Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
X-Frame-Options
Strict-Transport-Security
X-Content-Type-Options
Accept-Ranges
Last-Modified
X-XSS-Protection
X-Powered-By
Pragma
CF-Cache-Status
CF-RAY
Link
ETag
Expect-CT
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
X-UA-Compatible
X-Cache-Hits
X-Amz-Cf-Pop
X-Amz-Cf-Id
Referrer-Policy
X-Served-By
X-Varnish
Alt-Svc
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Download-Options
X-Request-Id
X-AspNet-Version
Access-Control-Allow-Credentials
X-Runtime
X-Drupal-Cache
X-Adblock-Key
X-Check
X-Request-ID
X-Cache-Status
Content-Security-Policy-Report-Only
X-Generator
X-Permitted-Cross-Domain-Policies
X-Cacheable
X-Template
X-DNS-Prefetch-Control
X-Language
Timing-Allow-Origin
X-Iinfo
X-AspNetMvc-Version
X-FRAME-OPTIONS
X-Buckets
Status
X-Content-Security-Policy
Upgrade
Content-Encoding
X-CDN
Access-Control-Expose-Headers
Access-Control-Max-Age
X-Kinja-Server-Push
X-Xss-Protection
Keep-Alive
X-Turbo-Charged-By
X-Drupal-Dynamic-Cache
P3p
Xkey
X-Pass-Why
X-Cache-Group
X-AH-Environment
X-Envoy-Upstream-Service-Time
CF-Ray
X-Via
X-Backend
X-Server
X-Age
X-Amz-Request-Id
X-Amz-Id-2
X-Robots-Tag
X-Server-Powered-By
X-Page-Speed
X-Ws-Request-Id
X-Pingback
EagleId
X-Proxy-Cache
X-Hacker
X-Nginx-Cache-Status
X-UA-Device
Request-Context
X-Varnish-Cache
Feature-Policy
Server-Timing
Grace
Cf-Railgun
X-Ua-Compatible
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Amz-Version-Id
Report-To
X-LiteSpeed-Cache
X-Rq
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-WebKit-CSP
X-OneAgent-JS-Injection
X-Server-Id
X-Host
X-Device
X-Origin-Cache
EagleEye-TraceId
X-Response-Time
X-Node
X-Ac
Content-Location
Surrogate-Control
X-Vhost
X-Readtime
X-Cloud-Trace-Context
Request-Id
X-Backend-Server
X-Dns-Prefetch-Control
X-Dispatcher
X-Origin-Upstream-Status
X-Cnection
X-Application-Context
X-HW
X-ORACLE-DMS-ECID
X-Cache-Lookup
Fusion-Template-Id
Fusion-Content-Source
Fusion-Source
Fusion-Content-Id
Fusion-Component-Id
X-ORACLE-DMS-RID
X-DataDome
NEL
X-Ruxit-JS-Agent
X-Mod-Pagespeed
X-Rack-Cache
Rating
Edge-Control
X-Country
X-Clacks-Overhead
X-Akam-SW-Version
Pinterest-Generated-By
X-TTL
Allow
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Country-Code
X-DynaTrace
Accept-Ch
X-Instart-Request-ID
X-Varnish-TTL
X-FTR-Request-ID
X-Goog-Hash
X-PC
X-TtlSet
X-Vname
X-ESI
Verso
Accept-Ch-Lifetime
X-Powered-By-Plesk
Content-MD5
Service-Worker-Allowed
X-Url
X-B3-TraceId
X-Version
X-Forwarded-Proto
X-MS-InvokeApp
X-GoogleNews-Bot
X-Exp-Variant
X-Kinja
X-Cdn-Fetch
X-Exp-Id
X-Kinja-Server
X-Kinja-Build
X-Use-Magma
X-Kinja-Revision
X-GitHub-Request-Id
RTSS
Edge-Cache-Tag
X-Abt-Application-Version
X-D2id
Ar-Sid
X-Px
AR-Request-ID
AR-CACHE
AR-ATIME
AR-PoweredBy
X-Debug
X-Server-Name
X-Vcache
SPRequestGuid
X-Amz-Server-Side-Encryption
Charset
X-NF-Request-ID
X-Accel-Expires
X-Cached
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-TEC-API-ROOT
Response
X-Middleton-Response
Display
Pagespeed
X-Sol
X-Middleton-Display
X-Fastcgi-Cache
X-Vcap-Request-Id
X-MSEdge-Ref
Arr-Disable-Session-Affinity
X-Amz-Rid
TCN
X-Navigation-Version
X-Pinterest-Rid
Pinterest-Version
X-Powered-CMS
X-SharePointHealthScore
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Cdn
X-Trace
X-VARITI-CCR
Realpath
Public-Key-Pins
Cache-Tag
X-Client-IP
X-Fastly-Request-ID
X-Ser
Access-Control-Request-Method
MS-Author-Via
X-Server-ID
Nginx-Cache
S
X-DynaTrace-JS-Agent
X-Shard
X-Edge-O15-RID
SPIisLatency
SPRequestDuration
X-Upstream
X-Id
MRF-Tech
X-B3-TraceId-Primal
X-Mrf-Item-Lastmod
Mrf-Cache-Status
X-Mrf-Section-Lastmod
X-Ezoic-Cdn
X-Content-Type
X-Hp-Webp
X-Amzn-Trace-Id
X-Grace
X-Forwarded-For
X-T
X-Amz-Meta-S3cmd-Attrs
Nel
Front-End-Https
X-Recruiting
X-Hits
DynaTrace
Fastcgi-Cache
X-Aspnet-Version
X-Varnish-Age
X-Jurisdiction
ServerID
X-Cache-TTL
X-Node-Name
X-FTR-Cache-Status
MicrosoftSharePointTeamServices
X-FTR-Expires
X-Country-Code-Real
X-Dw-Request-Base-Id
X-DIS-Request-ID
X-Element-Page-Cache
X-Mobile-URL
X-Content-Digest
NR-ENABLED
X-FTR-DC
X-FTR-Backend-Server
X-FTR-Backend
X-FTR-Balancer
X-FTR-Realm
X-HS-Combine-CSS
X-HS-Content-Id
X-HS-Cache-Config
X-HS-Hub-Id
X-Goog-Metageneration
X-Goog-Storage-Class
X-GUploader-UploadID
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
Powered
X-Frontend
Server-Node
TP-L2-Cache
TP-Cache
Alternate-Protocol
X-Logged-In
Server-Name
X-XRDS-Location
X-Request-Processing-Time
X-Request-Received
AMP-Access-Control-Allow-Source-Origin
X-Correlation-Id
X-Request-Handler-Origin-Region
X-Amzn-RequestId
X-Microsite
X-CST
X-Amz-Apigw-Id
Upgrade-Insecure-Requests
X-ATS-Timestamp
Backend-Timing
X-Cache-Hit
X-Content-Options
X-Origin-Server
X-Page-Id
X-User-Agent
X-F-Cache
X-Content-Security-Policy-Report-Only
X-Akamai-Edgescape
Refresh
X-Rid
X-Varnish-Grace
X-Revision
X-Type
Fastly-Restarts
X-Zen-Fury
X-XRDS-LOCATION
X-Content-Powered-By
X-B3-Sampled
X-LB-Cache
X-B
X-Geo-Country
X-URL
X-FTR-Cache-Host
X-Activity-Id
X-AppVersion
X-Az
PB-RID
PB-PID
X-Mobile-Rewrite
Arc-Version
X-Shield-Request-Id
Cache-Status
X-N
X-Kinsta-Cache
X-Pad
X-Cache-Age
X-Instance
X-TT
X-Signature
X-B-Cache
X-WebKit-CSP-Report-Only
Access-Control-Allow-Method
X-AOL-HN
X-Time
X-Cache-Action
X-Request-Guid
X-Debug-Info
X-Jobs
X-Framework
Paypal-Debug-Id
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-User
X-FB-Debug
X-PHP-Backend
X-Webkit-Csp
X-App-Environment
X-Load-Cache
Actual-Object-TTL
DC
X-Webapp-Samesite-None-Activated-N
X-Git-Hash
X-Cached-By
Fastcgi-Useragent
X-Varnish-Backend
X-RateLimit-Remaining
X-Tt-Trace-Tag
X-Analytics
X-Tt-Trace-Host
Surrogate-Key
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
Host-Header
X-Amz-Replication-Status
X-IPLB-Instance
X-Contextid
MS-CV
X-ATG-Version
X-SS-Set-Cookie
X-WA-Info
FilterID
Tracecode
Host
X-Cluster
X-Host-Name
X-Response-Served-From
NGB
X-Accel-Buffering
X-Mobile
X-Kong-Upstream-Latency
WPE-Backend
X-Via-JSL
X-Kong-Proxy-Latency
Payment
X-Cache-NE
X-ORACLE-APMCS-TAG
X-ORACLE-APMCS-REQUEST-ID
X-FW-Serve
X-FW-Type
X-NWS-LOG-UUID
X-FW-Hash
X-FW-Static
X-FW-Server
Source
X-Hostname
X-Cache-2
X-Region
X-Varnish-Server
X-Cacheable-TTL
Xserver
Frame-Options
Eomportal-Instance
Cache-Tv-Group
X-GeoIP
X-Cache-Key
X-Cache-Rule
X-Cache-Operation
Filters
X-Rendered-As
X-Is-Bot
X-Origin-Response-Time
X-Srv
X-Varnish-Hostname
X-IPS-LoggedIn
X-Adobe-Content
X-Cache-Enabled
X-Tumblr-Pixel-2
X-Tumblr-Pixel-1
X-Adobe-Loc
X-RequestSource
X-TX-ID
X-Seen-By
X-Presslabs-Stats
X-NewRelic-App-Data
Retry-After
X-EdgeConnect-Cache-Status
X-FastCGI-Cache
Server-Info
Cleartype
X-VCache
X-Cache-TTL-Remaining
X-RemovedCookies
Accept-CH
X-ProcessESI
Liferay-Portal
X-B3-Traceid
X-HTML-Minification-Powered-By
X-CACHE-KEY
Ms-Operation-Id
X-Dc
X-RTag
X-App-Server
X-Source
X-UA
X-FireWall-Port
X-Environment-Context
Datacenter
X-L-Path
Cache
X-Upgrade-Enabled
X-Endurance-Cache-Level
X-Handled-By
X-Cache-Server
From-Origin
Healthy
X-Cache-Control
Accept-CH-Lifetime
X-PressLabs-Stats
X-Wix-Request-Id
X-Backend-Name
X-ES-SERVER
Version
X-Status
OT-Force-Account-Verify
X-Cache-Var-Map
X-Path-Route
X-Cache-Var
Ec-Rule-Version
X-RN-RSRV
Meta-Geo
Node
Srv
Selected-Fe
X-Timing-Wait
X-Proxy-Build
X-Tb
X-Section
X-Akamai-Request-ID
X-Storage
X-BCube-Filmed-By
X-Ruxit-Js-Agent
X-Proto
X-APP-VERSION
X-Format
X-Access
X-Request-Time
X-EIG-Tracking-Id
X-Loop
Mn-Server-Ip
X-Time-Microsecs
X-NYM-Debug-Backend
X-Shopify-Generated-Cart-Token
X-UUID
X-Alternate-Cache-Key
X-Goog-Meta-Goog-Reserved-File-Mtime
Azure-InstanceId
X-ShopId
X-Sorting-Hat-PodId
X-Content-Age
Akamai-GRN
X-Cache-Config
X-Sorting-Hat-ShopId
X-Origin
X-Proxy-Cache-Status
X-Soup
Azure-SiteName
Azure-RegionName
S-Rt
X-TNCMS
Cache-Tags
Azure-SlotName
Azure-Version
X-FW-Dynamic
X-ShardId
X-RateLimit-Limit
X-Shopify-Stage
X-Akamai-Request-ID2
X-MP-GENERATED-AT
DB-Nickname
X-PCL
X-Yottaa-Metrics
X-OCL
X-AWS-Id
X-ServerID
X-Yottaa-Optimizations
X-BYPASS-REASON
X-SaId
X-Hosted-By
X-ProxyCache-Status
X-Hyper-Cache
NGX
X-Qloud-Router
X-Pubstack
X-VWS-Id
X-Hl-Ver
X-FC-Vary-Parameters
X-ProxyCache-Key
X-Web-Node
X-JoinUs
X-Cluster-Node
X-LJ-Flow-ID
Now
Accept-Charset
X-Vgn-Hpd-Reason
X-Rule
TWC-Device-Class
Origin-Edge-Control
TWC-Connection-Speed
Origin-Cache-Control
TWC-GeoIP-Country
Property-Id
X-Generated-By
X-Www-Served-By
Decoy-Debug-TTL
X-Varnish-Hits
X-Viewer-Country
X-Origin-Hint
X-SayCDN-TTL
X-Proxy
X-FB-TRIP-ID
X-Say-Cacheable
X-Amzn-Remapped-Content-Length
X-Say-TTL
X-Locale
X-IP
Webcakes-App-Version
Webcakes-App-Name
TWC-Privacy
TWC-Locale-Group
Webcakes-Region
X-Cache-Host
X-Human
X-Detected-As
X-Debug-Cache
X-CCM
TWC-GeoIP-LatLong
Cross-Origin-Window-Policy
Decoy-Debug-Key
Decoy-Debug-Status
GEO-INFO
X-Generated
X-Site-Version
X-Xfnlog-Site
X-R9-Blue-Green-Version
X-RCS-CacheZone
X-Akamai-Transformed
X-Redis-Cache
X-Ttl
L5d-Success-Class
X-NCache
X-CS
X-Drupal-Cache-Tags
Time
Cache-Name
X-Esi
Webserver
Viewport
X-Unique-Id
Uber-Trace-Id
Cache-Key
X-UA-Device-Type
X-UnsetCookies
Mime-Version
X-Mode
X-Cache-Remote
Rt-Fastcgi-Cache
Accept-Language
X-Forwarded-Host
X-Origin-TTL
X-Origin-CC
X-From
X-Trafficlayer-App-Name
X-Whom
X-Backend-TTL
X-NGENIX-Cache
Country
X-Drupal-Cache-Contexts
X-Trafficlayer-App-Scope
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-Info
X-Daa-Tunnel
Odigeo-Trace-Id
X-CDN-Forward
X-Cluster-Name
X-Newrelic-Synthetics
X-Varnish-Cache-Hits
Content-Disposition
X-ApacheServer
X-Magnolia-Registration
X-TT-TIMESTAMP
X-PERF
X-CLOUD-TRACE-CONTEXT
X-Microcachable
X-B3-Spanid
X-Edge-Location
ServedBy
X-Zipkin-Id
X-Device-Type
X-Proxied
X-Routing-Service
Proxy-Connection
Ohc-File-Size
Cf-Ipcountry
X-UPSTREAM-Address
X-EC-Lua
X-Geo
Section-Io-Cache
X-Via-Fastly
X-Nc
X-Uri
Ohc-Cache-HIT
HitType
X-No-Session
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Meta-Geo-Continent
Apple-News-Services-Handled
T-Server
Rendered-Blocks
Mobile-Detection-Method
MD5-Digest
Machine
Content-Script-Type
BehaviorPad-Version
Content-Style-Type
Fastcgi-X-Cache-Version
Apple-News-Services-Request-Url
GEO-REGION-INFO
AsisCache
X-Date
X-ScT
X-Session-Fingerprint
X-Sigma
X-Sigma-Backend
X-S-Cookie
X-S
X-Request-UUID
X-Rewrite-Enabled
X-Rocket-Build-Number
X-Rojux
X-SRCache-Key
X-Transaction
X-VG-WebServer
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
Xc-Version
X-VG-WebCache
X-VG-TLSProxy
X-Trv-Group
X-Twitter-Response-Tags
X-Vdms-Version
X-Region-Sid
X-GeoIP-Country-Code
X-A-Dgt
X-A-Wwc
X-Accel-Expires-Debug
X-Aed
X-A-Dcw
X-A-Dam
VivaBuild
W
X-A
X-A-Ccd
X-Application
X-ARC
X-DPWN-IS-SECURE
X-External-Request-Id
X-G
X-Geo-Header
X-Destination
X-D
X-B-Cookie
X-CF-Lambda-Fn
X-Connection-Hash
Viewtype
X-CF-Lambda-Version
Geo-Info
X-Labrador-Cache-Channel
X-GoCache-CacheStatus
X-C
Access-Control-Request-Headers
X-PHP-Host
X-Distil-CS
X-Developers
Environment
X-Eu-Site
Powered-By
X-Real-IP
CDCHOST
X-Contensis-Viewer-Groups
X-TH-Server
X-CUA
Server-Cache-Control
X-SIPLIST1
Server-Surrogate-Control
Fastly-SSL
IsBot
IBM-Web2-Location
X-Li-Pop
X-Li-Fabric
X-Hit
Locid
X-LI-Proto
HA-Ipaddr
X-FW-Version
X-Tumblr-Pixel-3
X-Logging-Id
X-LI-UUID
Ha-Gx-Prefs
Gh-Request-Id
Fastly-Soc-X-Request-Id
X-Thanos
X-Clientip
X-Auto-Login
X-App-Name
X-Backend-State
X-Bip
Fastly-SIE
Fastly-SWR
X-Agile-Id
X-Rebelmouse-Cache-Control
X-Agile
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
X-Agile-Age
X-Varnish-Beresp-Grace
X-Rebelmouse-Surrogate-Control
Countrycode
X-Cache-ASPX
X-VC-Cache
X-User
X-Varnish-Authentication
X-VServer
X-Cache-Debug
X-WebServer
X-CGP
X-Cache-Backend
User-Cache-Control
X-Debug-Cache-Expiry
X-GeoIP-City
X-Core-Mission
X-Generation-Time
X-Generated-In
X-Gamma-Serve
X-Hash
X-Debug-Cache-Fetch
X-Cms-Context
X-Debug-Log
X-Epic-Correlation-Id
X-Distributor
X-Cache-Bucket
X-Cache-Time
X-Debug-Cookies
X-Dispatcher-Server
X-Debug-Cache-Store
X-Azure-Ref
X-Fetched-On
X-AK-Request-ID
X-Nginx-Cache-Key
X-Wikidot-Backend
X-Wikidot-Static-Cache
Adler-Geo
Is-Eu
X-We-Are-Hiring
X-Urbn-Site-Id
X-TrackingId
X-TT-LOGID
X-Urbn-Context-Path
Platform
X-Cache-Tags
X-Servername
X-Up
X-Variation
X-Platform-Server
X-JWT-State
X-Has-Esi
X-Internal-Host
X-Is-Gdpr
X-Trace-Id
X-Swa-Ws
X-App-Version
X-NodeID
X-NX-Host
X-Origin-Date
X-Ms-Version
X-Ms-Request-Id
X-IN-APIGATEWAYSSL
X-Instart-Isnd
X-Key
X-Origin-Expires
X-Proxy-Upstream
X-Server-W
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Request-URI
X-Render-Time
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Reboot
X-IN-APIGATEWAY
X-Owner
AKAMAI
RNT-Time
RNT-Machine
V-Age
Mail-Subject
Request-EU
Country-Code
True-Client-Country-4JS
Cdncip
Cache-Host
Server-Int
Server-ID
Cdnsip
Fastly-Backend-Name
Request-Country
Kp-EeAlive
Memcached
Heartbleed
We-Hiring
Locale
X-TA-CDN-Provider
X-Generated-On
X-Req
X-Hnp-Log
X-Core-Value
X-Irp-Debug
Server-Host
X-Level-Front-Cache
PFcat
X-Matched-Rule
X-Micro-Cache
X-OVcl
X-Fastly-Cache
FNAC-ModuleRouting
X-OVcl-Cache
X-Gen-Mode
X-Clara-WADP
Thinkindot-CacheControl
X-WADP-Cache
X-Thinkindot-L3
X-BBXSRF
X-Sucuri-Cache
X-Webstats-RespID
ServerName
Wxu-Next-Hostname
Wxu-Next-Region
Wxu-Next-Commit
Web-Mar-Node
X-NU-AKA-ACS-Version
X-Block-Status
X-Trafficlayer-App-Version
Thinkindot-CacheControl-Type
X-Cache-URL
X-ServiceProvider
X-Cache-Info
X-Service
Thinkindot-Control
X-Cdn-Srv
X-Nginx-Cache
Filterid
X-Response-By
X-Lb-Id
X-Air-Hostname
Cache-Hits
X-SERVER
X-Location
X-S-Maxage
X-Old-Content-Length
X-Cache-Expired-At
X-Var-Ttl
Pragrma
RequestId
X-Refresh
Group
X-Parent-Response-Time
S-Cnection
X-VHOST
X-CSRF-TOKEN
X-Tb-Optimization-Total-Bytes-Saved
X-B3-Parentspanid
X-Cdn-Forward
X-Tec-Api-Root
ProcessTime
X-CF-Powered-By
X-BACKEND-TTL
Powered-By-ChinaCache
X-Tec-Api-Version
X-Tec-Api-Origin
Memory
X-Correlation-ID
X-Wa
X-Pjax-Url
X-B3-SpanId
X-Ua
Origin
X-Server-IP
X-NC
User-Agent
X-Sucuri-ID
X-CSRF-Token
Geoip-Latitude
X-Varnish-Cacheable
X-Pf-Uncompressing
TTL
X-Unique-ID
X-NWS-UUID-VERIFY
SRV
GeoIp-Country-Code
Geoip-City
X-NGINX-Cache
X-Vcl-Version
X-Developer
PICS-Label
X-COUNTRY
X-Via-CDN
X-Cdn-Request-ID
Media-Length
X-Node-Id
X-Servedbyhost
X-Ocache
X-Sn-Servicetimems
X-Cache-Grace
X-Cdn-Origin
X-Device-Os
X-LAGOON
On-Server
X-Litespeed-Cache
Dnion-Transfer-Encoding
X-Webkit-CSP
X-Sucuri-Id
A
X-MSEdge-Flight
X-MSEdge-Features
X-Cache-Status-Check
X-Via-Ucdn
SN
X-Varnish-Ttl
X-TIME
X-Oss-Request-Id
X-Oss-Storage-Class
Hostname
X-Rocket-Nginx-Bypass
X-Oss-Object-Type
X-Oneagent-Js-Injection
XServer
X-Oss-Hash-Crc64ecma
X-Oss-Server-Time
X-AIR-PT
M-TraceId
X-Reqid
Esi-Enabled
X-Request-Host
Cloudfront-Viewer-Country
X-HS-Status
X-FORWARDED-FOR
Cdn
X-Policy
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
X-Ratelimit-Remaining
X-Fastly-Country-Code
X-Beluga-Trace
X-ServedByHost
X-Beluga-Status
X-Beluga-Cache-Status
Resin-Trace
Who
X-Request-Start
X-Beluga-Node
X-Cache-Ttl
X-Beluga-Record
X-Azure-Ref-OriginShield
X-Beluga-Response-Time
X-Ftr-Cache-Host
HostName
Host-ID
X-Varnish-URL
CF-Cached-On
Rt-Proxy-Cache
Tcn
Pics-Label
GeoIP-Country-Code
NtCoent-Length
X-VCL-Version
GeoIP-Latitude
X-APP
Magicmarker
X-Method
MIME-Version
X-Oracle-Dms-Rid
CACHE
X-RPM
X-DW
X-PF-Uncompressing
X-RPS
X-RSL
X-Zone
X-DSS
X-Action
Ttl
Cteonnt-Length
X-Varnish-Url
X-Slack-Backend
X-DB
X-DI
GeoIP-City
X-Fastly-Backend-Reqs
X-Bc
X-LiteSpeed-Cache-Control
X-DC
X-Newrelic-App-Data
X-VarnishDD-TTL
X-Server-Time
X-Skip-Cache
X-Ratelimit-Limit
Arc-Country
X-Dispatch
X-PAYTM-SRV-ID
X-Processor
Pramga
X-Cache-FS-Status
X-Ftr-Request-Id
X-SRV
WebServer
Amp-Access-Control-Allow-Source-Origin
X-PJAX-URL
Load-Balancing
X-Swift-Error
Ohc-Response-Time
X-ND-Cache
X-ABtesting
X-Be
X-FPC
X-Flog
X-Svr
X-Hello
X-Served-From
Processtime
Vix-Hermes-Req-Id
Fastly-Drupal-HTML
X-HostName
X-Edge-Server
N-Cache
Cdn-Request-Time
X-BE
Cdn-Host
X-DevSite-Last-Modified
X-Dynatrace
X-Dynatrace-Js-Agent
DSUID
X-MServer
Servername
X-WA
X-Amzn-Remapped-Connection
Release
X-Aicache-OS
X-VCT
Cache-Provider
X-ID
X-Amzn-Remapped-Date
X-Bc-Bl
X-Hp-Ccpa-Warning
X-WR-MODIFICATION
X-Frame-Option
X-Tid
Lfy
X-Ftr-Realm
Pagetype
X-Fastly-Cache-Hits
X-Ftr-Backend
Dynatrace
X-StackifyID
CF-IPCountry
X-ZONE
X-Snapshot-Date
X-Configured-By
X-Backend-Host
X-Ftr-Balancer
Requestid
X-LB-ID
CDN
X-Ftr-Dc
X-Branch-Name
X-Ftr-Backend-Server
Section-Origin-Responded
Section-Io-Id
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
X-CACHE-AGE
Proxy-Firewall
WZWS-RAY
X-Upstream-Ct
X-Upstream-Ht
X-Apw-Access-Object
Warning
X-Apw-Hits
X-Request-Url
V-Cache
X-VC
X-BC
X-SB
X-Apw-Access-Token
D-Cc-Upstream
X-Apw-Access-Action
X-SD-PageType
X-Edge-IP
X-Cc-Req-Id
SD-X-WS
X-Cc-Via
X-Litespeed-Cache-Control
WP-Super-Cache
X-Compress-Hint
X-ElasticPress-Search
Cache-Cookie-Set-Idcheck
FSS-Proxy
X-Fpc
FSS-Cache
Cneonction
Cache-Cookie-Set-From
Cache-Cookie-Set-Lfrom
X-WPE-Loopback-Upstream-Addr
X-Powered-Y
X-Varnish-Beresp-TTL
X-Fastly-Cache-Status
X-Worker
Backend-Name
Correlation-Id
X-Check-Cacheable
X-SN
X-Cache-Id
L
Lb
X-App
X-Request-URL
X-ServerName