HMRC Fraud Prevention Header Lint for Making Tax Digital (VAT and Income Tax)

Five header spellings HMRC rejects look completely correct to a UK developer building Making Tax Digital software. They pass code review, they pass your tests, and they pass every linter you already run - because none of those things has ever read HMRC's Fraud Prevention Directions.

Here is the one that catches almost everyone. HMRC's header is Gov-Vendor-License-IDs. American spelling. A UK developer writes Licence without a second thought, and nothing in the toolchain objects.

There are four more of the same shape:

• Gov-Client-Timezone must be a UTC offset in UTC+HH:MM form. Not Europe/London, not GMT, not UTC+1.
• Gov-Client-Public-IP-Timestamp must be yyyy-MM-ddThh:mm:ss.sssZ, with the milliseconds and the trailing zeros. 2026-09-09T14:30:05Z is the wrong format.
• Gov-Client-Screens uses colour-depth. British spelling this time, which is exactly why it catches people who learned the License one.
• Gov-Client-Device-ID ends in a capital ID, and it has to be a UUID that persists on the device, not a string you hard-coded during testing.

Why your assistant gets this wrong

The Directions have been revised repeatedly - version 3.0 in January 2021, 3.1 in January 2022, 3.2 in August 2023, 3.3 in January 2025. Each revision moved headers between required and optional. Gov-Client-Browser-Plugins and Gov-Client-Browser-Do-Not-Track no longer need values for a web application via server, but a large amount of the tutorial material on the open web still lists them as mandatory, and that is the material language models were trained on.

That is the trap. The wrong answer is confidently written, well formatted, and four years out of date.

Why HMRC's own validator does not save you

HMRC publishes a Test Fraud Prevention Headers API, and it is good. But it grades a live request that you have already built and sent, using sandbox credentials. It cannot read your source. It tells you nothing on the afternoon you are writing the integration, and nothing at all about the code paths your tests do not exercise.

What this extension does

It reads the file you have open and applies 34 rules drawn directly from HMRC's connection-method tables - the header names, the value syntax, the percent-encoding rules, and the connection methods that actually exist. WEB_APP_DIRECT is not one of them; a browser-based application is always WEB_APP_VIA_SERVER.

It runs offline. Your code is not uploaded anywhere, which matters when the file in front of you sets headers on a request carrying a client's tax data.

Checking the open file is free and complete: every finding, every correct spelling. A licence adds the whole-workspace scan - header code is almost always spread across the HTTP client, the middleware and the tests - plus an exportable CSV, JSON or HTML report, machine-readable output so CI can fail the build, and auto-correction of the names that have exactly one right spelling.

The first mandated Making Tax Digital for Income Tax year is running now, and the next quarterly update deadline is 7 November 2026.