Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
X-Frame-Options
Expires
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
CF-Cache-Status
Cf-Request-Id
ETag
Accept-Ranges
Expect-CT
CF-RAY
Pragma
X-Powered-By
X-Cache
Via
Age
X-XSS-Protection
Content-Security-Policy
Alt-Svc
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
X-Xss-Protection
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Accept-CH
X-Served-By
P3P
X-Download-Options
X-Timer
Access-Control-Allow-Headers
X-Request-Id
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
Access-Control-Allow-Credentials
CF-Ray
X-DNS-Prefetch-Control
Content-Security-Policy-Report-Only
X-Runtime
X-AspNet-Version
X-Drupal-Cache
P3p
Server-Timing
X-Generator
X-Cache-Status
X-Cacheable
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-Iinfo
X-FRAME-OPTIONS
Permissions-Policy
X-Drupal-Dynamic-Cache
X-Request-ID
X-Ua-Compatible
X-Content-Security-Policy
Feature-Policy
Access-Control-Expose-Headers
Upgrade
Content-Encoding
Status
X-CDN
X-AspNetMvc-Version
Access-Control-Max-Age
Host-Header
Cf-Edge-Cache
X-Robots-Tag
Request-Context
X-Amz-Request-Id
X-Check
X-Backend
X-Amz-Id-2
Accept-CH-Lifetime
X-Hacker
Cf-Apo-Via
X-Turbo-Charged-By
X-Cache-Group
X-Proxy-Cache
Keep-Alive
X-Age
X-Rq
X-Via
EagleId
X-UA-Device
X-Server
X-Dispatcher
X-Vhost
X-Amz-Version-Id
X-AH-Environment
X-Ws-Request-Id
X-Litespeed-Cache
X-Varnish-Cache
X-OneAgent-JS-Injection
Grace
X-Server-Powered-By
X-WebKit-CSP
X-Swift-CacheTime
X-Swift-SaveTime
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
Allow
Ali-Swift-Global-Savetime
X-Cache-Lookup
X-Page-Speed
Xkey
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Cloud-Trace-Context
X-Device
X-Backend-Server
X-Dns-Prefetch-Control
X-Akam-SW-Version
X-Host
EagleEye-TraceId
Surrogate-Control
X-Response-Time
X-Readtime
Cf-Railgun
X-Server-Id
X-Node
X-HW
X-Ruxit-JS-Agent
Request-Id
X-Country
X-Url
X-Nginx-Cache-Status
Content-Location
X-Content-Type
Cache-Tag
X-Nginx-Upstream-Cache-Status
X-LiteSpeed-Cache
X-Country-Code
Fastly-Restarts
Service-Worker-Allowed
X-Clacks-Overhead
X-Trace
X-Application-Context
Cross-Origin-Opener-Policy
X-NWS-LOG-UUID
X-Amz-Server-Side-Encryption
X-Rack-Cache
X-Times
X-Vname
X-PC
X-TtlSet
X-Midtier
X-Mcache
X-Edge
Surrogate-Key
Rating
X-Server-Name
X-Cache-TTL
X-Sol
Display
Pagespeed
X-Middleton-Display
X-Browser-Type
X-Cnection
X-Element-Page-Cache
X-Abt-Application-Version
X-Kinja
X-Kinja-Build
X-GoogleNews-Bot
X-Exp-Id
X-Cdn-Fetch
X-Exp-Variant
X-Kinja-Server
X-Kinja-Revision
X-Powered-By-Plesk
Nginx-Cache
X-GitHub-Request-Id
X-ESI
X-ECACHE
Edge-Control
X-Vcap-Request-Id
X-D2id
X-Ac
X-Ser
Verso
X-MS-InvokeApp
X-Client-IP
X-ORACLE-DMS-RID
X-Amz-Rid
Response
X-ARC
X-Middleton-Response
X-Ratelimit-Limit
X-Dw-Request-Base-Id
X-CST
X-Wormhole-Sdk
X-Goog-Hash
X-B3-TraceId
X-Powered-CMS
X-Navigation-Version
X-Edge-Location-Klb
X-Kinsta-Cache
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Instrumentation
X-PDP-UNCACHING-HASH
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Upstream
X-Ratelimit-Remaining
X-Forwarded-For
X-Amzn-Trace-Id
X-Ruxit-Js-Agent
RTSS
X-Cache-Key
X-Daa-Tunnel
SPIisLatency
SPRequestDuration
X-FastCGI-Cache
X-Mod-Pagespeed
Edge-Cache-Tag
AR-Request-ID
AR-PoweredBy
AR-ATIME
AR-SID
Cache-Status
Public-Key-Pins
X-Server-ID
X-Content-Digest
X-Oneagent-Js-Injection
X-Ezoic-Cdn
X-Version
Accept-Ch-Lifetime
X-Mg-S
SPRequestGuid
X-SharePointHealthScore
X-ORACLE-DMS-ECID
S
X-Ttl
Realpath
X-Fastly-Request-ID
X-Shield-Request-Id
X-T
X-MSEdge-Ref
Cross-Origin-Resource-Policy
Fastcgi-Cache
X-Recruiting
AR-CACHE
Origin-Trial
X-NF-Request-ID
Front-End-Https
X-Cached
X-Accel-Expires
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Distributor
X-Ua-Device
X-Nf-Request-Id
X-TTL
X-FTR-Request-ID
X-Azure-Ref
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
TP-Cache
Access-Control-Request-Method
Arr-Disable-Session-Affinity
X-Request-Received
X-Request-Processing-Time
Count-Hit
X-Newrelic-App-Data
X-Id
X-Debug
X-HS-Hub-Id
X-HS-Content-Id
X-Ua-Browser
X-HS-Cache-Config
X-LLID
X-Varnish-TTL
X-Xrds-Location
Cache-Tags
X-Ismobilevalue
X-Cluster-Name
Server-Node
X-Content-Security-Policy-Report-Only
X-PressLabs-Stats
X-Correlation-Id
MicrosoftSharePointTeamServices
X-Frontend
X-Hits
X-VARITI-CCR
X-GUploader-UploadID
X-Varnish-Backend
X-HS-Combine-CSS
X-NGENIX-Cache
X-Aspnetmvc-Version
X-Protected-By
X-Amz-Replication-Status
Accept-Ch
Payment
X-Goog-Metageneration
X-Microsite
X-Request-Handler-Origin-Region
Akamai-GRN
X-Unique-Id
X-LB-Cache
Cleartype
X-Varnish-Server
X-FB-Debug
X-Activity-Id
X-Logged-In
X-Git-Hash
X-Www-Served-By
X-Az
X-AppVersion
X-Ratelimit-Reset
X-Page-Id
X-Tt-Trace-Host
Content-Disposition
X-Tt-Trace-Tag
X-Hostname
X-Forwarded-Proto
Host
X-DIS-Request-ID
Filterid
X-HP-Trace-Id
X-Cambria-Cache-Control
X-HP-Webp
X-Jurisdiction
X-Varnish-Ttl
X-Amz-Apigw-Id
X-Amzn-RequestId
X-App-Server
X-Fastcgi-Cache
X-Template
X-Geo-Country
Frame-Options
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-TraceId
Amp-Access-Control-Allow-Source-Origin
Trailer
Access-Control-Allow-Method
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Load-Cache
X-Origin-Server
Version
X-Aspnet-Version
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-Upgrade-Enabled
Fastly-SIE
Accept-Charset
X-ASPNET-VERSION
Viewport
Fastly-SWR
X-Type
X-Content-Options
Section-Io-Cache
X-TT
X-Fb-Rlafr
X-Cache-Control
X-B3-Sampled
Retry-After
X-B
X-Grace
X-Rid
X-Ah-Environment
X-Envoy-Decorator-Operation
X-Source
Content-MD5
X-Cache-Age
X-Tec-Api-Origin
X-Tec-Api-Root
X-SRCache-Store-Status
X-SRCache-Fetch-Status
MS-Author-Via
X-Tec-Api-Version
X-Device-Type
X-Vcl-Version
Server-Name
X-Request-Guid
X-Magnolia-Registration
X-Language
X-Trace-Id
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-Px
X-TEC-API-VERSION
X-Buckets
X-Revision
X-Cdn
Healthy
X-Mobile
X-HS-Prerendered
X-EdgeConnect-Cache-Status
X-WP-CF-Super-Cache-Active
X-Webkit-CSP
X-Akamai-Edgescape
X-Backend-Name
X-CSRF-Token
X-Varnish-Grace
TCN
Protected
X-RM-Cache-TTL
X-Status
X-App-Environment
X-Origin-Cache
X-Instance
X-Tumblr-Pixel
X-Environment-Context
X-FW-Dynamic
X-Rule
X-Contextid
X-RemovedCookies
X-L-Path
X-Debug-Info
X-Tumblr-Pixel-1
X-Tumblr-User
X-FW-Version
X-FW-Static
X-FW-Type
X-NYM-Debug-Backend
X-ProcessESI
X-FW-Server
X-FW-Serve
X-FW-Hash
X-Tumblr-Pixel-0
X-Framework
X-ServerID
X-Proxy-Cache-Info
NGB
X-Mg-Request-UUID
X-Node-Name
X-Storage
Access-Control-Request-Headers
Cross-Origin-Window-Policy
X-Region
GEO-INFO
X-Cache-Time
X-UUID
SD-X-WS
X-Datadog-Sampling-Priority
X-Datadog-Trace-Id
X-Rendered-As
X-Edge-Location
X-Adobe-Content
X-Datadog-Sampled
X-Is-Bot
X-Content-Powered-By
X-Datadog-Parent-Id
MS-CV
X-RTag
X-Debug-IsPreview
Ms-Operation-Id
X-Adobe-Loc
X-Debug-IsConnected
X-Proxy
X-Cacheable-TTL
X-Amz-Meta-S3cmd-Attrs
X-G
X-Original-Request-Id
Upgrade-Insecure-Requests
X-Response-Served-From
Charset
X-Yottaa-Metrics
X-Yottaa-Optimizations
Cross-Origin-Embedder-Policy-Report-Only
X-Whom
Refresh
OT-Force-Account-Verify
Webserver
Countrycode
X-Lambda-Id
DC
Paypal-Debug-Id
X-B3-Traceid
X-RateLimit-Remaining
X-User-Agent
Section-Io-Id
X-Seen-By
X-HTML-Minification-Powered-By
X-Reqid
X-Amzn-Remapped-Content-Length
Front
X-VC
X-WebKit-CSP-Report-Only
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-CCDN-CacheTTL
Alternate-Protocol
X-Server-W
SRV
X-VHOST
X-ECache
X-TT-LOGID
Priority
X-IPS-LoggedIn
X-Real-IP
X-Time
X-Akamai-Request-ID2
X-AB
X-WP-CF-Super-Cache-Cookies-Bypass
X-Cache-Status-Check
Liferay-Portal
Country
X-FTR-Cache-Status
X-Mode
X-FTR-Backend-Server
X-FTR-Expires
X-FTR-Balancer
X-FTR-Backend
X-N
X-Country-Code-Real
Backend
X-B3-SpanId
Xet-Cookie
Onion-Location
X-Nginx-Cache
X-FB-TRIP-ID
X-JoinUs
X-Origin-Hint
Meta-Geo
X-Rn-Rsrv
Environment
X-SaId
X-UPSTREAM-Address
Filters
Fastcgi-Useragent
X-Rewrite-Enabled
Property-Id
X-Tumblr-Pixel-2
Webcakes-App-Version
Webcakes-Region
X-Cache-Host
TWC-Connection-Speed
Webcakes-App-Name
TWC-Privacy
TWC-Locale-Group
TWC-GeoIP-LatLong
TWC-GeoIP-Country
ServerID
TWC-Device-Class
X-Origin-Date
X-Cluster-Node
X-Restarts
X-Connection-Hash
X-Origin-TTL
X-Frame-Option
X-Origin-CC
X-Varnish-Age
X-Rocket-Nginx-Serving-Static
X-PHP-Host
X-Fetched-On
X-Tb
Expiry
X-R9-Blue-Green-Version
X-VC-Cache
X-Format
X-Hosted-By
From-Origin
X-Scope-Id
Web-Mar-Node
X-Accel-Version
X-Cache-Expired-At
X-Hl-Ver
X-IPLB-Instance
X-IPLB-Request-ID
X-Skip-Cache
X-Redis-Cache
Mn-Server-Ip
DB-Nickname
X-Labrador-Cache-Channel
X-Cache-Action
Atl-Traceid
X-Httpd
X-Logging-Id
Uber-Trace-Id
X-Forwarded-Host
WPO-Cache-Status
WPO-Cache-Message
X-Vcache
X-Handled-By
X-Loop
X-Say-Cacheable
X-Cms-Context
X-BYPASS-REASON
X-Varnish-Cache-Hits
X-Web-Node
X-Webstats-RespID
X-Say-TTL
X-Director
X-Tncms
X-Soup
X-ProxyCache-Status
X-ProxyCache-Key
X-SayCDN-TTL
Selected-Fe
X-Cluster
X-DynaTrace
X-Varnish-Beresp-Grace
Apigw-Requestid
X-Auth-Group-Type
X-Timing-Wait
X-Proxy-Build
X-Servername
Cross-Origin-Opener-Policy-Report-Only
X-DataDome
X-Adobe-Source
X-Served-From
Url
X-Cloudmap
X-Extlb
ServedBy
X-S
X-Ms-Version
X-Detected-As
X-Routing-Service
X-Proxied
X-Zipkin-Id
X-Origin
X-Ms-Request-Id
X-Fastly-Request-Id
Accept-Language
X-Tumblr-Pixel-3
X-Hit
Cross-Origin-Embedder-Policy
Referer-Policy
X-Request-URI
N-Cache
X-Azure-Ref-OriginShield
Surrogated-Key
X-XRDS-Location
X-SRV
Ohc-File-Size
X-LSADC-Cache
X-RateLimit-Remaining-Second
X-Generated-By
X-RateLimit-Limit-Second
X-Worker
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
X-Wix-Request-Id
Xserver
X-Resp-Is-Stale
X-Xfnlog-Site
X-Sucuri-Cache
X-Generation-Time
X-HS-CF-Cache-Status
X-App-Version
X-Lagoon
LB
Source
X-Drupal-Cache-Tags
X-Drupal-Cache-Contexts
X-Cache-Hit
X-Cdn-Origin
CF-IPCountry
X-NWS-UUID-VERIFY
X-Cache-Debug
X-Sucuri-ID
X-RCS-CacheZone
X-MP-GENERATED-AT
X-F-Cache
Node
X-TA-CDN-Provider
X-VCT
X-Tx-Id
X-Is-Tablet
X-Browser-Name
CDN-RequestId
X-Tcp-Rtt
X-Is-Mobile
X-Is-Supported-Browser
X-Geo-Region
X-Is-Desktop
X-Cache-Rule
X-No-Session
X-Urbn-Context-Path
Cache
X-Mly-Id
Locale
X-NODE
X-Urbn-Site-Id
X-Pad
X-B-Cache
X-Signature
X-Varnish-Beresp-Ttl
X-Via-JSL
X-INCAP-ABP
X-ElasticPress-Query
X-Proxy-Cache-Status
X-Litespeed-Tag
X-CDN-Forward
X-Cache-Operation
Redirect-Candidate
Rendered-Blocks
Ngx.Var.Host
Producers
Sslversion
Origin
PFcat
User-Agent
W
Fl-Custom-Application
Candidate-Md5Url
Cluster
Content-Secure-Policy
DCR-Decision-By
Cache-Provider
BehaviorPad-Version
Edge-Copy-Time
X-Via-CDN
X-Via-Edge
X-Via-SSL
DCR-Processing-Time-Ms
Expect-Staple
L5d-Success-Class
Lang
Mail-Subject
MD5-Digest
Host-ID
HA-Ipaddr
Fastly-Backend-Name
We-Hiring
Ha-Gx-Prefs
Meta-Geo-Continent
X-Aed
X-HN
X-Geolocation
X-Ig-Origin-Region
X-Ig-Push-State
X-Jobs
X-GeoCountry
X-GeoCode
X-Vtex-Remote-Cache
X-Ec-GeoHdr
X-Eu-Site
X-FC-Vary-Parameters
X-Gdpr
X-Mvc-Supplant-Cachable
X-Nyt-Route
X-Vdms-Version
X-Rojux
X-ScT
X-VarnishDD-TTL
X-TIM-N
X-Proto
X-Platform-Server
X-Org
X-Op-Id-All
X-Origin-Time
X-Path
X-PAYTM-SRV-ID
X-Ec-Fail
X-DPWN-IS-SECURE
X-AB-Test
X-A-Wwc
X-Aicache-OS
X-App-Name
X-Backend-Instance
X-A-Dgt
X-A-Dcw
Wxu-Next-Region
Wxu-Next-Hostname
X-A
X-A-Ccd
X-A-Dam
X-Bc-Bl
X-BCube-Filmed-By
X-D
X-Csrf-Jwt
X-Debug-Cache-Fetch
X-Debug-Cache-Store
X-Developer
X-Conf
Xc-Version
X-Bl-Debug
X-Bug-Bounty
X-Cache-NE
X-CGP
Wxu-Next-Commit
Odigeo-Trace-Id
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-Storefront-Renderer-Rendered
X-Shopify-Stage
X-ShopId
X-Alternate-Cache-Key
X-ShardId
X-Oracle-Dms-Ecid
Fastly-SSL
Mime-Version
X-Cached-By
X-Cdn-Srv
X-CacheTTL
X-External-Request-Id
Origin-Agent-Cluster
X-Cache-Id
X-Cache-Info
X-Proxied-Request
X-Varnish-Remaining-TTL
NM-Fastcgi-Cache
X-Clientip
X-Policy
Gannett-Cam-Experience-Id
X-Date
X-DefElseHash
X-DefHash
X-Dispatcher-Server
X-Depends
Gh-Request-Id
X-Powered-By-VTEX-Cache
X-Wikidot-Static-Cache
L
X-Wikidot-Backend
X-Contensis-Viewer-Groups
X-Core-Value
X-Content-Length
X-Cache-Date
Product
Web-Mar-Region
X-Application
X-Section
X-AK-Request-ID
X-Akamai-Device-Characteristics
X-Cache-Grace
V-Age
X-B-Cookie
X-Req
X-Request-Time
X-SB
X-Accel-Expires-Debug
X-Scheme
X-Access
Thinkindot-CacheControl-Type
Thinkindot-CacheControl
RNT-Machine
RNT-Time
X-B3-Trace-ID
Debug
Platform
X-Shield-Cache-Expires
Server-Host
X-Auto-Login
X-Varnishpool
TDXMobile
X-Amz-Meta-Cb-Modifiedtime
X-Amz-Storage-Class
X-Destination
X-Cache-Aspx
Fastly-GeoIP-CountryCode
X-V-Cache
X-GeoIP-Region-Code
Apple-News-Services-Handled
X-Irp-Debug
X-Var-Ttl
X-Level-Front-Cache
X-Varnish-Authentication
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Azure-SlotName
Azure-Version
Azure-SiteName
Azure-RegionName
Apple-News-Services-Request-Url
X-We-Are-Hiring
X-Loc
X-Locale
X-Slack-Backend
X-Node-Id
X-NodeID
X-S-Cookie
X-Origin-Expires
X-SD-PageType
X-NMSegId
X-Mvc-Supplant-OutputCached
X-Slack-Shared-Secret-Outcome
X-Location
X-HS-Content-Campaign-Id
X-Varnish-CookieHashed-On
X-Micro-Cache
X-Varnish-CookieINHashed-On
X-Hash
Azure-InstanceId
X-GeoIP-Country-Code
X-VServer
Cdnsip
X-Fmm-Version
X-Via-Fastly
X-Gamma-Serve
X-Fastly-Backend
X-Esi-Check
X-VTEX-Cache-Time
X-Edge-Server
Content-Style-Type
X-VTEX-Cache-Server
X-Thinkindot-L3
Content-Script-Type
Cdn-Request-Time
Cdncip
X-GoCache-CacheStatus
X-Gzip
Canary
X-GeoIP-City
X-GeoIP
CDCHOST
X-Platform
Cdn-Host
X-Vmg-Version
X-Generated-On
X-Upstream-Ht
Akamai-Mon-Iucid-Del
X-Upstream-Ct
X-NGINX-Cache
X-Acquia-Purge-Cdn-Unconfigured
X-Viewer-Country
X-Request-Start
X-ORCA-Accelerator
User-Cache-Control
X-Cache-FS-Status
X-BBC-Edge-Cache-Status
X-VG-WebCache
Pramga
X-IsAdmin
Yak-Timeinfo
X-Men
X-Pool
X-Internal-TTL
X-Site-Version
X-Bip
X-Epic-Correlation-Id
X-Block-Status
Click-Count-Error
X-SIPLIST1
X-Ec-Custom-Error
Country-Code
X-Server-IP
Release
X-GEO
X-SVT-ORM-RULES
Req-ID
Click-Count-Action-Start
Origin-EX
Origin-CC
X-Varnish-Director
X-Gen-Mode
X-SVT-ORM-VERSION
IsBot
X-Thanos
DSUID
X-Human
X-Sn-Servicetimems
NGX
ServerName
Req-Svc-Chain
X-Origin-Response-Time
CDN-PullZone
CDN-RequestCountryCode
CDN-EdgeStorageId
CDN-CachedAt
X-Hnp-Log
X-UA-Device-Type
CDN-Cache
Tube-Got-Results
Tube-Return
Tube-Got-Eval
X-Content-Age
CDN-RequestPullSuccess
X-Request-Host
X-CUA
CDN-Uid
CDN-RequestPullCode
Tube-Get-Contents
Ohc-Cache-HIT
Sid
X-Tb-Optimization-Total-Bytes-Saved
X-VG-TLSProxy
X-Varnish-Beresp-Status
X-User
Esi-Enabled
X-Service
X-Varnish-Hits
X-Pubstack
XM
Ssr
X-Zen-Fury
X-AIR-PT
X-VC-TTL
X-UA
X-HOST
X-Cs
X-LB-NoCache
X-Api-Version
X-RID
AMP-Access-Control-Allow-Source-Origin
Fastly-Drupal-HTML
X-Refresh
X-CACHE-GROUP
Cdn-Requestid
X-ZONE
XkeyRZ
A
Cache-Key
GeoIP-Latitude
X-Proxy-CacheRZ
X-Cache-Bucket
X-B3-Spanid
X-Newrelic-Synthetics
X-Cdn-Forward
X-DC
X-Tt-Logid
X-TH-Server
X-RequestId
X-Vgn-Hpd-Reason
X-HITS
CloudFront-Viewer-Country
X-Servedbyhost
X-Via-Poph
X-HA-Backend
X-Via-Popn
X-HubSpot-Correlation-Id
X-Via-Popv
TP-L2-Cache
X-Wa
X-Nc
C-Via
X-Dc
X-LB-ID
X-APP
X-Nananana
X-B3-Parentspanid
X-Old-Content-Length
Server-ID
X-Moov-Xdn-Caching-Status
X-Moov-T
X-DynaTrace-JS-Agent
X-Endurance-Cache-Level
Proxy-Firewall
X-Optimistic-Header
HostName
X-Moov-Xdn-Version
X-Webkit-Csp-Report-Only
X-Ua
X-Srv
Fastly-Drupal-Html
Cdn
X-Presslabs-Stats
X-Parent-Response-Time
True-Client-Country-4JS
X-COUNTRY
WP-Super-Cache
X-Zone
X-LiteSpeed-Tag
X-URL
X-Action
N1-Cache
X-Datadome
X-CS
X-Webkit-Csp
X-LiteSpeed-Cache-Control
X-Test
Sever-Int
Server-Hostname
X-Litespeed-Cache-Control
Location
Server-Ext
X-Vercel-Cache
X-Vercel-Id
X-Thinkindot-L1
X-Cache-VC
X-CACHE-AGE
Adler-Geo
Is-Eu
X-Air-Pt
X-Fpc
GeoIp-Country-Code
SID
X-API-Version
TWC-GeoIP-City
TWC-GeoIP-DMA
Cache-Hits
TWC-GeoIP-Region
X-LJ-Flow-ID
X-Dispatcher-Number
X-NewRelic-App-Data
X-DataCenter
X-VWS-Id
WZWS-RAY
X-AWS-Id
X-Nginx-Cache-Key
Tcn
True-Client-Ip
X-PERF
X-Datacenter
X-ApacheServer
X-RateLimit-Limit
True-Client-IP
Uri
X-Provided-By
X-WA-Info
GeoIP-Country-Code
X-Geo-Header
X-Custom-Header
Resin-Trace
SEZNAM-JOBS-OFFER
T-Server
X-Render-Time
X-Pass-Why
X-ND-Cache
X-Nitro-Cache
X-Uri
X-CLOUD-TRACE-CONTEXT
S-Rt
X-Ssense-Shipping-Surcharge-Enabled
X-Varnish-Beresp-TTL
X-Ssense-Gql
X-SERVER-NAME
Cache-Contol
RewriteTeamHook
X-CMSURLCustom
X-Cache-Server
X-Stale
Lb
RewriteTestHook
Log-Origin
Serverhost
Vc-Max-Age
X-FPC
X-Jungle-Id
X-Ion-Healthy
X-Ion-Hop
Cache-Tv-Group
Sm-Log-Id
X-Service-Response-Time
X-Client-Ip
X-TX-ID
Pics-Label
Cmsid
Cmstype
My-App
X-Esi
X-Srcache-Fetch-Status
X-Srcache-Store-Status
X-Correlation-ID
X-Dynatrace-Js-Agent
X-Oracle-Dms-Rid
Powered-By
X-From
Srv
X-APP-VERSION
X-Udemy-Cache-App-Namespace
X-Up
X-XRDS-LOCATION
X-Debug-Service
Av-Poweredby
Hostname
X-Fastly-Cache-Status
Vix-Hermes-Req-Id
X-Air-Source
Server-Id
CacheControlHeader
X-Air-Hostname
X-Air-Trace-Id
X-Cdn-Cache-Status
Cf-Ipcountry
X-Akamai-Pragma-Client-IP
X-Ckpd-Fst-Backend
X-Fastly-Cache
X-Cache-TTL-Remaining
X-App
X-LAGOON
X-Vc
On-Server
X-WA
Thinkindot-Control
X-Lb-Id
X-NC
X-Cache-Ttl
Geoip-Latitude
NtCoent-Length
X-Ha-Backend
X-Fastly-Backend-Reqs
X-Oracle-DMS-ECID
X-Via-PopN
ServerHost
X-Github-Request-Id
X-Via-PopH
X-Via-PopV
X-Html-Minification-Powered-By
AKAMAI
Origin-Site
X-Ee-Generated-By
X-Cms-Device
X-Ee-Origin
X-Amz-Meta-Opti
X-Ee-Request-Date
X-VCL-Version
X-Ee-Request-Id
Cloudfront-Viewer-Country
Store-Cloud-Cache
X-Requestid
X-Vary-Devices
X-Save-Cache
X-ServedByHost
Xkeylog
X-PHP-Backend
Time-Cloud-Cache
X-Proxy-Cache-La3
Xkey-La3
X-MSEdge-Features
Ms-Author-Via
X-MSEdge-Flight
X-VTEX-Cache-Backend-Header-Time
Epwk-X-Cache
X-IAuth-Set-Uid
WWW-Authenticate
X-VTEX-Cache-Backend-Connect-Time
X-Varnish-Hostname
X-Traceid
X-SRCache-Key
WebServer
CountryCode
X-Serial
X-Info
X-Limited
X-Check-Cacheable
X-HS-Status
Cl-Cache
Warning
Edge-Cache
Magicmarker
X-Sucuri-Id
X-Lsadc-Cache
X-Acquia-Purge-Tags
X-Acquia-Application-UUID
Pragrma
X-Pod
X-Wp-Cf-Super-Cache-Cache-Control
X-Akamai-Transformed
X-Acquia-Site
X-Lb-Nocache
X-Acquia-Application-Trace
X-Dw-Trace-Id
X-Wp-Cf-Super-Cache
FSS-Cache
Reporter
Yjs-Id
YJS-ID
X-Mg-Cache
X-Web-Server
X-Td-Header-From-No-Data
Thinkindot-Cache-Type
X-Orig-Cache-Control
X-Ms-Blob-Type
X-Akamai-ERPolicy
X-Akamai-ERRuleID
Timeexpire
X-Ms-Lease-Status
X-Tncms-Bot-Tier
Cneonction
X-Ramcache
CF-Cached-On
X-Platform-Cluster
X-Platform-Processor
X-BBC-Origin-Response-Status
X-Geo
X-CDN-Cache-Status
X-Elasticpress-Query
X-Platform-Router