Threat Level: green Handler on Duty: Rick Wanner

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
CF-RAY
X-XSS-Protection
Accept-Ranges
Expect-CT
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
X-Served-By
P3P
X-Xss-Protection
X-Request-Id
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
X-FRAME-OPTIONS
Access-Control-Allow-Credentials
X-AspNet-Version
Content-Security-Policy-Report-Only
P3p
X-Runtime
Accept-CH
X-DNS-Prefetch-Control
X-Cache-Status
Accept-CH-Lifetime
X-Drupal-Cache
X-Check
X-Ua-Compatible
X-Generator
Server-Timing
X-Cacheable
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-Iinfo
X-Drupal-Dynamic-Cache
Access-Control-Expose-Headers
X-Content-Security-Policy
Feature-Policy
Content-Encoding
X-CDN
Status
X-AspNetMvc-Version
Upgrade
X-Request-ID
Access-Control-Max-Age
X-Via
X-Amz-Request-Id
X-Amz-Id-2
CF-Ray
Host-Header
Cf-Edge-Cache
X-Backend
Allow
Request-Context
Keep-Alive
X-UA-Device
X-Robots-Tag
X-Server
X-Cache-Group
X-Hacker
X-AH-Environment
X-Turbo-Charged-By
X-Ws-Request-Id
X-Proxy-Cache
X-Age
Xkey
X-Rq
EagleId
X-Vhost
X-Dispatcher
X-Server-Powered-By
X-Amz-Version-Id
X-Varnish-Cache
Grace
Cf-Apo-Via
X-Page-Speed
X-Swift-SaveTime
X-Swift-CacheTime
X-Pingback
Cf-Railgun
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
Ali-Swift-Global-Savetime
X-Device
X-WebKit-CSP
EagleEye-TraceId
X-Dns-Prefetch-Control
X-Aws-Lambda-Call-Status
X-CST
X-OneAgent-JS-Injection
X-LiteSpeed-Cache
Permissions-Policy
X-Backend-Server
X-Server-Id
X-Litespeed-Cache
X-Readtime
X-Response-Time
X-Host
X-Akam-SW-Version
Request-Id
Surrogate-Control
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-HW
X-Nginx-Upstream-Cache-Status
X-Cache-Lookup
X-Cloud-Trace-Context
X-Node
X-Nginx-Cache-Status
X-Application-Context
X-Country-Code
Content-Location
X-Trace
X-Country
Service-Worker-Allowed
X-Ruxit-JS-Agent
X-Url
X-Content-Type
X-Clacks-Overhead
X-Oneagent-Js-Injection
X-Origin-Cache-Key
Accept-Ch-Lifetime
X-Edge
X-Rack-Cache
Cross-Origin-Opener-Policy
Cache-Tag
X-Amz-Server-Side-Encryption
X-FTR-Request-ID
X-Midtier
X-Mcache
X-Mod-Pagespeed
X-MS-InvokeApp
X-Vname
X-TtlSet
Nginx-Cache
X-PC
X-ECACHE
X-ESI
X-Upstream
X-Powered-By-Plesk
Rating
Edge-Control
X-Server-Name
X-Browser-Type
X-D2id
X-Cnection
X-Element-Page-Cache
Verso
X-Times
X-Cdn-Fetch
X-Exp-Id
X-Kinja
X-Kinja-Revision
X-Kinja-Build
X-Kinja-Server
X-GoogleNews-Bot
X-Exp-Variant
SPIisLatency
X-Ac
SPRequestDuration
X-Ruxit-Js-Agent
AR-PoweredBy
AR-SID
AR-Request-ID
AR-ATIME
X-B3-TraceId
X-NWS-LOG-UUID
X-SharePointHealthScore
SPRequestGuid
X-Ser
X-Navigation-Version
X-Abt-Application-Version
X-NF-Request-ID
X-GitHub-Request-Id
X-Vcap-Request-Id
X-Dw-Request-Base-Id
X-RateLimit-Remaining
AR-CACHE
Pinterest-Version
X-Ttl
Pinterest-Generated-By
X-Pinterest-Rid
X-Mg-S
X-VARITI-CCR
S
X-Client-IP
Pagespeed
X-Middleton-Display
Display
X-Sol
Edge-Cache-Tag
X-Cache-Key
RTSS
Fastly-Restarts
X-Amzn-Trace-Id
X-Amz-Rid
X-Cache-TTL
X-Powered-CMS
Cache-Status
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Kraken-Loop-Name
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kinsta-Cache
X-Edge-Location-Klb
X-Version
X-Goog-Hash
Access-Control-Request-Method
X-Server-ID
X-Recruiting
X-Erf-Stays-Pdp-Viaduct-Migration-Web-V2
X-Varnish-TTL
X-ARC
Response
X-Middleton-Response
X-Content-Digest
X-TraceId
X-Forwarded-For
Arr-Disable-Session-Affinity
X-T
Origin-Trial
X-Daa-Tunnel
X-MSEdge-Ref
Content-MD5
X-SRCache-Store-Status
MicrosoftSharePointTeamServices
X-SRCache-Fetch-Status
TP-Cache
X-Accel-Expires
Front-End-Https
X-Shield-Request-Id
Cross-Origin-Resource-Policy
X-Content-Security-Policy-Report-Only
X-Cached
X-Hits
Public-Key-Pins
X-Id
MS-Author-Via
X-FTR-Backend-Server
X-FTR-Backend
X-Country-Code-Real
X-FTR-Balancer
X-FTR-Cache-Status
X-Fastcgi-Cache
X-HS-Hub-Id
X-HS-Cache-Config
Server-Node
X-Ua-Browser
X-HS-Combine-CSS
X-HS-Content-Id
X-FTR-Expires
X-Forwarded-Proto
X-Request-Processing-Time
X-DIS-Request-ID
X-Request-Received
Payment
X-Frontend
X-Webkit-Csp
X-LLID
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
Realpath
X-Protected-By
TP-L2-Cache
X-GUploader-UploadID
X-ORACLE-DMS-RID
X-Distributor
X-FastCGI-Cache
X-LB-Cache
Cache-Tags
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Ratelimit-Limit
X-Origin-Server
X-Microsite
X-Request-Handler-Origin-Region
X-Kong-Upstream-Latency
X-RateLimit-Limit
X-Kong-Proxy-Latency
Referer-Policy
Mrf-Cache-Status
X-Page-Id
X-B3-TraceId-Primal
MRF-Tech
Count-Hit
X-Az
X-Hostname
X-AppVersion
X-Activity-Id
X-Debug-Info
X-NGENIX-Cache
X-Www-Served-By
Host
X-Cluster-Name
Fastcgi-Cache
X-Varnish-Server
X-Varnish-Backend
X-Correlation-Id
Accept-Charset
X-Envoy-Decorator-Operation
X-F-Cache
X-App-Server
X-Geo-Country
X-ORACLE-DMS-ECID
X-Ua-Device
X-XRDS-LOCATION
X-FB-Debug
X-PressLabs-Stats
X-Goog-Metageneration
Retry-After
X-Ezoic-Cdn
Access-Control-Allow-Method
X-Upgrade-Enabled
X-CSRF-Token
X-Git-Hash
X-Fastly-Request-Id
X-Load-Cache
X-TEC-API-ROOT
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-Seen-By
X-Content-Options
X-Varnish-Ttl
X-TTL
X-RateLimit-Reset
Server-Name
X-Px
Section-Io-Cache
X-Contextid
TCN
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-Request-Guid
X-Datadog-Trace-Id
X-Revision
X-Type
X-Oracle-Dms-Ecid
X-Tt-Trace-Tag
X-Trace-Id
X-Amz-Meta-S3cmd-Attrs
X-Tt-Trace-Host
X-Cache-Control
X-Grace
X-B
Cleartype
Paypal-Debug-Id
X-B3-Sampled
Healthy
X-TT
Charset
X-Whom
DC
X-Signature
X-Fb-Rlafr
X-B-Cache
X-Wix-Request-Id
X-App-Environment
X-Newrelic-App-Data
X-Node-Name
X-Origin-Cache
X-Proxy
Frame-Options
X-Mobile
Accept-Ch
X-Magnolia-Registration
X-Amz-Replication-Status
X-Azure-Ref
X-Rid
X-Oracle-Dms-Rid
X-Ratelimit-Remaining
X-Air-Pt
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Generation
X-Fastly-Request-ID
X-N
Filterid
X-WebKit-CSP-Report-Only
X-EdgeConnect-Cache-Status
X-WP-CF-Super-Cache
X-Logged-In
X-WP-CF-Super-Cache-Cache-Control
X-Language
X-Aspnet-Duration-Ms
X-Is-Crawler
X-Providence-Cookie
X-Route-Name
X-Flags
X-Kinja-CCPA
Content-Disposition
Akamai-GRN
Backend
NGB
X-Response-Served-From
X-Time
X-Original-Request-Id
X-Template
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-Rendered-As
X-Is-Bot
X-Unique-Id
Ms-Operation-Id
X-Tumblr-Pixel-1
X-Tumblr-User
Viewport
X-Cache-Age
X-Datadog-Sampled
X-Yottaa-Optimizations
X-ProcessESI
SD-X-WS
X-Varnish-Grace
X-RemovedCookies
X-Debug-IsConnected
X-RTag
X-Debug-IsPreview
X-Servername
Liferay-Portal
X-Yottaa-Metrics
X-Tumblr-Pixel-0
Upgrade-Insecure-Requests
X-Tumblr-Pixel
MS-CV
X-Adobe-Content
X-Adobe-Loc
X-Proxy-Cache-Info
X-FW-Type
X-FW-Version
X-IPS-LoggedIn
Refresh
X-Instance
X-NYM-Debug-Backend
X-Amzn-Remapped-Content-Length
X-FW-Static
X-FW-Server
X-Debug
X-FW-Dynamic
X-FW-Serve
X-FW-Hash
X-UUID
Fastly-SIE
X-App-Version
X-Region
X-CCDN-Origin-Time
X-Cacheable-TTL
Fastly-SWR
X-Cache-Grace
X-Environment-Context
X-Hcs-Proxy-Type
X-CCDN-CacheTTL
X-Hl-Ver
X-Backend-Name
X-L-Path
X-G
X-Via-JSL
X-User-Agent
From-Origin
X-Device-Type
X-Rule
X-Cache-Hit
X-Status
ServerID
Country
X-B3-SpanId
Url
X-VC-Cache
X-Jobs
X-Webkit-CSP
X-INCAP-ABP
Countrycode
WPO-Cache-Message
WPO-Cache-Status
Version
Alternate-Protocol
X-HTML-Minification-Powered-By
X-Cache-Status-Check
X-Source
X-Origin-CC
X-Air-Hostname
X-Air-Source
X-Air-Trace-Id
X-Origin-TTL
X-NODE
GEO-INFO
X-Page-View
Surrogate-Key
X-Akamai-Request-ID2
X-Nginx-Cache
CDN-RequestId
X-Hosted-By
X-Content-Powered-By
X-WP-CF-Super-Cache-Active
X-Storage
Amp-Access-Control-Allow-Source-Origin
X-B3-Traceid
SRV
X-Rocket-Nginx-Serving-Static
Protected
X-Tec-Api-Root
X-Tec-Api-Origin
X-Tec-Api-Version
X-Accel-Version
OT-Force-Account-Verify
X-Akamai-Edgescape
Access-Control-Request-Headers
X-VC
X-Real-IP
X-Edge-Location
X-CDN-Forward
X-Framework
AMP-Access-Control-Allow-Source-Origin
CF-IPCountry
X-ServerID
X-Mode
X-Cache-Time
X-Cache-Rule
X-Use-Mantle
Front
X-Rn-Rsrv
X-UPSTREAM-Address
X-Xfnlog-Site
X-Rewrite-Enabled
Meta-Geo
Accept-Language
Webserver
X-Cache-Operation
Filters
X-Http-Reason
X-Upstream-Ht
X-Upstream-Ct
X-Tumblr-Pixel-2
X-AWS-Id
X-Tumblr-Pixel-3
X-VWS-Id
X-Detected-As
X-Origin
Xet-Cookie
X-Timing-Wait
X-Cache-Debug
X-Soup
Section-Io-Id
X-Proxy-Build
Cross-Origin-Embedder-Policy
Mn-Server-Ip
Selected-Fe
ServedBy
X-Served-From
X-SaId
X-Handled-By
X-Director
X-Varnish-Cache-Hits
X-LJ-Flow-ID
X-JoinUs
TWC-GeoIP-LatLong
TWC-GeoIP-Country
X-Routing-Service
TWC-Device-Class
X-Say-Cacheable
X-Say-TTL
X-Endurance-Cache-Level
Web-Mar-Node
TWC-Privacy
TWC-Locale-Group
X-SayCDN-TTL
Apigw-Requestid
X-ProxyCache-Key
Node
X-Redis-Cache
X-Httpd
X-Restarts
Property-Id
TWC-Connection-Speed
X-Labrador-Cache-Channel
X-Lambda-Id
X-Logging-Id
Webcakes-App-Version
Webcakes-App-Name
X-Zipkin-Id
Xserver
X-Worker
X-Web-Node
X-PHP-Host
X-Cluster
X-Origin-Hint
X-Extlb
X-No-Session
X-Format
X-Cms-Context
X-BYPASS-REASON
X-Proxied
X-Adobe-Source
X-Vcache
Webcakes-Region
X-ProxyCache-Status
X-Locale
X-GeoCountry
X-Is-Mobile
X-IPLB-Request-ID
X-GeoCode
X-IPLB-Instance
X-Loop
X-Geo-Region
X-Is-Desktop
X-Browser-Name
X-Forwarded-Host
X-AB
X-Is-Tablet
X-Is-Supported-Browser
X-RM-Cache-TTL
X-Platform-Cluster
X-Skip-Cache
X-Site-Version
X-Platform-Router
X-Tcp-Rtt
X-Tncms
X-VCT
X-Varnish-Beresp-Grace
X-Varnish-Age
X-Drupal-Cache-Tags
X-S
X-Platform-Processor
Azure-Version
Azure-InstanceId
X-TT-LOGID
DB-Nickname
Azure-SlotName
Azure-SiteName
Azure-RegionName
X-RCS-CacheZone
X-Cache-Server
X-R9-Blue-Green-Version
X-Drupal-Cache-Contexts
X-Git-Commit
X-Webstats-RespID
X-Fetched-On
X-Vercel-Id
X-Generation-Time
X-Container-Uri
X-Cache-Host
X-Server-W
X-Tb
X-Reqid
X-Vercel-Cache
X-Frame-Option
X-Provided-By
X-Ms-Request-Id
X-Ms-Version
CDN-RequestPullSuccess
CDN-Uid
CDN-CachedAt
CDN-Cache
X-Storefront-Renderer-Rendered
CDN-EdgeStorageId
X-Shopify-Stage
CDN-RequestPullCode
X-Uri
CDN-RequestCountryCode
X-MP-GENERATED-AT
X-Alternate-Cache-Key
CDN-PullZone
X-Origin-Date
X-XRDS-Location
X-Sucuri-Cache
WP-Super-Cache
X-DynaTrace
X-Sorting-Hat-PodId
X-ShardId
X-ShopId
X-Sorting-Hat-ShopId
Fastcgi-Useragent
Cache-Tv-Group
Source
X-Sucuri-ID
X-Vcl-Version
X-Cdn-Origin
Cross-Origin-Embedder-Policy-Report-Only
Content-Secure-Policy
X-FB-TRIP-ID
X-Sql-Duration-Ms
X-Xrds-Location
X-Sql-Count
X-Generated-By
Priority
Atl-Traceid
Onion-Location
X-Pass-Why
X-Urbn-Context-Path
X-SRV
X-Urbn-Site-Id
Locale
X-Buckets
X-Content-Age
Sid
X-DataDome
Thinkindot-CacheControl-Type
Thinkindot-Control
X-Thinkindot-L3
X-CMSURLCustom
TDXMobile
Thinkindot-CacheControl
X-Scope-Id
X-Shield-Cache-Expires
Cross-Origin-Window-Policy
Cache
HostName
X-Cluster-Node
WZWS-RAY
X-Newrelic-Synthetics
X-LSADC-Cache
X-Varnish-Beresp-Ttl
X-Proxy-Cache-Status
S-Rt
X-WP-CF-Super-Cache-Cookies-Bypass
X-Cache-Action
X-Optimistic-Header
Edge-Copy-Time
X-TA-CDN-Provider
X-Via-Edge
X-Via-CDN
X-Cache-Expired-At
X-Via-SSL
X-GEO
User-Cache-Control
Expiry
X-Connection-Hash
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
X-BCube-Filmed-By
Apple-News-Services-Request-Url
X-Bl-Debug
X-Cache-NE
X-ScT
X-Rojux
A
X-Cache-Bucket
X-Request-Start
Apple-News-Services-Handled
X-S-Cookie
X-Scheme
X-PAYTM-SRV-ID
Origin
Origin-Agent-Cluster
Redirect-Candidate
Rendered-Blocks
Ngx.Var.Host
Ngx-Var-Key
MD5-Digest
Meta-Geo-Continent
X-A
Req-ID
X-Op-Id-All
Sslversion
Surrogated-Key
T-Server
Sever-Int
Server-Hostname
Vix-Hermes-Req-Id
Server-Ext
Server-Host
X-A-Ccd
Magicmarker
DCR-Decision-By
DCR-Processing-Time-Ms
X-Platform
X-Application
X-TIM-N
CDCHOST
X-Bc-Bl
X-B-Cookie
Gannett-Cam-Experience-Id
X-Section
X-A-Dgt
X-A-Dcw
X-A-Dam
Lang
X-A-Wwc
X-Aed
X-Access
L
Candidate-Md5Url
X-SB
X-Vdms-Path
X-Vdms-Version
X-Dispatcher-Server
X-Destination
X-Ua
X-Varnish-Hostname
X-D
X-Ec-Custom-Error
X-Ec-Fail
X-External-Request-Id
X-Vtex-Remote-Cache
X-Instance-Name
X-Viewer-Country
X-Correlation-ID
X-Ec-GeoHdr
X-Epic-Correlation-Id
X-Conf
X-Developer
X-SRCache-Key
Fastly-Drupal-HTML
X-Dc
X-TimeS
X-Human
Host-ID
X-VServer
X-Acquia-Purge-Cdn-Unconfigured
X-Gzip
X-Forwarded-Site
X-Hnp-Log
X-Node-Id
X-UA-Device-Type
X-Nginx-Cache-Key
Ssr
Fastly-SSL
DSUID
X-WA-Info
Type
X-Pool
Environment
X-NMSegId
X-GeoIP-Region-Code
Fastly-GeoIP-CountryCode
X-Amz-Meta-Cb-Modifiedtime
X-AK-Request-ID
X-Gdpr
Wxu-Next-Hostname
X-NCache
NM-Fastcgi-Cache
X-Gen-Mode
Req-Svc-Chain
Wxu-Next-Commit
Release
Pramga
X-Generated-On
X-Varnish-Beresp-Status
X-Varnishpool
X-We-Are-Hiring
V-Age
X-VG-WebCache
X-Nyt-Route
X-Varnish-Director
X-VG-TLSProxy
X-GeoIP-Country-Code
Wxu-Next-Region
X-Thanos
X-Origin-Time
X-TH-Server
Content-Style-Type
X-Debug-Cache-Fetch
X-Core-Value
X-Request-Time
X-Request-URI
X-Debug-Cache-Store
X-ND-Cache
Yak-Timeinfo
X-Branch-Name
X-Req
X-Azure-Ref-OriginShield
X-Rocket-Build-Number
X-Clientip
X-Sigma
X-Sigma-Backend
X-Moov-T
X-Mly-Id
X-Cache-TTL-Remaining
X-Loc
X-Cache-Id
X-Cache-Info
X-Level-Front-Cache
X-SD-PageType
X-Block-Status
X-Moov-Xdn-Version
X-Esi-Check
X-Pubstack
Cluster
Cache-Provider
X-B3-Trace-ID
X-Fastly-Cache
Cdnsip
Cdncip
X-BBC-Edge-Cache-Status
X-Proxied-Request
X-Bip
X-Auto-Login
X-Zen-Fury
Content-Script-Type
C-Via
X-Service
X-Origin-Response-Time
X-GeoIP
Uber-Trace-Id
X-Men
X-Micro-Cache
X-CGP
X-Geo-Header
X-GoCache-CacheStatus
X-FC-Vary-Parameters
X-Mvc-Supplant-Cachable
X-ApacheServer
X-GeoIP-City
X-Mvc-Supplant-OutputCached
X-Cache-Date
X-Device-Os
X-Cdn-Srv
X-DPWN-IS-SECURE
X-Cache-Aspx
X-Fmm-Version
X-From
X-Ad-Load-Variation
X-Aicache-OS
X-Eu-Site
W
X-HS-Content-Campaign-Id
We-Hiring
Web-Mar-Region
X-Csrf-Jwt
X-Contensis-Viewer-Groups
Tube-Return
Country-Code
Click-Count-Error
Canary
X-RateLimit-Limit-Second
Adler-Geo
X-Policy
Esi-Enabled
HA-Ipaddr
Ha-Gx-Prefs
Gh-Request-Id
X-PERF
X-RateLimit-Remaining-Second
X-Region-Sid
X-SVT-ORM-RULES
X-Amz-Storage-Class
X-VarnishDD-TTL
X-HN
PFcat
X-SVT-ORM-VERSION
X-Request-Host
X-Server-IP
Tube-Got-Results
Is-Eu
Click-Count-Action-Start
X-ECache
Producers
X-Mg-Request-UUID
On-Server
X-V-Cache
RNT-Machine
RNT-Time
Tube-Got-Eval
Tube-Get-Contents
True-Client-Country-4JS
X-Old-Content-Length
X-Org
Platform
Locid
Machine
X-Var-Ttl
Mail-Subject
X-Varnish-Authentication
L5d-Success-Class
X-VCache
X-Datadome
X-Sn-Servicetimems
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Fastly-Backend
X-App-Name
X-Hash
X-Slack-Shared-Secret-Outcome
X-Backend-Instance
X-Edge-Server
X-Slack-Backend
Cf-Device-Type
AKAMAI
Cache-Key
X-DC
Cdn-Request-Time
X-Up
X-Proto
Proxy-Firewall
Cdn-Host
X-Ratelimit-Reset
X-Test
X-Tx-Id
X-Irp-Debug
X-Ah-Environment
X-CacheTTL
X-Parent-Response-Time
XM
X-Accel-Expires-Debug
X-LB-ID
Pics-Label
X-Date
X-Lagoon
LB
X-Cache-Backend
X-Origin-Expires
X-COUNTRY
Fastly-Backend-Name
X-Servedbyhost
X-Varnish-Hits
NGX
X-Owner
X-API-Version
X-UA
X-DynaTrace-JS-Agent
IsBot
X-CACHE-GROUP
X-Via-Poph
X-SIPLIST1
X-ZONE
X-Tb-Optimization-Total-Bytes-Saved
X-Core-Mission
X-HA-Backend
X-Via-Popn
X-Via-Popv
Cdn
X-RID
X-Refresh
X-LB-NoCache
X-VHOST
Datacenter
X-Qloud-Router
NtCoent-Length
SID
RATING
X-Use-Magma
X-NGINX-Cache
Cdn-Requestid
X-Nc
N-Cache
X-Wa
Server-ID
GeoIp-Country-Code
X-CDN-Cache-Status
X-CF-Lambda-Version
Expect-Staple
X-CF-Lambda-Fn
X-Srv
X-Zone
Cache-Hits
X-Tenant
X-Orig-Expires
X-Cache-Type
X-Forwarded-Path
CloudFront-Viewer-Country
X-Via-Fastly
Xc-Version
X-Shop-Environment
X-Nananana
X-Presslabs-Stats
X-Fpc
Cmsid
Cmstype
X-Gamma-Serve
GeoIP-Latitude
Cross-Origin-Opener-Policy-Report-Only
X-Akamai-Transformed
X-Hit
X-Location
X-Ig-Origin-Region
CPC-Age
DataCenter
X-B3-Parentspanid
CPC-Cache
X-TX-ID
X-Nf-Request-Id
X-Cdn-Diag
X-Cloudmap
X-Proxy-CacheRZ
XkeyRZ
Uri
X-Vmg-Version
Fusion-Content-Id
Fusion-Source
Fusion-Template-Id
Resin-Trace
Fusion-Deployment-Id
Fusion-Content-Source
User-Agent
Fusion-Component-Id
X-Client-Ip
X-URL
X-CS
Powered-By
X-DataCenter
True-Client-Ip
Origin-CC
X-TIME
X-Info
X-Tt-Logid
X-Jungle-Id
X-CUA
Origin-EX
X-Amz-Meta-Opti
Tcn
X-Variation
X-NWS-UUID-VERIFY
Mime-Version
X-IAuth-Set-Uid
X-Fastly-Country-Code
X-User
MIME-Version
CacheControlHeader
X-NewRelic-App-Data
X-HostName
X-LAGOON
X-Datacenter
X-Segment-20210421
X-Cached-By
X-CACHE-AGE
X-Geo
True-Client-IP
Fastly-Drupal-Html
X-Dynatrace-Js-Agent
Srv
Cf-Ipcountry
X-Render-Time
Load-Balancing
X-Webkit-Csp-Report-Only
X-Cdn-Forward
X-B3-Spanid
CDN
VNS-Age
X-HOST
X-LiteSpeed-Tag
VNS-Cache
Debug
X-Vc
X-VTEX-Cache-Time
X-Powered-By-VTEX-Cache
X-VTEX-Cache-Server
X-Wormhole-Sdk
X-LiteSpeed-Cache-Control
X-Varnish-Beresp-TTL
X-AIR-PT
X-Auth-Group-Type
Lb
Ohc-File-Size
Edge-Cache
X-Api-Version
X-CSRF-TOKEN
X-Dispatch
Hostname
Cl-Cache
Ohc-Cache-HIT
X-Ig-Push-State
GeoIP-Country-Code
X-Dispatcher-Number
X-FPC
X-MCACHE
X-WA
X-Cdn-Cache-Status
Server-Id
X-NodeID
X-NC
X-Esi
Cache-Name
Odigeo-Trace-Id
X-Cs
X-Vgn-Hpd-Reason
X-APP-VERSION
X-Custom-Header
X-Lb-Nocache
X-Oracle-DMS-ECID
X-Litespeed-Tag
X-Mid
X-PHP-Backend
X-Depends
X-Pad
X-Cache-Ttl
CountryCode
X-Via-PopN
X-DefHash
X-Via-PopH
X-Fastly-Backend-Reqs
X-ServedByHost
X-Via-PopV
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
X-Ha-Backend
X-Varnish-CookieHashed-On
X-DefElseHash
X-Litespeed-Cache-Control
X-VCL-Version
Ms-Author-Via
X-Srcache-Store-Status
X-Srcache-Fetch-Status
X-Web-Server
X-MiniProfiler-Ids
X-M-Reqid
X-Akamai-Pragma-Client-IP
X-Cdn-Request-ID
X-MSEdge-Features
BehaviorPad-Version
X-Proxy-Cache-La3
Ngx
X-M-Log
X-Lb-Id
PICS-Label
X-RequestId
X-MSEdge-Flight
X-VC-TTL
Xkeylog
Xkey-La3
X-Cache-Enabled
X-IN-APIGATEWAY
X-Acquia-Site
X-Snapshot-Date
OriginIP
FSS-Cache
X-IN-APIGATEWAYSSL
Memcached
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Acquia-Application-Trace
Time
Memory
X-Cache-Version
X-Sorting-Hat-Podid
X-Shardid
X-Sorting-Hat-Shopid
X-Shopid
X-PDP-UNCACHING-HASH
X-Cache-FS-Status
Epwk-X-Cache
Warning
Location
X-Sucuri-Id
X-Th-Server
X-Wp-Cf-Super-Cache-Cookies-Bypass
CF-Cached-On
X-FL-EDGE
X-FL-QIT-DEBUG
YJS-ID
X-Lsadc-Cache
Geoip-Latitude
X-Udemy-Cache-App-Namespace
Srvid
X-Dw-Trace-Id
X-Mg-Cache
X-Service-Response-Time
X-Serial
Sm-Log-Id
X-Check-Cacheable
Server-Info
Akamai-Cache-Status