Even cookies aren't required (see https://tools.ietf.org/html/rfc2616 and https://serverfault.com/questions/163511/what-is-the-mandato... for an explanation). It entirely depends on the client and convention.

That said, browsers typically send headers such as ACCEPT, REFERER and USER_AGENT (see https://www.whatismybrowser.com/detect/what-http-headers-is-... for a complete list of headers for your browser).

The HTTP/1.1 RFC[0] specifies that the host header MUST be included in each request.

   >A client MUST include a Host header field in all HTTP/1.1 request
   >messages . If the requested URI does not include an Internet host
   >name for the service being requested, then the Host header field MUST
   >be given with an empty value. An HTTP/1.1 proxy MUST ensure that any
   >request message it forwards does contain an appropriate Host header
   >field that identifies the service being requested by the proxy. All
   >Internet-based HTTP/1.1 servers MUST respond with a 400 (Bad Request)
   >status code to any HTTP/1.1 request message which lacks a Host header
   >field.

[0] https://tools.ietf.org/html/rfc2616#page-128

Depends on the client I would imagine. This is what cURL sends by default:

    > Host: google.com
    > User-Agent: curl/7.54.0
    > Accept: */*

Etag and Last modified since, headers?