.

# All header blocks for one domain, including a 103 if the server sends one
curl -s -o /dev/null -D - --http2 -L -A 'Mozilla/5.0 (Macintosh) Chrome/126.0' https://example.com/ \
  | grep -iE '^(HTTP/|link:)'

# One link per line
curl -sIL -A 'Mozilla/5.0 (Macintosh) Chrome/126.0' https://example.com/ \
  | grep -i '^link:' | sed 's/, *</\n</g'

Four limits. We did not fetch the HTML, so a site that writes the same preload as a <link> element inside the page is counted here as sending nothing; the header and the element are two different channels and this measurement only reads one. Second, a homepage is one URL, and the header is often set per route. Third, the count depends on the client: the 103 response is something a server may reserve for browsers, and we cannot tell from outside whether any of the 26 silent sites would have sent one to Chrome. Fourth, we used curl on purpose — Python's standard HTTP client drops 1xx responses without a trace, and a script built on it would have reported zero.

Nine of 27 homepages send an HTTP Link header

The header is uncommon, and where it exists it is doing one of two very different jobs. Three sites use it for performance hints; five use it to tell a machine where their API catalog is; Cloudflare does both in one field of ten links. The one WordPress site on the panel sends the REST API pointer WordPress emits by default.

The other 18 send no Link field at all: arstechnica, bbc, figma, github, gitlab, mozilla, notion, nytimes, react.dev, reddit, shopify, slack, stripe, substack, theverge, wikipedia, wired, and news.ycombinator. None of the 403 responses and none of the intermediate redirects carried one either.

What the 39 links point at

Counted by relation, the header on this panel is mostly a performance channel with a discovery channel growing beside it. Preload and preconnect together are 24 of the 39 links but come from only three sites. The api-catalog relation is one link per site and five sites — the widest spread of any relation here.

Two things in the preload rows are worth a second look. All eight of nextjs.org's links sit under /_next/static/immutable/media/, two fonts and six logo SVGs, which is the shape a framework emits rather than a person. And the HTML Standard is specific about which relations the header form is even allowed to act on: for preload and preconnect it defines header processing steps, while for icon, manifest, modulepreload, prefetch and stylesheet it says the header steps "are to do nothing" (HTML Standard, section 4.6.8, read 2026-09-11). Nobody on this panel sent one of the five dead ones.

The two relations Google documents reading appear zero times

The two uses of this header we could find in Google's Search documentation are both for files that cannot carry a <link> element. On canonicalization: "you can return a rel="canonical" HTTP header to tell Googlebot what is the canonical URL for the non-HTML files", with the example Link: <https://www.example.com/downloads/white-paper.pdf>; rel="canonical" (Consolidate duplicate URLs, read 2026-09-11). On localized versions: the HTTP header "is useful for non-HTML files (like PDFs)", with the format Link: <url1>; rel="alternate"; hreflang="lang_code_1", … (Tell Google about localized versions of your page, read 2026-09-11).

On a homepage neither is expected, and neither showed up. That is the right result, not a gap: the page can hold both as elements, and that is where this panel keeps them — when we read the HTML of the same sites on 2026-08-19, 23 of 28 declared a canonical there (canonical tag on 28 homepages). The header form earns its place on PDFs, on the .docx in Google's example, and on any file your CDN serves without a <head>. If you have never sent one, the chapter on how to use canonical tags ranks the header against the other three signals.

Five sites use it to say where the API catalog is

The api-catalog relation and the /.well-known/api-catalog path come from a standards-track RFC published in June 2025 whose stated purpose is "to facilitate automated discovery and usage of published Application Programming Interfaces" (RFC 9727, read 2026-09-11). The RFC says the catalog "MUST" be published as application/linkset+json and "SHOULD" carry a profile parameter naming the RFC. We fetched all five targets, plus everything else the nine headers pointed at.

Every advertised URL exists. Four of the five catalogs are in the format the RFC requires; Vercel's is the only one that also sends the profile parameter. Cloudflare's api-catalog link is the odd one: it points at an agents.json whose first line declares a schema at agentprotocol.ai, which is not the RFC's format, so a client that trusts the relation name and expects a Linkset gets something else. Railway's homepage is the only one on the panel that advertises a markdown twin of itself — the file opens with the words "Setup briefing for AI coding agents arriving at railway.com" — which is the header-level version of what we found three docs sites doing in serving markdown to AI crawlers.

Whether any AI crawler reads these relations today is not something a response header can tell you. We did not measure crawler behaviour in this pass, and we are not going to guess at it. What the five headers prove is narrower and still real: as of 2026-09-11, five infrastructure companies decided the HTTP response, not the HTML, is where a machine should be told what else the site offers.

Only one site sends any of it early

A 103 response "indicates to the client that the server is likely to send a final response with the header fields included in the informational response" (RFC 8297, read 2026-09-11), and its whole reason to exist is to carry Link hints before the page is ready. On this panel exactly one homepage sends one: www.cloudflare.com, whose 103 carries five links — the three preloads and two preconnects — and whose final 200 repeats those five and adds the five discovery links. The 26 other readable sites, including nextjs.org with the longest preload list on the panel, send their hints only with the final response, which is the moment the browser would have discovered them anyway.

A Link header on the final response is a note pinned to the parcel; the same header on a 103 is a phone call before the parcel leaves.

What this means for you

Read your own header once, then decide which of the two jobs you want it doing. Most sites need neither on the homepage; the cases below are the ones where it is the right tool.

• Send rel="canonical" as a header on every PDF, spreadsheet and export that has an HTML twin — that is the one use Google documents, and it is the only way to declare a canonical on a file with no <head>.
• If you translate downloadable files, send the hreflang set as a header on each of them, including the requested file itself, as the localized-versions page requires.
• If you publish an API, put the catalog at /.well-known/api-catalog as application/linkset+json and name it with rel="api-catalog"; four of the five sites doing this already match the RFC.
• Do not move icon, manifest, stylesheet, prefetch or modulepreload into the header. The standard says the header form does nothing for those five.
• Do not treat a preload header on the final response as an early hint. Without a 103 in front of it, it arrives with the HTML.

If the question is whether an AI crawler can reach the file you just pointed at, run it through the AI crawler accessibility check — a discovery link to a URL the crawler is blocked from is a link to nothing.

Common questions

How did you measure this?

One curl request per homepage on 2026-09-11, HTTP/2, desktop Chrome user agent, redirects followed, headers dumped with -D - so that any 103 block is kept. Every number above was recomputed from the saved header blocks by a script; nothing was typed in by hand. Then a second pass fetched each URL the headers named and recorded status, content type and size.

What is the HTTP Link header for?

It "provides a means for serialising one or more links into HTTP headers" (RFC 8288, read 2026-09-11). In practice it does three jobs: performance hints a browser can act on before parsing, metadata for files that cannot hold HTML, and — newly — discovery pointers for machines that never render the page.

Does Google read preload or preconnect from the header?

Google's Search documentation does not say, and we did not test it. The two relations it does document are canonical and hreflang. Treat everything else in this header as addressed to browsers and to whatever agents choose to read it.

Is 103 Early Hints worth setting up?

Only if you already have preloads worth sending, and only if your CDN will emit the 103 for you — on this panel that was one site in 27. For an SEO reader the honest answer is that we found no Google document tying 103 to crawling or ranking, so file it under page performance, not search.

Should I add an api-catalog link if I do not have a public API?

No. The relation exists to point at a catalog; a link to a page that is not one tells a machine something false. If what you have is documentation for humans and models, /llms.txt and a markdown alternate, as Railway and Cloudflare send, are the closer fit.