Threat Level: green Handler on Duty: Renato Marinho

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
X-XSS-Protection
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-Served-By
X-UA-Compatible
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Ua-Compatible
X-Cache-Status
X-Request-ID
X-Generator
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Content-Security-Policy
X-Iinfo
Content-Encoding
X-CDN
X-AspNetMvc-Version
Feature-Policy
Status
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
X-Via
Access-Control-Max-Age
Keep-Alive
X-Ws-Request-Id
X-Age
X-Robots-Tag
X-AH-Environment
X-Turbo-Charged-By
Request-Context
X-Proxy-Cache
X-Cache-Group
EagleId
Server-Timing
X-Backend
X-Hacker
X-Server
Host-Header
Report-To
X-Amz-Request-Id
X-Server-Powered-By
X-Amz-Id-2
Grace
X-Nginx-Cache-Status
X-UA-Device
X-Rq
X-Varnish-Cache
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-Page-Speed
X-Dns-Prefetch-Control
X-LiteSpeed-Cache
Cf-Railgun
X-Pingback
X-OneAgent-JS-Injection
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Amz-Version-Id
X-Cache-Spec
NEL
X-Device
X-CST
Allow
X-WebKit-CSP
Xkey
X-Vhost
X-Host
X-Backend-Server
X-Server-Id
EagleEye-TraceId
Surrogate-Control
Request-Id
X-Dispatcher
X-Node
Content-Location
X-Response-Time
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Akam-SW-Version
X-Ruxit-JS-Agent
P3p
X-ASPNET-VERSION
X-Ac
X-Application-Context
X-Cache-Lookup
X-Country
Accept-Ch
Accept-CH
X-Template
X-Language
X-Mod-Pagespeed
X-Readtime
Accept-Ch-Lifetime
Accept-CH-Lifetime
MS-Author-Via
X-B3-TraceId
X-Cloud-Trace-Context
Rating
X-Origin-Cache
X-HW
X-MS-InvokeApp
X-Cnection
X-Url
X-PC
X-Vname
X-TtlSet
Edge-Control
X-Clacks-Overhead
X-GitHub-Request-Id
X-ESI
X-ORACLE-DMS-ECID
X-Trace
X-Middleton-Response
X-Sol
X-Middleton-Display
Response
Display
Pagespeed
X-Content-Type
X-D2id
Arr-Disable-Session-Affinity
X-Use-Magma
X-Kinja-Revision
X-Kinja-Build
X-Cdn-Fetch
X-GoogleNews-Bot
X-Exp-Variant
X-Kinja-Server
X-Exp-Id
X-Kinja
Verso
X-ORACLE-DMS-RID
X-Vcap-Request-Id
X-Goog-Hash
X-Rack-Cache
X-Country-Code
X-Buckets
X-Varnish-TTL
X-Server-Name
X-Navigation-Version
Service-Worker-Allowed
X-Powered-By-Plesk
X-VARITI-CCR
X-Amz-Rid
X-Abt-Application-Version
X-TTL
X-FastCGI-Cache
X-Fastly-Request-ID
X-Client-IP
X-Cache-TTL
X-Webkit-CSP
Fastly-Restarts
Pinterest-Version
X-Pinterest-Rid
Pinterest-Generated-By
X-Cached
X-Release
X-MSEdge-Ref
X-Dw-Request-Base-Id
SPRequestGuid
X-SharePointHealthScore
X-Element-Page-Cache
X-Litespeed-Cache
X-NF-Request-ID
SPRequestDuration
SPIisLatency
X-Oneagent-Js-Injection
Public-Key-Pins
RTSS
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
Access-Control-Request-Method
AR-ATIME
AR-CACHE
X-SRCache-Fetch-Status
X-SRCache-Store-Status
AR-Request-ID
AR-PoweredBy
Ar-Sid
X-Edge
X-LLID
X-Powered-CMS
X-Ezoic-Cdn
Cache-Tag
Content-MD5
X-Upstream
X-Origin-Upstream-Status
X-Px
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Source
Fusion-Content-Id
Fusion-Template-Id
Fusion-Component-Id
X-HP-Webp
X-Jurisdiction
S
X-Version
X-MCACHE
X-ECACHE
X-Mid
X-Recruiting
X-Mg-S
Charset
X-Content-Digest
X-PressLabs-Stats
X-Kinsta-Cache
X-Amz-Server-Side-Encryption
Fastcgi-Cache
X-T
X-Ttl
X-Id
Cache-Tags
MicrosoftSharePointTeamServices
Filters
Front-End-Https
X-DynaTrace
X-Content-Security-Policy-Report-Only
X-Logged-In
X-Accel-Expires
Server-Node
Edge-Cache-Tag
X-Debug
X-Correlation-Id
X-Forwarded-Proto
X-Grace
X-Forwarded-For
TP-Cache
TP-L2-Cache
Server-Name
Nginx-Cache
X-XRDS-LOCATION
X-Amzn-Trace-Id
X-Kong-Upstream-Latency
TCN
X-Kong-Proxy-Latency
X-Request-Processing-Time
X-Request-Received
X-Fastcgi-Cache
Surrogate-Key
X-Pinterest-Direct
X-Shield-Request-Id
X-Varnish-Age
X-Yandex-Sdch-Disable
X-Request-Handler-Origin-Region
X-Microsite
X-B3-Sampled
X-Ser
X-Hits
X-Az
X-AppVersion
X-Activity-Id
X-Amz-Replication-Status
X-F-Cache
X-HS-Cache-Config
X-HS-Content-Id
X-HS-Hub-Id
X-HS-Combine-CSS
X-DIS-Request-ID
X-Ruxit-Js-Agent
X-GUploader-UploadID
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-Goog-Generation
X-Goog-Storage-Class
X-Origin-Server
Accept-Charset
X-Geo-Country
Alternate-Protocol
X-Git-Hash
X-Rid
X-Respond-Thread
Cache
Section-Io-Cache
X-Time
X-Frontend
X-FTR-Request-ID
X-XRDS-Location
Nel
X-LB-Cache
Host
X-Upgrade-Enabled
X-DataDome
Access-Control-Allow-Method
X-NWS-LOG-UUID
X-Seen-By
X-Mobile-URL
X-Cache-Age
X-Cache-Key
MS-CV
Paypal-Debug-Id
X-VCache
X-TT
X-AOL-HN
Healthy
ServerID
X-IPLB-Instance
Cleartype
X-Whom
X-Type
X-Content-Options
Powered-By-ChinaCache
X-Varnish-Backend
X-App-Environment
Payment
X-Request-Guid
X-Route-Name
X-Providence-Cookie
X-Aspnet-Duration-Ms
X-Flags
X-Is-Crawler
X-Server-ID
X-Cache-Action
X-Signature
X-B-Cache
X-Page-Id
X-Source
X-WebKit-CSP-Report-Only
Fastcgi-Useragent
X-Debug-Info
X-Jobs
X-Hostname
X-Load-Cache
X-Daa-Tunnel
X-N
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-FB-Debug
X-Mobile
X-Erf-Bev-Bev
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
X-Via-JSL
Realpath
X-Contextid
Refresh
Version
Node
X-Cached-By
X-Wix-Request-Id
X-Drupal-Cache-Tags
X-Original-Request-Id
X-RateLimit-Remaining
X-Accel-Buffering
X-Rule
X-Response-Served-From
DC
X-Zen-Fury
X-RTag
X-Proxy
Ms-Operation-Id
X-Cacheable-TTL
X-Akamai-Edgescape
X-Framework
X-RemovedCookies
X-ProcessESI
Viewport
X-Cache-Operation
X-Cache-Rule
X-Real-IP
X-HTML-Minification-Powered-By
X-Distributor
X-Cache-Time
Access-Control-Request-Headers
X-Instance
X-B
Eomportal-Instance
X-Region
X-Page-View
X-Drupal-Cache-Contexts
Referer-Policy
X-UUID
X-Cluster-Name
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Cache-Expired-At
X-Cache-Control
X-FW-Serve
Countrycode
Liferay-Portal
X-Content-Powered-By
VIX-Pulpo-Node
X-FW-Server
X-FW-Dynamic
X-FW-Hash
X-FW-Type
X-FW-Static
VIX-Pulpo-Upstream-Status
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Cache-Hit
X-IPS-LoggedIn
X-G
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-Pixel-1
X-Tumblr-User
X-L-Path
X-Environment-Context
DynaTrace
X-FireWall-Port
X-Pass-Why
Server-Info
X-App-Server
X-Ratelimit-Limit
Xserver
X-User-Agent
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Origin-Responded
X-Varnish-Ttl
CF-IPCountry
X-Protected-By
Section-Io-Id
Webserver
X-Tumblr-Pixel-2
Ec-Rule-Version
X-Ratelimit-Remaining
From-Origin
GEO-INFO
X-Www-Served-By
SRV
X-Node-Name
Protected
X-Nginx-Cache
X-Cache-Server
Meta-Geo
X-ES-SERVER
X-Endurance-Cache-Level
X-Debug-IsConnected
X-RN-RSRV
X-Backend-Name
X-Hl-Ver
X-Mode
X-Debug-IsPreview
X-UPSTREAM-Address
X-Handled-By
Cache-Tv-Group
Cache-Status
X-Adobe-Content
X-Device-Type
X-Adobe-Loc
Frame-Options
X-FB-TRIP-ID
X-Locale
X-Site-Version
X-Uri
X-NYM-Debug-Backend
X-Storage
X-PHP-Host
X-Be
X-MP-GENERATED-AT
X-Web-Node
X-Labrador-Cache-Channel
X-Soup
X-Varnishpool
X-UA-Device-Type
X-Request-Time
Selected-Fe
TWC-Connection-Speed
X-Pubstack
TWC-Device-Class
TWC-GeoIP-Country
X-Redis-Cache
Webcakes-App-Name
X-ProxyCache-Status
Fastly-SSL
Country
Cache-Name
X-WA-Info
X-Proxy-Build
Decoy-Debug-Key
X-Sql-Count
X-ProxyCache-Key
Decoy-Debug-TTL
Decoy-Debug-Status
Property-Id
X-Via-Fastly
TWC-Privacy
X-Origin-Date
TWC-Locale-Group
X-Proto
X-No-Session
X-Timing-Wait
X-Hyper-Cache
X-BYPASS-REASON
X-Origin-Hint
X-OCL
Webcakes-Region
X-PCL
X-Sql-Duration-Ms
Webcakes-App-Version
X-Human
TWC-GeoIP-LatLong
X-VWS-Id
X-Loop
X-Access
Azure-RegionName
X-AIR-PT
Azure-SiteName
Azure-SlotName
Azure-Version
Azure-InstanceId
X-SayCDN-TTL
X-LJ-Flow-ID
X-S-Maxage
X-TNCMS
X-Hosted-By
X-LAGOON
Retry-After
X-Say-Cacheable
X-R9-Blue-Green-Version
X-Section
X-Format
X-Say-TTL
X-FW-Version
X-Server-W
X-AWS-Id
X-CCM
X-Cluster
X-Forwarded-Host
X-Cache-TTL-Remaining
X-Cache-Grace
X-Revision
X-Alternate-Cache-Key
X-Storefront-Renderer-Rendered
X-Status
X-ShardId
X-PERF
X-ShopId
X-Shopify-Stage
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-Xfnlog-Site
X-ApacheServer
X-Varnish-Grace
X-TT-LOGID
Mn-Server-Ip
AMP-Access-Control-Allow-Source-Origin
X-Tec-Api-Version
X-Proxied
X-SRV
X-Routing-Service
X-Tec-Api-Root
X-Zipkin-Id
X-Tec-Api-Origin
Apigw-Requestid
X-Webkit-Csp
X-Rendered-As
X-Dc
X-Is-Bot
X-Amz-Meta-S3cmd-Attrs
X-Qloud-Router
X-Varnish-Server
X-Info
S-Cnection
X-FTR-Backend-Server
X-Via-CDN
X-FTR-Backend
X-FTR-Balancer
X-FTR-Cache-Status
X-FTR-DC
X-Country-Code-Real
X-FTR-Realm
X-GG-Cache-Date
X-Cache-Enabled
Cache-Hits
X-Content-Age
X-Microcachable
X-Proxy-Cache-Status
X-Cdn
Uber-Trace-Id
X-Platform
X-Detected-As
X-TA-CDN-Provider
X-Cache-Host
X-Azure-Ref
X-EdgeConnect-Cache-Status
X-Amzn-Remapped-Content-Length
X-Amzn-RequestId
X-CSRF-Token
X-Backend-Host
X-Amz-Apigw-Id
X-FTR-Expires
X-NWS-UUID-VERIFY
X-App-Version
X-Aspnetmvc-Version
X-Air-Hostname
X-CLOUD-TRACE-CONTEXT
Akamai-GRN
Tracecode
SD-X-WS
X-Time-Microsecs
X-ATG-Version
X-Oss-Storage-Class
X-Oss-Object-Type
HostName
X-Oss-Request-Id
X-Oss-Server-Time
X-Oss-Hash-Crc64ecma
X-Cache-Var-Map
X-Cache-Var
X-Trace-Id
X-ServerID
X-Backend-TTL
Amp-Access-Control-Allow-Source-Origin
ServedBy
X-Debug-Cache
X-CACHE-KEY
X-DynaTrace-JS-Agent
X-RCS-CacheZone
X-Tb
X-Cdn-Forward
X-BCube-Filmed-By
X-Varnish-Hostname
X-Cache-NGX
X-Cache-PHP
X-Unique-Id
Backend
X-Correlation-ID
X-B3-SpanId
X-Sucuri-ID
DSUID
DB-Nickname
X-TX-ID
X-CS
X-Fetched-On
X-PAYTM-SRV-ID
X-Cache-NE
Meta-Geo-Continent
X-Vtex-Processado-Em
Mobile-Detection-Method
X-VG-WebServer
X-Magnolia-Registration
X-Origin-TTL
X-Vdms-Version
X-SRCache-Key
Odigeo-Trace-Id
X-VG-WebCache
X-Origin-CC
X-From
Expiry
X-Level-Front-Cache
Xc-Version
Fastcgi-X-Cache-Version
DCR-Processing-Time-Ms
DCR-Decision-By
BehaviorPad-Version
X-Generation-Time
X-Generated-On
X-Location
Instruction
Machine
MD5-Digest
X-NAPM-TraceId
X-CF-Lambda-Version
X-PBS-Appsvrname
X-CF-Lambda-Fn
X-Ms-Version
X-Ms-Request-Id
X-Vtex-Remote-Cache
X-Owner
X-S
X-A-Dgt
X-A-Dcw
X-A-Dam
X-Trv-Group
X-A-Wwc
X-Rojux
X-Aed
SR-User-Adfree
X-Request-UUID
X-GEO
X-Vdms-Path
X-GeoIP-City
X-S-Cookie
X-Destination
X-Session-Fingerprint
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Thinkindot-Control
X-D
X-A
T-Server
X-ScT
X-A-Ccd
X-Thinkindot-L3
X-Application
X-Rewrite-Enabled
Path
X-B-Cookie
X-Processor
X-Device-Os
X-External-Request-Id
X-Connection-Hash
Release
X-ARC
Rendered-Blocks
X-Akamai-Transformed
X-NewRelic-App-Data
X-Cache-Backend
X-Adobe-Source
Content-Disposition
UCS
X-Cms-Context
X-GeoIP
C-Via
Arc-Version
CacheControlHeader
Pagetype
Cf-Device-Type
X-Geo-Header
X-Bip
X-FC-Vary-Parameters
NGX
PB-RID
X-Cache-Bucket
Server-Host
Host-ID
Gh-Request-Id
X-Azure-Ref-OriginShield
On-Server
X-Core-Value
PB-PID
Fastly-Backend-Name
X-Fastly-Cache
X-Node-Id
X-Thanos
X-Micro-Cache
X-Tumblr-Pixel-3
X-JWT-State
X-Irp-Debug
X-Is-Gdpr
X-SVT-ORM-VERSION
X-Mvc-Supplant-Cachable
X-OVcl-Cache
X-Reqid
X-OVcl
X-Skip-Cache
X-SVT-ORM-RULES
X-Varnish-Cache-Hits
X-HS-Content-Campaign-Id
X-TrackingId
X-Has-Esi
AKAMAI
X-VServer
User-Cache-Control
X-Scheme
Ssr
X-Cache-Id
X-Developer
X-WADP-Cache
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Cache-Tags
X-Developers
X-Request-Host
X-DPWN-IS-SECURE
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-Envoy-Decorator-Operation
X-Dispatcher-Server
Server-Ext
X-DefHash
Server-Hostname
X-Cache-Info
Sever-Int
X-DefElseHash
X-Varnish-CookieHashed-On
X-Csrf-Jwt
X-CUA
X-Varnish-Beresp-Grace
X-Varnish-CookieINHashed-On
X-Branch-Name
X-VarnishDD-TTL
X-Backend-State
X-Clientip
X-Block-Status
X-Variation
X-Var-Ttl
Wxu-Next-Hostname
Wxu-Next-Commit
Web-Mar-Node
X-Varnish-Remaining-TTL
Wxu-Next-Region
X-Swa-Ws
X-User
X-Clara-WADP
X-Esi-Check
X-CGP
V-Age
X-B3-Traceid
X-Li-Pop
X-Generated-By
X-Li-Fabric
X-Generated-In
X-IP
Fastly-SIE
Fastly-SWR
HA-Ipaddr
X-Eu-Site
X-LI-UUID
X-Gen-Mode
X-Hnp-Log
X-HN
CDCHOST
CDN-Cache
Adler-Geo
Cache-Host
X-Gzip
CDN-CachedAt
CDN-EdgeStorageId
CDN-Uid
CDN-RequestId
CDN-RequestCountryCode
CDN-PullZone
X-Matched-Rule
Ha-Gx-Prefs
X-Platform-Server
X-NU-AKA-ACS-Version
X-Policy
X-Ratelimit-Reset
X-Fastly-Backend
X-Old-Content-Length
X-Origin-Expires
X-Origin-Response-Time
X-Origin
PFcat
X-GoCache-CacheStatus
Platform
L5d-Success-Class
X-Fmm-Version
Is-Eu
Lfy
Location
X-Nginx-Cache-Key
Magicmarker
Locid
NM-Fastcgi-Cache
X-Varnish-Hits
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
X-Slack-Backend
X-Gamma-Serve
X-LB-ID
X-Method
X-VG-TLSProxy
X-Hash
X-SIPLIST1
X-Request-URI
X-Cache-Debug
X-Cache-Expires
Cf-Bgj
X-EC-Lua
Vix-Hermes-Req-Id
IsBot
Rt-Fastcgi-Cache
CloudFront-Viewer-Country
True-Client-Country-4JS
L
Sid
X-ID
X-APP-VERSION
X-Nc
Apple-News-Services-Host
Apple-News-Services-Handled
X-Cdn-Origin
X-Goog-Meta-Goog-Reserved-File-Mtime
Apple-News-Services-Parsed-Url
Fastly-Drupal-HTML
X-Loc
X-Kinja-Server-Push
Apple-News-Services-Request-Url
X-Sn-Servicetimems
Origin
X-Unique-ID
Pramga
X-Mvc-Supplant-OutputCached
X-Via-Popv
Esi-Enabled
X-Via-Popn
X-Servername
X-PF-Uncompressing
X-NCache
X-Via-Poph
X-Cache-Date
X-Aicache-OS
Geo-Info
Who
Country-Code
X-Core-Mission
X-Refresh
X-Varnish-Url
Tcn
X-Erf-Stays-Bingo-Pdp-Web
Pics-Label
X-Request-Start
Url
X-Epic-Correlation-Id
X-Tb-Optimization-Total-Bytes-Saved
X-FireWall-Protection
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
X-TraceId
Req-Svc-Chain
X-NC
X-Cache-Remote
Filterid
X-Dynatrace
X-Varnish-Cacheable
X-Response-By
S-Rt
X-Proxy-Cachei7
Cmsid
Source
Cmstype
X-RateLimit-Limit
Xkeyi7
X-Error
X-BBXSRF
X-HS-Status
GeoIp-Country-Code
Geoip-Latitude
X-Served-From
Svr
Kp-EeAlive
Content-Secure-Policy
X-HostName
N-Cache
X-Webkit-CSP-Report-Only
X-B3-Spanid
X-DC
VivaBuild
A
Cache-Key
Viewtype
HitType
X-Host-Name
X-Srv
X-Vcl-Version
X-Cache-2
Server-Ttl
Cross-Origin-Window-Policy
X-Sucuri-Cache
X-LiteSpeed-Cache-Control
Cteonnt-Length
X-Varnish-Authentication
Ohc-File-Size
NGB
M-TraceId
D-Cc-Upstream
MIME-Version
X-Cc-Via
X-Cache-ASPX
X-Cc-Req-Id
X-Contensis-Viewer-Groups
X-URL
X-Air-Source
X-Li-Proto
X-Servedbyhost
X-Wa
TDXMobile
X-Svr
Cross-Origin-Opener-Policy
Arc-Country
X-Oracle-Dms-Rid
NtCoent-Length
X-Vgn-Hpd-Reason
Server-ID
X-Server-IP
X-Esi
X-CDN-Forward
CACHE
X-Geo
X-Gdpr
X-FPC
X-Origin-Time
X-Cache-Config
X-Nyt-Route
X-ServedByHost
X-LI-Proto
X-WA
X-RAMCache
X-Vc
X-API-Version
X-Cs
X-HOST
X-Check-Cacheable
X-Viewer-Country
X-NGENIX-Cache
X-PHP-Backend
X-SaId
X-VC
Request-ID
SID
Resin-Trace
DataCenter
X-SN
X-Service
X-JoinUs
Server-Id
X-Edge-Location
X-UA
X-Hcs-Proxy-Type
X-RPS
X-RPM
X-DW
X-Internal-Host
X-VCL-Version
X-DB
X-DI
X-DSS
Cache-Provider
X-Webstats-RespID
X-SB
X-Newrelic-Synthetics
Mime-Version
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-TIM-N
X-NodeID
X-RSL
Hostname
Ohc-Cache-HIT
GeoIP-Latitude
Srv
X-Via-NSCOPI
FSS-Cache
X-SD-PageType
X-Extlb
X-Forwarded-Site
GeoIP-Country-Code
CF-Cached-On
X-NGINX-Cache
XServer
X-Bc-Bl
ProcessTime
X-Render-Time
X-App
X-Action
X-BBC-Edge-Cache-Status
X-FTR-Cache-Host
X-Proxy-Upstream
X-Fpc
Memcached
Surrogated-Key
X-PJAX-URL
EpKe-Alive
X-Oss-Cdn-Auth
X-Accel-Expires-Debug
X-Date
We-Hiring
X-Depends-On
Mail-Subject
X-CF-Powered-By
Upgrade-Insecure-Requests
X-VC-Cache
X-Req
X-Region-Sid
LB
X-Swift-Error
X-Provided-By
X-Dynatrace-Js-Agent
X-ZONE
X-Ua
X-UnsetCookies
X-FORWARDED-FOR
X-RateLimit-Remaining-Second
X-Worker
Env
X-RateLimit-Limit-Second
Processtime
X-APP
W
X-Auto-Login
X-Cdn-Request-ID
X-HITS
Time
X-CSRF-TOKEN
X-MSEdge-Features
X-Sigma-Backend
X-Sigma
X-Air-Trace-Id
Proxy-Connection
X-Fastly-Backend-Reqs
X-BACKEND-TTL
X-Rocket-Build-Number
CDN
X-MSEdge-Flight
X-Men
X-Dw-Trace-Id
X-Ftr-Cache-Host
Cdn
X-Cluster-Node
Memory
X-TIME
X-Akamai-Pragma-Client-IP
X-CACHE-AGE
X-Client-Ip
CPC-Age
X-BBC-Origin-Response-Status
X-Flog
CPC-Cache
VNS-Age
X-ABtesting
X-Hello
X-Fastly-Request-Id
Datacenter
X-IN-APIGATEWAY
X-Parent-Response-Time
X-Cache-Tag
VNS-Cache
PICS-Label
X-IN-APIGATEWAYSSL
Dnion-Transfer-Encoding
X-Presslabs-Stats
Media-Length
X-Acquia-Application-UUID
X-Pad
X-Acquia-Application-Trace
X-Oracle-DMS-ECID
X-Acquia-Site
X-Pf-Uncompressing
X-Acquia-Purge-Tags
Vha6-Origin
X-Zone
X-Via-PopV
X-LiteSpeed-Tag
Epwk-X-Cache
X-Via-PopH
X-Via-PopN
OT-Force-Account-Verify
Cf-Ipcountry
X-ServerName
State
X-Request-Url
X-Varnish-URL
X-ElasticPress-Query
X-Request-URL
X-Vcache
X-Akamai-ERRuleID
X-ND-Cache
WZWS-RAY
X-Csrf-Token
X-Akamai-ERPolicy
X-Varnish-Beresp-TTL
My-App
X-Snapshot-Date
X-Ms-Meta-Staticbatchstarttime
X-Lb-Id
Xet-Cookie
X-Ms-Meta-Originalurl
X-MiniProfiler-Ids
Fastcgi-Cache-TTL
X-ElasticPress-Search
CountryCode
Content-Script-Type
X-Amz-Meta-Cb-Modifiedtime
Content-Style-Type
X-Litespeed-Cache-Control
X-Storefront-Renderer-Verified
URI
X-Traceid
X-Redis-Duration-Ms
X-Redis-Count
X-C
Environment
NnCoection
X-B3-Parentspanid
X-Debug-Cache-Store
Inserted-Into-Cache-At
X-Debug-Cache-Fetch
Ohc-Response-Time
Phost
X-Tid