Header Bidding Explained: What It Is, How Wrappers Work, and Prebid Client Side vs Server Side

Before header bidding, most publishers sold unsold ad space through a waterfall. The ad server called one exchange or network, waited for its answer, and moved down the list if it passed. The order came from ad server priorities and past average prices. It did not reflect what each buyer would pay for this one impression.

Magnite, the largest independent supply-side platform (SSP) by its own description, sums up the change in its annual report. Impressions that used to go to demand sources in a sequence set by the ad server became open to all of them at once (Magnite 10-K, FY2025). That is the whole idea of header bidding in one sentence.

The waterfall had two costs. A buyer lower in the chain never got a chance to bid, even when it valued the impression most. And each step added a round trip to a server, so a long chain slowed the page. Header bidding fixed the first problem by asking everyone at once. It turned the second problem into a setting called the timeout, covered below.

A simple example shows the gap. The numbers in this table are made up to show the mechanism; they are not market data.

Header bidding spread in 2014 and 2015, according to the case timeline in coverage of the US v. Google liability ruling (PPC Land, 17 April 2025). The court later found that Google used auction rules it called First Look, Last Look and Unified Pricing Rules to blunt header bidding's effect (AdExchanger, September 2026). Magnite's annual report calls header bidding a counterweight to Google's hold on display ad serving, which is a company view, not a finding (Magnite 10-K, FY2025).

A header bidding wrapper is the code that manages the auction. It decides which bidders to call, for which ad slots, how long to wait and what to send to the ad server. In the early days each exchange shipped its own tag, and publishers stitched them together by hand. Prebid calls Prebid.js the most widely used wrapper (Prebid introduction, accessed 9 November 2026) and notes that many managed services also use it (Prebid, accessed 9 November 2026).

Here is one auction on a news article page, in seven steps:

1. The page loads the wrapper and its settings. The publisher's file lists the ad units, their sizes, the bidders, any price floors and the auction timeout.
2. Pre-auction modules run. A consent management platform (CMP) reads the reader's privacy choices, and identity and real-time data modules add signals. Prebid warns that slow pre-auction modules eat into the time left for bids (Prebid timeouts guide).
3. Bid requests go out in parallel. Each bid adapter turns the request into the format its exchange expects, often OpenRTB, and sends it at the same time as the others.
4. Bidders answer or time out. Bids that arrive after the timeout are dropped from this auction.
5. The wrapper passes the best bids to the ad server. It attaches them as key-value pairs on the ad server call.
6. The ad server decides. Line items set up by the ad operations team match those key-values, so header bids compete with direct-sold campaigns and with the ad server's own exchange (Prebid, accessed 9 November 2026).
7. The winning ad renders. If a header bid wins, the ad server returns a small creative that tells the wrapper to show that bidder's ad.

The ad server step is the part people miss. Header bidding does not replace the ad server in the most common setup. It feeds the ad server better prices, and the ad server still protects sponsorships and guaranteed deals that the publisher has sold directly.

A safety net sits outside the wrapper. Prebid recommends a separate failsafe timer that calls the ad server anyway if something breaks, set well above the auction timeout (Prebid timeouts guide). Without it, one broken bidder can leave a slot blank.

The ad server can also become just another bidder. Prebid's documentation now describes a second setup in which Prebid picks the winner itself, and the publisher's ad server bids into the Prebid auction like any other source (Prebid introduction). Keep that model in mind for the Google remedies section below.

Prebid is a suite, not one product. Prebid.js is a JavaScript library that runs in the browser. Prebid Server runs the same kind of auction on a server, and Prebid Mobile is the software development kit (SDK) that apps use to talk to it. All of them are open source under the Apache 2.0 license and run by Prebid.org, which its dues-paying members fund (Prebid.org, accessed 9 November 2026).

Prebid.js is modular. Each exchange or SSP writes a bid adapter, and the publisher builds a file with only the adapters it needs. Other modules handle analytics, user IDs, price floors and currency. We counted 537 bid adapter files in the repository on 9 November 2026 (Prebid.js modules, GitHub). Most sites use a small subset: Prebid says client-side setups typically call 5 to 15 demand partners (Prebid introduction).

Prebid Server exists for places where a browser auction does not work. Apps, Accelerated Mobile Pages (AMP), connected TV (CTV), digital out-of-home screens and audio players have no web page header to run code in (Prebid Server overview, accessed 9 November 2026). Websites use it too, to cut the number of calls a browser makes. Unlike Prebid.js, it needs hosting. Prebid warns that installing it is much harder than adding Prebid.js and that the open-source project ships no configuration tools.

The project moves fast, so version numbers age quickly. The table records the versions we found on GitHub at our last check.

Major versions of Prebid.js now land about once a year: 10.0 on 1 July 2025 and 11.0 on 12 March 2026 (Prebid.js 10.0.0, GitHub). Each major release removes old features, so read the release notes before you upgrade. Our Prebid.js guide covers events, adapters, releases and debugging.

You can run Prebid Server yourself or rent it. Several Prebid.org members sell hosted Prebid Server with servers around the world and tools for stored requests (Prebid Server overview). PubMatic, for example, lists OpenWrap as its header bidding product in its annual report (PubMatic 10-K, FY2025). Our Prebid Server self-hosting guide covers the build path. The profiles of PubMatic OpenWrap and Magnite Prebid Server cover the rent path.

Client side means the browser calls each bidder directly. Each bidder can read its own cookies, so it recognises more users and often bids higher. The cost is more network requests and more script on the page. That cost is highest on slow phones and busy pages.

Server side means the browser makes one call to Prebid Server, which calls the bidders from a data centre. Prebid's own example: move five bidders to the server and the browser sends one request instead of five (Prebid introduction). The catch is identity. The server cannot read each bidder's cookies, so it relies on user matching, also called cookie sync, to tell bidders who the reader is. Our explainer on Prebid Server cookie sync and user matching shows how that works.

Most large publishers mix the two. They keep their best-paying bidders in the browser and move the long tail to the server. Prebid does not prescribe a split. It recommends A/B tests of the number of bidders, the timeout values and the client-versus-server mix on each site (Prebid introduction).

Sources for the table: Prebid introduction and Prebid Server overview, both accessed 9 November 2026.

Amazon Publisher Services (APS) runs two header bidding marketplaces. Both work server to server: the page or app makes one call, and Amazon's servers collect bids from Amazon and from other buyers. Both pay the publisher in one combined payment, which APS says arrives within 60 days (APS Transparent Ad Marketplace, accessed 9 November 2026).

Transparent Ad Marketplace (TAM) is the version in which the publisher manages its own buyer relationships. The only technical need is the APS multi-slot tag, but the publisher signs a contract with each demand partner it wants. APS says more than 50 buyers work with TAM (company claim) (APS TAM, accessed 9 November 2026). It also says publishers get auction-level records that show every bidder, bid and winner.

Unified Ad Marketplace (UAM) is invitation-only and aimed at web publishers that use Google Ad Manager. Amazon brings the buyers. APS names OpenX, PubMatic, Magnite and Index Exchange among them (APS Unified Ad Marketplace, accessed 9 November 2026). UAM runs next to Prebid rather than inside it: APS asks publishers to place the UAM script outside any other wrapper, and it sets up the ad server line items for them.

A news site can run both. Prebid.js calls eight browser bidders, UAM collects Amazon's bids in parallel, and both sets of prices reach Google Ad Manager as key-values. The ad server then compares them with direct campaigns and with AdX.

Open Bidding is Google's own form of server-side bidding. Google Ad Manager calls third-party exchanges, which Google calls yield partners, from its own servers during its unified auction. The publisher adds no new code, because the existing Google tag does the work (Google Ad Manager Help, accessed 9 November 2026).

The key difference is where the auction lives. In header bidding, bids are gathered before Google Ad Manager is called. In Open Bidding, Google Ad Manager runs the whole auction and compares yield partner bids with the AdX bid and direct line items in one step (Google Ad Manager Help). Google pays the publisher for Open Bidding impressions net of Google's revenue share, under an addendum to the Ad Exchange agreement (Google Ad Manager Help). Those help pages do not state the size of the share.

Sources for the table: Prebid introduction, APS pages and Google Ad Manager Help, accessed 9 November 2026. The full side-by-side, with fees and data access, is in Prebid vs Open Bidding vs Amazon TAM.

Every header bidding setup trades revenue against speed. Wait too briefly and good bids miss the auction. Wait too long and the ad server call slips, readers scroll away and impressions are lost. Prebid lists the factors to weigh: time on page, direct sell-through, the value of each channel and readers' network delay (Prebid timeouts guide, accessed 9 November 2026).

Prebid uses four timers. The failsafe timeout fires the ad server call if all else fails. The auction timeout caps the whole Prebid auction. The server-side timeout, set in s2sConfig.timeout, must be shorter, so that Prebid Server's answer gets back in time. It travels to bidders as the OpenRTB tmax field, and Prebid Server shaves a safety buffer off it before replying (Prebid timeouts guide).

Here is a worked budget for a publisher that picks a one-second auction.

When timeouts climb, Prebid suggests four checks (Prebid timeouts guide). Compare where your readers are with where each bidder's servers are. Measure how long consent and ID modules run before bids go out. Look for heavy scripts that block the browser. And make sure user syncs do not fire before the first auction. Our guide to QPS, latency and bid performance covers the same trade-off from the server side.

On 17 April 2025 a US federal court ruled that Google had monopolized the publisher ad server and ad exchange markets for open-web display (PPC Land, 17 April 2025). Judge Leonie Brinkema issued her remedies order on 2 September 2026 and unsealed the 106-page opinion on 16 September 2026. She declined to order a sale of AdX. Instead she chose behavioural remedies, watched by a technical monitor for six years (AdExchanger, September 2026).

The headline change for header bidding: Google must build an adapter so that a qualified Prebid instance can request AdX bids and get them back. The draft judgment filed on 2 October 2026 also requires a server-to-server link between Google's ad server and Prebid Server within 12 months of the effective date. A second link, for programmatic guaranteed and preferred deals, follows within 15 months (PPC Land, October 2026).

The same draft contains four more items that matter to header bidding (PPC Land, October 2026):

• Header Bidding Trafficking for every publisher. Google's tool for handling Prebid bids without hand-built line items would reach every Google Ad Manager publisher within six months, whatever its size.
• Old pricing rules go. Unified Pricing Rules end for indirect demand, and First Look and Last Look may not return.
• One route per impression. A publisher can call AdX directly or through Prebid for a given impression, but not both, and logs must show which route was used.
• Narrow scope. The judgment covers open-web display. It excludes apps, CTV, in-stream video and Google's buying tool, Display & Video 360 (PPC Land, October 2026).

Status matters more than headlines here. The draft still carries bracketed alternatives where the government and Google disagree, mostly on deadlines. The judgment takes effect 60 days after the judge signs it, and the six-year term starts then. We found no report of entry by 9 November 2026, and the judge remarked at closing arguments in November 2025 that an appeal looked likely (PPC Land, October 2026). Plan against the signed text, not the draft.

What could change in practice? Today a publisher that wants AdX demand calls it through Google Ad Manager. Once the integrations ship, the same publisher could run Prebid as the main auction and let AdX bid inside it, or move to a rival ad server and keep AdX. Our guides to the Google ad tech remedies for publishers and switching ad servers without losing AdX demand track the details as they firm up.

1. Prebid.org, "About Prebid.org" (accessed 9 November 2026). https://docs.prebid.org/overview/what-is-prebid-org.html
2. Prebid.org, "Introduction to Prebid" (accessed 9 November 2026). https://docs.prebid.org/overview/intro.html
3. Prebid.org, "Introduction to Header Bidding" (accessed 9 November 2026). https://docs.prebid.org/overview/intro-to-header-bidding.html
4. Prebid.org, "Prebid Server overview" (accessed 9 November 2026). https://docs.prebid.org/prebid-server/overview/prebid-server-overview.html
5. Prebid.org, "Prebid timeouts" (accessed 9 November 2026). https://docs.prebid.org/features/timeouts.html
6. GitHub, Prebid.js releases 11.47.0 (4 November 2026), 11.0.0 (12 March 2026) and 10.0.0 (1 July 2025). https://github.com/prebid/Prebid.js/releases/tag/11.47.0
7. GitHub, Prebid.js modules folder (counted 9 November 2026). https://github.com/prebid/Prebid.js/tree/master/modules
8. GitHub, Prebid Server (Go) releases 4.11.1 (2 November 2026) and 4.0.0 (6 March 2026). https://github.com/prebid/prebid-server/releases/tag/v4.11.1
9. GitHub, Prebid Server (Java) releases 4.5.0 (4 November 2026) and 4.0.0 (6 August 2026). https://github.com/prebid/prebid-server-java/releases/tag/4.5.0
10. Magnite, Inc., Form 10-K for fiscal year 2025 (filed 25 February 2026). https://www.sec.gov/Archives/edgar/data/1595974/000159597426000007/mgni-20251231.htm