Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
CF-RAY
Cf-Request-Id
CF-Cache-Status
Last-Modified
X-XSS-Protection
Accept-Ranges
Link
Pragma
Expect-CT
ETag
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Cache-Status
X-Generator
X-Request-ID
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Content-Security-Policy
Content-Encoding
X-CDN
X-Envoy-Upstream-Service-Time
Status
X-Ua-Compatible
Feature-Policy
Access-Control-Expose-Headers
X-AspNetMvc-Version
X-Drupal-Dynamic-Cache
Access-Control-Max-Age
X-Via
Upgrade
Keep-Alive
X-Ws-Request-Id
X-Age
X-Turbo-Charged-By
X-AH-Environment
X-Robots-Tag
Request-Context
X-Proxy-Cache
EagleId
X-Cache-Group
X-Backend
Server-Timing
X-Hacker
X-Amz-Request-Id
Report-To
X-Server
Host-Header
X-Amz-Id-2
X-Server-Powered-By
X-UA-Device
Grace
X-Nginx-Cache-Status
X-LiteSpeed-Cache
X-Dns-Prefetch-Control
X-Varnish-Cache
X-Rq
Ali-Swift-Global-Savetime
X-Swift-SaveTime
X-Swift-CacheTime
X-Page-Speed
Cf-Railgun
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
NEL
X-Amz-Version-Id
X-OneAgent-JS-Injection
Xkey
X-WebKit-CSP
Allow
X-Cache-Spec
X-Backend-Server
X-Host
X-Vhost
X-CST
X-Device
EagleEye-TraceId
X-Server-Id
Surrogate-Control
Request-Id
X-Dispatcher
Accept-CH
X-Node
X-Kinja-Server-Push
Content-Location
X-Response-Time
Accept-CH-Lifetime
X-Akam-SW-Version
X-Ruxit-JS-Agent
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-ASPNET-VERSION
X-Template
X-Language
X-Ac
X-Application-Context
X-Country
X-Readtime
X-Cloud-Trace-Context
X-Cache-Lookup
X-Mod-Pagespeed
MS-Author-Via
X-Origin-Cache
X-B3-TraceId
Rating
X-MS-InvokeApp
X-Cnection
X-HW
X-ORACLE-DMS-ECID
X-Url
X-TtlSet
X-PC
X-Vname
Accept-Ch
X-ESI
X-Clacks-Overhead
Edge-Control
X-GitHub-Request-Id
X-FastCGI-Cache
X-Trace
Accept-Ch-Lifetime
Pagespeed
Display
X-Sol
Response
X-Middleton-Response
X-Middleton-Display
X-Content-Type
X-Buckets
X-D2id
Verso
X-Kinja-Build
X-Use-Magma
X-Kinja-Revision
X-Kinja-Server
X-GoogleNews-Bot
X-Exp-Id
X-Exp-Variant
X-Cdn-Fetch
X-Kinja
Arr-Disable-Session-Affinity
X-Vcap-Request-Id
X-Goog-Hash
X-Varnish-TTL
X-Server-Name
X-Rack-Cache
X-Country-Code
Service-Worker-Allowed
X-Navigation-Version
X-VARITI-CCR
X-Abt-Application-Version
X-Amz-Rid
X-ORACLE-DMS-RID
X-Oneagent-Js-Injection
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
X-Client-IP
X-Cache-TTL
X-Powered-By-Plesk
SPRequestGuid
X-SharePointHealthScore
X-TTL
SPRequestDuration
SPIisLatency
X-Fastly-Request-ID
X-Release
X-MSEdge-Ref
X-Dw-Request-Base-Id
X-Element-Page-Cache
Fastly-Restarts
X-Cached
X-NF-Request-ID
X-B3-TraceId-Primal
Mrf-Cache-Status
MRF-Tech
Public-Key-Pins
RTSS
X-Origin-Upstream-Status
AR-PoweredBy
AR-Request-ID
AR-ATIME
X-Edge
AR-CACHE
Ar-Sid
X-Px
Access-Control-Request-Method
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Webkit-CSP
X-LLID
X-Powered-CMS
Fusion-Component-Id
Fusion-Content-Id
Fusion-Deployment-Id
Fusion-Template-Id
Fusion-Source
Fusion-Content-Source
X-Upstream
X-Ezoic-Cdn
Content-MD5
X-Pinterest-Direct
X-HP-Webp
X-Jurisdiction
X-Amz-Server-Side-Encryption
X-ECACHE
X-Mid
X-MCACHE
Charset
X-Content-Digest
X-Recruiting
S
X-Mg-S
X-Ttl
Cache-Tag
X-PressLabs-Stats
X-Aspnetmvc-Version
X-Version
MicrosoftSharePointTeamServices
TCN
X-Debug
Front-End-Https
Fastcgi-Cache
X-Content-Security-Policy-Report-Only
X-Grace
X-T
Filters
X-Kinsta-Cache
Cache-Tags
Server-Node
X-XRDS-Location
Edge-Cache-Tag
X-Id
X-Forwarded-Proto
X-Yandex-Sdch-Disable
X-Cache-Key
X-Accel-Expires
X-Amzn-Trace-Id
X-Logged-In
Server-Name
X-Forwarded-For
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
Nginx-Cache
X-Varnish-Age
Surrogate-Key
Powered-By-ChinaCache
X-Correlation-Id
X-DynaTrace
X-B3-Sampled
X-Hits
TP-Cache
TP-L2-Cache
X-Ser
X-Microsite
X-Request-Handler-Origin-Region
X-DIS-Request-ID
X-Request-Processing-Time
X-Request-Received
X-Shield-Request-Id
X-Az
X-Activity-Id
X-AppVersion
X-Amz-Replication-Status
X-Server-ID
X-F-Cache
X-HS-Hub-Id
X-HS-Content-Id
X-HS-Combine-CSS
X-HS-Cache-Config
X-FTR-Request-ID
X-Goog-Generation
Accept-Charset
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Metageneration
X-Git-Hash
X-Origin-Server
X-Hostname
X-Respond-Thread
X-Geo-Country
X-LB-Cache
X-DataDome
Section-Io-Cache
X-Upgrade-Enabled
X-Rid
X-Frontend
X-Cache-Age
Access-Control-Allow-Method
X-Mobile-URL
Host
Cleartype
Alternate-Protocol
X-Type
Healthy
Paypal-Debug-Id
MS-CV
ServerID
Cache
X-Content-Options
X-IPLB-Instance
X-Ruxit-Js-Agent
X-WebKit-CSP-Report-Only
X-AOL-HN
Payment
X-Whom
X-Varnish-Backend
X-App-Environment
X-Route-Name
X-Signature
X-TT
X-Request-Guid
X-Flags
X-B-Cache
X-Aspnet-Duration-Ms
X-Debug-Info
X-VCache
X-Is-Crawler
X-Providence-Cookie
X-Cache-Action
X-Seen-By
X-XRDS-LOCATION
Fastcgi-Useragent
X-Page-Id
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-Jobs
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Mobile
X-N
X-Source
X-NWS-LOG-UUID
X-RateLimit-Remaining
X-Load-Cache
X-Time
X-Browser-Type
X-Cached-By
X-Via-JSL
X-Akamai-Edgescape
Version
X-FB-Debug
Nel
X-Cache-Rule
X-Daa-Tunnel
Viewport
DynaTrace
X-Cache-Operation
X-Litespeed-Cache
X-Rule
X-Accel-Buffering
X-Original-Request-Id
Refresh
X-Response-Served-From
X-Zen-Fury
X-Drupal-Cache-Tags
X-Proxy
X-Framework
DC
Realpath
X-RemovedCookies
X-Instance
X-ProcessESI
GEO-INFO
Referer-Policy
X-Tt-Trace-Host
X-Cacheable-TTL
X-Tt-Trace-Tag
Ms-Operation-Id
X-Region
X-RTag
X-Fastcgi-Cache
X-Real-IP
Access-Control-Request-Headers
X-Cache-Time
X-UUID
X-HTML-Minification-Powered-By
X-Contextid
X-FW-Hash
X-FW-Dynamic
X-FW-Server
X-FW-Serve
X-Page-View
X-Yottaa-Metrics
X-Distributor
X-Environment-Context
X-Drupal-Cache-Contexts
X-L-Path
X-Yottaa-Optimizations
X-FW-Type
X-FW-Static
VIX-Pulpo-Upstream-Status
X-Node-Name
X-Cache-Expired-At
Eomportal-Instance
VIX-Pulpo-Node
X-Wix-Request-Id
X-B
Liferay-Portal
Node
X-Cluster-Name
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-G
X-Tumblr-User
Countrycode
X-Cache-Control
X-Content-Powered-By
X-IPS-LoggedIn
X-Cache-Hit
X-Amz-Meta-S3cmd-Attrs
X-User-Agent
Webserver
X-Ratelimit-Limit
X-Tumblr-Pixel-2
Section-Origin-Responded
Section-Io-Origin-Status
Section-Io-Id
Section-Io-Origin-Time-Seconds
SRV
Server-Info
Protected
From-Origin
X-App-Server
X-Pass-Why
X-Revision
X-Protected-By
Ec-Rule-Version
X-FireWall-Port
X-Cache-Server
X-Backend-Name
Cache-Status
Frame-Options
X-Oracle-Dms-Rid
X-Hyper-Cache
X-ES-SERVER
X-Handled-By
X-UPSTREAM-Address
X-Hl-Ver
Meta-Geo
X-Mode
X-RN-RSRV
Retry-After
X-Endurance-Cache-Level
X-Locale
X-Forwarded-Host
X-Site-Version
X-NYM-Debug-Backend
X-Storage
X-FB-TRIP-ID
X-Adobe-Loc
CF-IPCountry
X-Www-Served-By
X-Adobe-Content
X-Soup
TWC-Privacy
Decoy-Debug-Status
Decoy-Debug-TTL
Decoy-Debug-Key
Country
Cache-Tv-Group
Fastly-SSL
Property-Id
X-Section
X-Pubstack
X-Origin-Hint
X-Human
TWC-Connection-Speed
X-Varnishpool
Webcakes-Region
X-Access
Webcakes-App-Version
Webcakes-App-Name
TWC-GeoIP-LatLong
X-Be
X-Cache-Grace
X-Format
TWC-Device-Class
X-Web-Node
TWC-Locale-Group
X-Via-CDN
TWC-GeoIP-Country
X-PERF
X-PHP-Host
X-Proto
X-Proxy-Build
X-PCL
X-Timing-Wait
X-Uri
Azure-SiteName
X-UA-Device-Type
X-TT-LOGID
X-ProxyCache-Key
X-ProxyCache-Status
Azure-SlotName
X-Redis-Cache
Azure-InstanceId
Azure-RegionName
Azure-Version
X-Say-Cacheable
Cache-Name
X-SayCDN-TTL
X-Say-TTL
X-Origin-Date
X-ApacheServer
Selected-Fe
X-Labrador-Cache-Channel
X-FW-Version
X-BYPASS-REASON
X-OCL
X-FTR-Cache-Status
X-AIR-PT
X-WA-Info
X-Sql-Count
X-LAGOON
X-FTR-Backend
X-Server-W
X-FTR-Backend-Server
X-Varnish-Ttl
X-Sql-Duration-Ms
X-FTR-DC
X-No-Session
S-Cnection
X-Via-Fastly
X-FTR-Realm
X-FTR-Balancer
X-S-Maxage
X-Country-Code-Real
X-R9-Blue-Green-Version
X-Qloud-Router
X-Hosted-By
X-LJ-Flow-ID
X-Loop
X-AWS-Id
X-VWS-Id
Mn-Server-Ip
X-TNCMS
X-Status
X-Cache-TTL-Remaining
X-Request-Time
X-Cluster
X-FTR-Expires
X-Proxied
Cache-Hits
X-ShopId
X-Storefront-Renderer-Rendered
X-Sorting-Hat-ShopId
X-Xfnlog-Site
X-Zipkin-Id
X-MP-GENERATED-AT
X-Sorting-Hat-PodId
X-CCM
X-ShardId
X-Shopify-Stage
X-Routing-Service
X-Alternate-Cache-Key
Xserver
X-Rendered-As
X-Is-Bot
X-Ratelimit-Remaining
X-Cache-Var
X-Cache-Var-Map
X-Dynatrace
X-Air-Hostname
X-Unique-Id
X-Tec-Api-Origin
X-Tec-Api-Version
AMP-Access-Control-Allow-Source-Origin
X-Detected-As
X-Tec-Api-Root
X-Cache-Host
X-Amzn-RequestId
X-Amzn-Remapped-Content-Length
X-EdgeConnect-Cache-Status
X-Amz-Apigw-Id
X-Device-Type
Apigw-Requestid
X-Info
X-Dc
X-Webkit-Csp
X-Nginx-Cache
X-Cdn
X-SRV
X-Microcachable
SD-X-WS
X-APP-VERSION
X-Cache-Enabled
X-B3-Traceid
X-GEO
X-Content-Age
X-Time-Microsecs
X-Cache-Backend
X-Correlation-ID
X-Debug-IsConnected
X-Debug-IsPreview
X-Varnish-Server
Tracecode
X-Backend-TTL
Amp-Access-Control-Allow-Source-Origin
X-Platform
X-Varnish-Grace
X-ServerID
X-Azure-Ref
X-Backend-Host
X-DynaTrace-JS-Agent
Uber-Trace-Id
DSUID
X-Erf-Stays-Bingo-Pdp-Web
X-GG-Cache-Date
X-Tb
X-Sucuri-ID
Akamai-GRN
X-Oss-Hash-Crc64ecma
X-Oss-Storage-Class
X-Oss-Server-Time
X-Oss-Request-Id
X-Oss-Object-Type
PB-PID
Arc-Version
PB-RID
X-BCube-Filmed-By
X-Proxy-Cache-Status
Backend
X-ATG-Version
X-NewRelic-App-Data
X-ID
X-Akamai-Transformed
X-Trace-Id
X-Origin-Response-Time
X-Magnolia-Registration
X-Device-Os
X-B-Cookie
X-Varnish-Cache-Hits
X-Vtex-Processado-Em
X-Cache-Remote
X-Vtex-Remote-Cache
X-Cache-NE
X-Application
X-VG-WebCache
X-A-Wwc
X-VG-WebServer
X-Aed
X-External-Request-Id
Thinkindot-Control
X-Destination
Expiry
X-CSRF-Token
Xc-Version
X-A-Ccd
DCR-Processing-Time-Ms
X-CF-Lambda-Fn
X-CF-Lambda-Version
Fastcgi-X-Cache-Version
X-ARC
X-Fetched-On
X-D
X-A-Dgt
X-Connection-Hash
X-A-Dam
X-A
X-A-Dcw
Instruction
X-Processor
DCR-Decision-By
ServedBy
Thinkindot-CacheControl-Type
Thinkindot-CacheControl
Mobile-Detection-Method
Meta-Geo-Continent
X-Rojux
X-Vdms-Version
X-Request-UUID
MD5-Digest
X-PBS-Appsvrname
X-PAYTM-SRV-ID
X-Level-Front-Cache
SR-User-Adfree
Pramga
X-Location
X-Matched-Rule
X-Origin-CC
X-Origin-TTL
Odigeo-Trace-Id
X-RCS-CacheZone
Path
T-Server
X-S
X-Rewrite-Enabled
X-SRCache-Key
Rendered-Blocks
X-Trv-Group
X-From
X-S-Cookie
X-Generated-On
Machine
X-Generation-Time
X-ScT
X-Thinkindot-L3
X-Session-Fingerprint
X-Vdms-Path
Lfy
X-Varnish-Hostname
X-Adobe-Source
X-Cache-PHP
X-Cache-NGX
PFcat
Host-ID
HA-Ipaddr
Ssr
Gh-Request-Id
Wxu-Next-Hostname
Magicmarker
Fastly-Backend-Name
Locid
Wxu-Next-Commit
L
Pagetype
L5d-Success-Class
Ha-Gx-Prefs
X-Geo-Header
X-Skip-Cache
X-Sn-Servicetimems
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Request-URI
X-Request-Start
X-OVcl
X-OVcl-Cache
X-Owner
X-Reqid
X-Swa-Ws
X-Thanos
X-Wikidot-Static-Cache
BehaviorPad-Version
Release
X-GeoIP-City
X-Wikidot-Backend
X-VServer
X-Tumblr-Pixel-3
X-User
X-VarnishDD-TTL
X-Node-Id
X-Mvc-Supplant-Cachable
X-Cdn-Origin
X-CGP
X-Csrf-Jwt
X-Developers
X-Cache-Info
X-Cache-Date
X-Backend-State
X-Bip
X-Cache-Bucket
X-Eu-Site
X-FC-Vary-Parameters
X-Irp-Debug
X-Is-Gdpr
X-JWT-State
X-Micro-Cache
X-HS-Content-Campaign-Id
X-HN
X-Generated-In
X-GeoIP
X-Has-Esi
X-Azure-Ref-OriginShield
Wxu-Next-Region
C-Via
Cache-Host
AKAMAI
Cf-Device-Type
CACHE
DB-Nickname
CacheControlHeader
X-Ms-Version
X-Ms-Request-Id
Rt-Fastcgi-Cache
X-Cache-Tags
Server-Ext
Server-Host
Server-Hostname
X-NWS-UUID-VERIFY
X-Fastly-Backend
On-Server
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
Apple-News-Services-Handled
Sever-Int
X-Scheme
X-Varnish-Hits
X-Nginx-Cache-Key
X-Request-Host
X-NC
UCS
X-Generated-By
X-Origin-Expires
X-Method
V-Age
X-Var-Ttl
Apple-News-Services-Request-Url
X-Fastly-Cache
X-Core-Value
CDCHOST
X-IP
Cf-Bgj
X-Developer
X-CUA
CloudFront-Viewer-Country
X-Cms-Context
X-Envoy-Decorator-Operation
Content-Disposition
User-Cache-Control
X-Clientip
NGX
X-Policy
X-Varnish-Beresp-Grace
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
X-Block-Status
X-Hnp-Log
X-Fmm-Version
X-Dispatcher-Server
X-DPWN-IS-SECURE
Fastly-SIE
X-Branch-Name
X-WADP-Cache
X-Gen-Mode
X-DefHash
X-Variation
X-TX-ID
X-Li-Fabric
X-VG-TLSProxy
X-B3-Spanid
X-GoCache-CacheStatus
X-Li-Pop
X-DefElseHash
X-Cache-Debug
X-LI-UUID
X-Cache-Expires
X-Clara-WADP
X-Cache-Id
X-Loc
X-Host-Name
IsBot
Is-Eu
Adler-Geo
X-Ratelimit-Reset
X-Old-Content-Length
X-Origin
X-Gzip
X-Platform-Server
X-Rebelmouse-Surrogate-Control
X-Varnish-CookieHashed-On
Origin
Location
Platform
NM-Fastcgi-Cache
X-NU-AKA-ACS-Version
X-Rebelmouse-Cache-Control
X-Esi-Check
X-SIPLIST1
X-Debug-Cache
Web-Mar-Node
X-TrackingId
True-Client-Country-4JS
Fastly-SWR
X-Servername
Vix-Hermes-Req-Id
X-Varnish-Url
CDN-RequestCountryCode
CDN-Cache
CDN-CachedAt
CDN-PullZone
CDN-EdgeStorageId
Fastly-Drupal-HTML
X-Gamma-Serve
X-Slack-Backend
X-NCache
CDN-Uid
X-Hash
X-Goog-Meta-Goog-Reserved-File-Mtime
CDN-RequestId
X-Varnish-Beresp-Status
HostName
X-Varnish-Beresp-Ttl
X-Response-By
X-NAPM-TraceId
Url
X-PF-Uncompressing
X-Refresh
X-Varnish-Cacheable
S-Rt
X-Core-Mission
X-CS
Xkeyi7
X-Proxy-Cachei7
Pics-Label
X-Aicache-OS
X-Mvc-Supplant-OutputCached
X-EC-Lua
X-CDN-Forward
Content-Secure-Policy
Cross-Origin-Window-Policy
X-Sucuri-Cache
N-Cache
X-App-Version
X-CACHE-GROUP
X-URL
X-BBXSRF
X-Cache-2
X-Cdn-Forward
Sid
X-FireWall-Protection
X-B3-SpanId
Ohc-File-Size
Cteonnt-Length
X-Cc-Req-Id
X-Varnish-Authentication
X-Cc-Via
X-Cache-ASPX
D-Cc-Upstream
X-Contensis-Viewer-Groups
X-LB-ID
X-Srv
X-Servedbyhost
X-Wa
Esi-Enabled
X-Via-Popn
X-Tb-Optimization-Total-Bytes-Saved
X-Via-Popv
X-Via-Poph
X-Svr
MIME-Version
X-Cs
X-TA-CDN-Provider
X-Server-IP
X-Error
X-DC
Source
X-Epic-Correlation-Id
X-FPC
Geoip-Latitude
X-Gdpr
X-Cache-Config
X-Origin-Time
X-TIME
GeoIp-Country-Code
X-API-Version
X-Nyt-Route
X-Unique-ID
X-Webkit-CSP-Report-Only
X-TraceId
Who
X-Nc
Hostname
X-VC
XServer
X-SN
Req-Svc-Chain
HitType
X-RateLimit-Limit
Ohc-Cache-HIT
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
X-Planisys-CDN-Cache
Server-Ttl
X-VCL-Version
Country-Code
X-Webstats-RespID
X-SB
X-LI-Proto
X-NodeID
X-Fastly-Request-Id
X-NGINX-Cache
X-LiteSpeed-Cache-Control
X-SD-PageType
Server-ID
X-HS-Status
X-Check-Cacheable
Geo-Info
X-Ua
Svr
Cmsid
X-Esi
Kp-EeAlive
Cmstype
NtCoent-Length
EpKe-Alive
VivaBuild
X-Viewer-Country
X-Render-Time
X-Served-From
Viewtype
X-Vgn-Hpd-Reason
SID
X-BBC-Edge-Cache-Status
X-HOST
X-Auto-Login
X-Worker
Cache-Key
Request-ID
X-Ftr-Cache-Host
X-RAMCache
A
X-Dynatrace-Js-Agent
X-UA
X-RSL
X-DB
X-RPS
X-RPM
X-DSS
Server-Id
X-DI
X-Hcs-Proxy-Type
X-CCDN-CacheTTL
X-DW
M-TraceId
Cache-Provider
X-Li-Proto
ProcessTime
Resin-Trace
X-CCDN-Origin-Time
X-TIM-N
X-Vcl-Version
X-CSRF-TOKEN
X-CACHE-KEY
Upgrade-Insecure-Requests
CDN
X-App
X-Cluster-Node
GeoIP-Country-Code
Cross-Origin-Opener-Policy
Arc-Country
X-CF-Powered-By
TDXMobile
GeoIP-Latitude
X-Air-Source
X-Newrelic-Synthetics
Processtime
X-Action
X-Internal-Host
X-FTR-Cache-Host
Tcn
Datacenter
Mime-Version
X-Fpc
X-Oss-Cdn-Auth
X-Vc
Filterid
OT-Force-Account-Verify
CF-Cached-On
X-CLOUD-TRACE-CONTEXT
X-Via-PopH
Srv
X-ServedByHost
X-WA
X-Via-PopN
X-Geo
X-BBC-Origin-Response-Status
X-Via-PopV
X-Service
X-FORWARDED-FOR
WZWS-RAY
X-HostName
X-HITS
X-MSEdge-Flight
X-Pinterest-Sli-Latency-Threshold
X-MSEdge-Features
Cdn
X-Flog
X-Hello
X-Pinterest-Sli-Response-Type
X-Dw-Trace-Id
X-Fastly-Backend-Reqs
Proxy-Connection
X-BACKEND-TTL
X-Cache-Tag
X-ND-Cache
X-Parent-Response-Time
X-ABtesting
X-Pinterest-Sli-Endpoint-Name
X-Lb-Id
DataCenter
X-Client-Ip
X-CACHE-AGE
X-Via-NSCOPI
NGB
Dnion-Transfer-Encoding
X-Forwarded-Site
X-IN-APIGATEWAYSSL
FSS-Cache
W
X-IN-APIGATEWAY
X-PHP-Backend
X-Cdn-Request-ID
X-JoinUs
X-SaId
Vha6-Origin
URI
Media-Length
PICS-Label
X-Oracle-DMS-ECID
X-Pf-Uncompressing
X-Extlb
X-Presslabs-Stats
X-Edge-Location
X-Acc-Debug-Context
CountryCode
X-Acc-Rdl
We-Hiring
X-Bc-Bl
X-RateLimit-Limit-Second
Surrogated-Key
X-RateLimit-Remaining-Second
X-UnsetCookies
X-Accel-Expires-Debug
X-Region-Sid
X-Req
X-PJAX-URL
Epwk-X-Cache
X-VC-Cache
X-Date
Memcached
X-LiteSpeed-Tag
Mail-Subject
X-Depends-On
X-Varnish-Beresp-TTL
X-Pad
X-Provided-By
X-Akamai-Pragma-Client-IP
X-Request-URL
Inserted-Into-Cache-At
X-MiniProfiler-Ids
X-ZONE
X-Akamai-Request-ID
X-NGENIX-Cache
Cf-Ipcountry
X-Acquia-Application-Trace
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Tid
X-Proxy-Upstream
X-Acquia-Site
X-Csrf-Token
X-Via-Edge
LB
X-B3-Parentspanid
X-Request-Url
X-Sigma-Backend
X-Vcache
Env
X-Swift-Error
X-Akamai-ERRuleID
X-Traceid
Content-Style-Type
Edge-Copy-Time
X-ElasticPress-Search
X-Rocket-Build-Number
X-Sigma
X-ElasticPress-Query
Content-Script-Type
X-Ms-Meta-Staticbatchstarttime
X-Via-SSL
X-Ms-Meta-Originalurl
X-Akamai-ERPolicy
X-APP
X-Varnish-URL
X-Zone
X-C
Environment
X-Redis-Count
X-Redis-Duration-Ms
X-Storefront-Renderer-Verified
X-ServerName
X-Litespeed-Cache-Control
Akamai-Age-Ms
X-Snapshot-Date
NnCoection
Time
X-Debug-Cache-Fetch
Memory
Ohc-Response-Time
Xet-Cookie
Phost
X-Debug-Cache-Store