Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
X-Frame-Options
Expires
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Accept-CH
CF-Cache-Status
ETag
X-XSS-Protection
Expect-CT
Accept-Ranges
Pragma
X-Powered-By
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Alt-Svc
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
X-Amz-Cf-Pop
Content-Language
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
X-Served-By
X-Download-Options
X-Request-Id
X-Timer
X-Xss-Protection
Access-Control-Allow-Headers
Access-Control-Allow-Methods
CF-Ray
X-Varnish
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
Access-Control-Allow-Credentials
X-DNS-Prefetch-Control
Content-Security-Policy-Report-Only
Accept-CH-Lifetime
X-AspNet-Version
X-Runtime
Accept-Ch
Permissions-Policy
Server-Timing
X-Drupal-Cache
X-Generator
X-Envoy-Upstream-Service-Time
X-Cache-Status
X-Cacheable
X-FRAME-OPTIONS
X-Iinfo
X-Drupal-Dynamic-Cache
X-Ua-Compatible
Timing-Allow-Origin
X-CONTENT-TYPE-OPTIONS
Feature-Policy
X-Content-Security-Policy
Xkey
Upgrade
Access-Control-Expose-Headers
X-CDN
X-XSS-PROTECTION
Content-Encoding
Status
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
Host-Header
X-Amz-Id-2
X-Age
Request-Context
Cf-Edge-Cache
X-Backend
X-Request-ID
X-Robots-Tag
X-Hacker
Keep-Alive
X-Via
Cf-Apo-Via
X-Amz-Version-Id
X-Turbo-Charged-By
X-Rq
X-AH-Environment
X-Vhost
X-Cache-Group
X-Server
X-Dispatcher
X-Proxy-Cache
X-Ws-Request-Id
EagleId
CONTENT-SECURITY-POLICY
X-UA-Device
X-Varnish-Cache
Pantheon-Trace-Id
Grace
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Litespeed-Cache
X-OneAgent-JS-Injection
X-Server-Powered-By
X-Pingback
Allow
X-Page-Speed
X-WebKit-CSP
X-Dns-Prefetch-Control
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-FTR-Request-ID
X-Node
X-Device
X-Cache-Lookup
X-Server-Id
EagleEye-TraceId
X-Host
X-Backend-Server
X-Country-Code
Surrogate-Control
X-Cloud-Trace-Context
X-Readtime
X-Akam-SW-Version
Cf-Railgun
Accept-Ch-Lifetime
X-Ruxit-JS-Agent
X-HW
X-Response-Time
Cache-Tag
P3p
Cf-Request-Id
X-Amz-Server-Side-Encryption
X-LiteSpeed-Cache
X-Ua-Device
Content-Location
Cross-Origin-Opener-Policy
X-Rack-Cache
X-Nginx-Upstream-Cache-Status
X-Nginx-Cache-Status
X-Trace
Service-Worker-Allowed
X-Content-Type
Request-Id
X-TraceId
X-Application-Context
Fastly-Restarts
X-Times
X-Vname
X-TtlSet
X-PC
X-Nf-Request-Id
X-Clacks-Overhead
Rating
X-Cnection
X-Midtier
X-Edge
X-Mcache
X-Vcap-Request-Id
X-FTR-Cache-Status
X-Browser-Type
X-Country-Code-Real
X-FTR-Balancer
X-FTR-Backend
X-FTR-Backend-Server
X-ESI
X-FTR-Expires
Origin-Trial
Edge-Control
X-Cache-TTL
X-Element-Page-Cache
X-D2id
X-FastCGI-Cache
Surrogate-Key
X-Oneagent-Js-Injection
X-Powered-By-Plesk
X-Cdn-Fetch
X-Exp-Id
X-Exp-Variant
X-Kinja-Revision
X-Kinja-Build
X-Kinja
X-GoogleNews-Bot
X-NWS-LOG-UUID
X-Kinja-Server
X-Country
X-Abt-Application-Version
X-Ac
X-Navigation-Version
X-Upstream
Verso
X-Mod-Pagespeed
X-ORACLE-DMS-RID
X-B3-TraceId
X-Amz-Rid
X-Url
Nginx-Cache
Akamai-GRN
X-Language
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
X-GitHub-Request-Id
X-Sol
X-Middleton-Display
Pagespeed
Display
X-ECACHE
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-Instrumentation
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-PDP-UNCACHING-HASH
S
X-Envoy-Decorator-Operation
Response
X-MS-InvokeApp
X-Middleton-Response
AR-PoweredBy
AR-ATIME
AR-Request-ID
Edge-Cache-Tag
X-Ratelimit-Limit
X-Goog-Hash
X-Distributor
X-Ser
X-Resp-Is-Stale
SPIisLatency
X-Edge-Location-Klb
X-SharePointHealthScore
SPRequestGuid
SPRequestDuration
X-Kinsta-Cache
X-ARC
X-Ttl
X-Amzn-Trace-Id
Access-Control-Request-Method
X-Ruxit-Js-Agent
X-NGENIX-Cache
X-Client-IP
X-Dw-Request-Base-Id
X-Shield-Request-Id
Front-End-Https
X-Content-Digest
X-Ezoic-Cdn
RTSS
X-Recruiting
X-Cache-Key
X-T
X-Varnish-TTL
Cache-Status
X-Version
X-Mg-S
X-Powered-CMS
Public-Key-Pins
TP-Cache
X-MSEdge-Ref
Fastcgi-Cache
X-HS-Cache-Config
X-HS-Content-Id
X-HS-Hub-Id
X-Accel-Expires
X-Ismobilevalue
Arr-Disable-Session-Affinity
X-Daa-Tunnel
AR-CACHE
X-Request-Device-Id
Cache-Tags
X-Cached
X-Cluster-Name
X-Request-Received
X-Request-Processing-Time
Realpath
X-Correlation-Id
X-Id
Content-MD5
X-Content-Security-Policy-Report-Only
X-HS-Combine-CSS
X-Forwarded-For
Ar-SID
YJS-ID
X-Fastly-Request-ID
X-Ua-Browser
Payment
X-Meli-Trace-Site
X-Meli-Trace-Bu
X-Meli-Trace-Platform
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-DIS-Request-ID
X-Newrelic-App-Data
X-Cambria-Cache-Control
X-Amz-Replication-Status
X-HP-Trace-Id
X-Jurisdiction
X-HP-Webp
X-Azure-Ref
X-COUNTRY
X-GUploader-UploadID
X-Xrds-Location
X-RateLimit-Remaining
X-HS-CF-Cache-Status
X-HS-Prerendered
X-Webkit-Csp
Content-Disposition
X-Ratelimit-Remaining
X-Server-Name
Count-Hit
X-Protected-By
X-Ratelimit-Reset
X-Unique-Id
X-AppVersion
X-Origin-Server
X-Az
X-Px
X-Activity-Id
X-SRCache-Fetch-Status
X-ORACLE-DMS-ECID
MicrosoftSharePointTeamServices
X-SRCache-Store-Status
X-Page-Id
X-Rid
X-Logged-In
X-Amz-Meta-S3cmd-Attrs
X-SERVER-NAME
Cleartype
Cross-Origin-Resource-Policy
X-Git-Hash
X-FB-Debug
X-VARITI-CCR
Cross-Origin-Embedder-Policy
Accept-Charset
X-Request-Handler-Origin-Region
X-Microsite
X-Proxy
X-Amzn-RequestId
X-Amz-Apigw-Id
X-Www-Served-By
X-TTL
Version
X-Load-Cache
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-LLID
X-TEC-API-ROOT
X-Goog-Metageneration
X-Forwarded-Proto
X-Geo-Country
X-Template
X-Varnish-Backend
X-CST
X-Upgrade-Enabled
X-PressLabs-Stats
Server-Node
X-Hits
Server-Name
X-B3-Sampled
X-WebKit-CSP-Report-Only
X-Hostname
X-App-Server
Healthy
X-Content-Options
Access-Control-Allow-Method
X-Frontend
Section-Io-Cache
X-Varnish-Grace
Viewport
X-TT
X-Device-Type
X-Grace
X-Fb-Rlafr
Fastly-SWR
Fastly-SIE
X-Varnish-Server
Alternate-Protocol
X-B
X-B3-TraceId-Primal
Mrf-Cache-Status
MRF-Tech
X-Request-Guid
X-Status
TCN
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Goog-Storage-Class
X-Contextid
Upgrade-Insecure-Requests
DC
Retry-After
AKAMAI-GRN
X-Magnolia-Registration
X-Amzn-Remapped-Content-Length
X-EdgeConnect-Cache-Status
Host
X-Requestid
X-Cache-Control
X-Cache-Age
MS-Author-Via
X-App-Version
Amp-Access-Control-Allow-Source-Origin
X-CSRF-Token
X-ProcessESI
X-RemovedCookies
X-Tt-Trace-Tag
X-Tt-Trace-Host
Frame-Options
X-Buckets
X-Debug
X-Hl-Ver
X-Origin-TTL
X-Origin-CC
X-Varnish-Ttl
X-Revision
X-Type
X-Response-Served-From
X-Original-Request-Id
SD-X-WS
X-Mobile
X-Oracle-Dms-Ecid
VIX-Pulpo-Node
X-Seen-By
X-ServerID
X-Backend-Name
X-G
X-Instance
X-INCAP-ABP
VIX-Pulpo-Upstream-Status
X-UUID
Cross-Origin-Embedder-Policy-Report-Only
Cross-Origin-Opener-Policy-Report-Only
X-Is-Bot
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-Adobe-Loc
X-Rendered-As
X-Akamai-Edgescape
X-Tumblr-User
X-N
X-NYM-Debug-Backend
X-Cache-Status-Check
X-Tumblr-Pixel
X-Adobe-Content
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Debug-IsPreview
X-WP-CF-Super-Cache-Cache-Control
X-Mg-Request-UUID
X-Debug-IsConnected
Access-Control-Request-Headers
X-Framework
X-Lambda-Id
Ms-Operation-Id
X-AB
X-Trace-Id
MS-CV
X-WP-CF-Super-Cache
X-Akamai-Request-ID2
NGB
X-RTag
X-Content-Powered-By
Section-Io-Id
X-Server-W
X-Storage
X-RM-Cache-TTL
X-Vcl-Version
Charset
Cache
X-ECache
X-Dc
Webserver
X-DataDome
X-Yandex-Req-Id
Filterid
Paypal-Debug-Id
X-Request-Site
X-Request-Bu
Accept-Language
X-B3-SpanId
X-Request-Platform
X-Cache-Time
Refresh
X-Cache-Hit
X-VC-Cache
X-URL
X-HITS
X-Tec-Api-Origin
SRV
X-Tec-Api-Version
X-Tec-Api-Root
X-Ms-Request-Id
Onion-Location
X-Ms-Version
X-Time
X-Node-Name
X-Real-IP
X-User-Agent
X-Region
X-F-Cache
Xet-Cookie
YJS-CacheStatus
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-CCDN-CacheTTL
CDN-RequestId
Priority
Liferay-Portal
X-HTML-Minification-Powered-By
X-Fastcgi-Cache
GEO-INFO
X-Timing-Wait
X-L-Path
X-Environment-Context
Selected-Fe
X-IPS-LoggedIn
X-Proxy-Build
X-LB-Cache
X-Mode
X-Pass-Why
X-Service
X-BYPASS-REASON
X-ProxyCache-Key
X-ProxyCache-Status
Cross-Origin-Window-Policy
X-Datadog-Parent-Id
X-Datadog-Sampled
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-Rule
X-Rocket-Nginx-Serving-Static
X-Origin
X-Rn-Rsrv
X-UPSTREAM-Address
X-Rewrite-Enabled
Country
X-Cache-Expired-At
X-VC
X-Tb
X-Drupal-Cache-Tags
X-Cacheable-TTL
Meta-Geo
X-JoinUs
X-SaId
Protected
Backend
X-Geo-Region
X-Is-Desktop
X-Is-Mobile
X-Browser-Name
X-Handled-By
X-Adobe-Source
X-Origin-Cache
X-Is-Mobile-Only
X-Is-Modern-Browser
X-Wix-Request-Id
X-VCT
X-Whom
X-Tcp-Rtt
X-Is-Tablet
X-Is-Supported-Browser
Apigw-Requestid
Mn-Server-Ip
X-Web-Node
X-Provided-By
X-Generation-Time
X-Proxy-Cache-Info
Fastcgi-Useragent
X-Proxied
X-Origin-Hint
Property-Id
X-Origin-Date
Expiry
X-RateLimit-Limit-Second
X-Servername
X-WP-CF-Super-Cache-Active
X-Routing-Service
X-Httpd
X-RateLimit-Remaining-Second
X-RCS-CacheZone
X-Loop
TWC-Connection-Speed
Url
Uber-Trace-Id
Web-Mar-Node
Webcakes-App-Name
Webcakes-Region
Webcakes-App-Version
TWC-Privacy
TWC-Locale-Group
TWC-GeoIP-City
TWC-Device-Class
TWC-GeoIP-Country
TWC-GeoIP-DMA
TWC-GeoIP-Region
TWC-GeoIP-LatLong
X-Connection-Hash
X-Cloudmap
X-Detected-As
X-FB-TRIP-ID
X-Vcache
X-Tncms
X-Varnish-Beresp-Grace
X-Extlb
ServerID
X-Zipkin-Id
X-Auth-Group-Type
X-Cache-Action
X-Format
X-Forwarded-Host
Atl-Traceid
X-Fetched-On
X-Director
OT-Force-Account-Verify
ServedBy
X-Locale
X-Alternate-Cache-Key
X-Tumblr-Pixel-3
X-App-Environment
DB-Nickname
X-Tumblr-Pixel-2
X-Storefront-Renderer-Rendered
X-Soup
X-Cms-Context
X-Hit
LB
X-Shopify-Stage
X-Skip-Cache
X-Redis-Cache
X-MP-GENERATED-AT
X-Hosted-By
X-Cdn-Origin
X-Logging-Id
X-Cluster
X-FW-Version
X-FW-Serve
X-FW-Hash
X-FW-Server
X-FW-Static
X-FW-Dynamic
X-FW-Type
X-NewRelic-App-Data
Environment
X-Say-Cacheable
X-Restarts
X-Urbn-Context-Path
X-Say-TTL
X-SayCDN-TTL
X-Cluster-Node
X-Served-From
X-Scope-Id
X-Cache-Host
Cache-Hits
Locale
X-Edge-Location
X-Urbn-Site-Id
X-Endurance-Cache-Level
X-Api-Version
X-Debug-Info
X-Labrador-Cache-Channel
X-Drupal-Cache-Contexts
Filters
X-S
X-Mly-Id
X-IPLB-Request-ID
X-PHP-Host
X-Cache-Debug
X-IPLB-Instance
X-Server-ID
X-R9-Blue-Green-Version
Node
X-XRDS-Location
Front
X-Platform
X-GEO
X-CDN-Cache-Status
AR-SID
X-No-Session
X-CDN-Forward
X-Optimistic-Header
X-CLOUD-TRACE-CONTEXT
Xserver
Countrycode
X-Tt-Logid
X-Varnish-Age
X-Sorting-Hat-ShopId
X-ShardId
X-UA
X-Sorting-Hat-PodId
X-ShopId
WPO-Cache-Status
X-Fastly-Request-Id
X-Varnish-Cache-Hits
X-Varnish-Beresp-Ttl
Cache-Tv-Group
X-WP-CF-Super-Cache-Cookies-Bypass
X-Lagoon
X-Generated-By
X-Presslabs-Stats
X-Wormhole-Sdk
X-B3-Traceid
X-SRV
X-Signature
X-B-Cache
X-NWS-UUID-VERIFY
Referer-Policy
X-CACHE-AGE
X-Webstats-RespID
X-Client-Ip
AMP-Access-Control-Allow-Source-Origin
X-Azure-Ref-OriginShield
X-Site-Version
Request-ID
X-Ua
From-Origin
X-Cache-Rule
X-Cache-Operation
Cache-Provider
X-PHP-Backend
X-IsAdmin
X-Accel-Version
X-Worker
X-Auto-Login
X-AWS-Id
Location
X-NF-Request-ID
X-VWS-Id
X-LJ-Flow-ID
Expect-Staple
X-Clientip
X-VC-TTL
Fl-Custom-Application
X-TA-CDN-Provider
X-Bc-Bl
X-Tx-Id
X-Upstream-Ct
X-Upstream-Ht
Xc-Version
Sid
X-External-Request-Id
X-A-Ccd
Redirect-Candidate
X-Cache-NE
Rendered-Blocks
WPO-Cache-Message
X-Tb-Optimization-Total-Bytes-Saved
Mail-Subject
X-Loc
X-SRCache-Key
Sslversion
MD5-Digest
X-Org
Origin
We-Hiring
N-Cache
X-Content-Age
Ngx.Var.Host
Source
Meta-Geo-Continent
X-Ec-GeoHdr
X-Vtex-Remote-Cache
X-Destination
X-Conf
Pragrma
Candidate-Md5Url
X-Bl-Debug
X-D
X-A-Wwc
X-ScT
X-Ig-Push-State
X-GeoCountry
Origin-Agent-Cluster
X-Aed
X-Ig-Origin-Region
X-GeoCode
X-A-Dam
X-S-Cookie
DCR-Decision-By
X-A-Dcw
X-A-Dgt
DCR-Processing-Time-Ms
X-BCube-Filmed-By
X-Server-IP
Host-ID
X-A
X-B-Cookie
X-Vdms-Version
X-PERF
X-Rojux
X-Ec-Fail
Lang
X-Application
S-Rt
X-ApacheServer
X-Developer
X-Xfnlog-Site
X-Litespeed-Cache-Control
Ha-Gx-Prefs
CDN-CachedAt
X-GeoIP-City
Gh-Request-Id
Cdnsip
Fastly-SSL
Gannett-Cam-Experience-Id
X-HS-Content-Campaign-Id
X-Hash
X-GoCache-CacheStatus
X-GeoIP-Region-Code
Cluster
Cdncip
CDN-PullZone
X-GeoIP-Country-Code
CDN-RequestCountryCode
CDN-RequestPullCode
CDN-Uid
CDN-RequestPullSuccess
CDN-EdgeStorageId
X-CGP
X-CUA
X-Forwarded-Site
X-Ee-Generated-By
Wxu-Next-Region
ServerName
RNT-Time
X-Action
X-Access
RNT-Machine
Store-Cloud-Cache
X-Ee-Origin
X-Depends
X-Fmm-Version
CDN-Cache
Web-Mar-Region
X-FC-Vary-Parameters
Wxu-Next-Hostname
Time-Cloud-Cache
Wxu-Next-Commit
X-Aicache-OS
X-AK-Request-ID
Odigeo-Trace-Id
Origin-Site
Powered-By
X-Contensis-Viewer-Groups
X-Core-Value
L5d-Success-Class
Log-Origin
X-Csrf-Jwt
X-Cms-Device
X-Ee-Request-Date
X-From
X-Epic-Correlation-Id
X-Eu-Site
X-Gamma-Serve
X-Bug-Bounty
X-Ee-Request-Id
X-Cache-FS-Status
X-Cache-Aspx
IsBot
X-PAYTM-SRV-ID
X-SIPLIST1
X-Old-Content-Length
X-Sigma-Backend
X-Origin-Expires
X-Sigma
X-Node-Id
X-Slack-Backend
X-VG-TLSProxy
X-VG-WebCache
X-Micro-Cache
X-Slack-Shared-Secret-Outcome
X-Vary-Devices
X-Section
X-SD-PageType
X-Req
X-Sucuri-Cache
X-Varnish-Beresp-Status
X-Varnish-Hostname
X-Policy
X-Rocket-Build-Number
X-Varnish-Authentication
X-V-Cache
X-Save-Cache
CF-IPCountry
X-Varnish-Director
X-Internal-TTL
X-Mvc-Supplant-Cachable
Apple-News-Services-Host
Apple-News-Services-Request-Url
X-ND-Cache
Apple-News-Services-Handled
Canary
Apple-News-Services-Parsed-Url
X-Reqid
X-Parent-Response-Time
X-NGINX-Cache
CloudFront-Viewer-Country
X-DefElseHash
X-We-Are-Hiring
X-DefHash
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-Date
X-Accel-Expires-Debug
X-AB-Test
X-Wikidot-Backend
X-SB
X-Render-Time
Country-Code
X-Ec-Custom-Error
Vix-Hermes-Req-Id
V-Age
User-Cache-Control
X-Pubstack
X-Region-Sid
X-Dispatcher-Server
X-Request-URI
X-CacheTTL
X-Acquia-Purge-Cdn-Unconfigured
X-Wikidot-Static-Cache
X-VarnishDD-TTL
X-Block-Status
X-Sn-Servicetimems
X-Bip
X-Proto
X-BBC-Edge-Cache-Status
X-Cache-Date
X-Thinkindot-L3
X-Via-Fastly
X-Thinkindot-L1
X-Thanos
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Backend-Instance
X-Viewer-Country
X-UA-Device-Type
X-Amz-Storage-Class
X-Akamai-Device-Characteristics
X-Varnish-Remaining-TTL
X-Fastly-Backend
X-Vmg-Version
X-Uri
X-Content-Length
X-Up
X-FORWARDED-FOR
X-App-Name
X-Shield-Cache-Expires
TDXMobile
X-Men
L
X-Level-Front-Cache
X-Jungle-Id
Fastly-Backend-Name
X-Ion-Hop
X-NMSegId
Machine
NM-Fastcgi-Cache
Nord-Request-ID
X-Generated-On
X-Cs
X-Nyt-Route
X-Ion-Healthy
DSUID
Azure-SiteName
Azure-RegionName
Azure-SlotName
Azure-Version
CDCHOST
Cache-Contol
Cmsid
Cmstype
Content-Script-Type
Content-Style-Type
X-HN
X-Hnp-Log
Azure-InstanceId
X-Op-Id-All
X-Mvc-Supplant-OutputCached
RewriteTeamHook
RewriteTestHook
Req-Svc-Chain
X-Varnish-CookieINHashed-On
X-Gdpr
X-Gen-Mode
X-Varnish-CookieHashed-On
Server-Host
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
X-Human
X-Air-Pt
X-Frame-Option
X-Path
Release
PFcat
Origin-EX
Origin-CC
X-Origin-Time
Pics-Label
X-Esi-Check
Tube-Return
Click-Count-Action-Start
Click-Count-Error
X-LSADC-Cache
X-Vercel-Id
Tube-Got-Results
C-Via
Cdn-Host
Tube-Get-Contents
Cdn-Request-Time
X-DPWN-IS-SECURE
Tube-Got-Eval
CacheControlHeader
X-ElasticPress-Query
X-Vercel-Cache
Fastly-GeoIP-CountryCode
X-Moov-Xdn-Version
X-ZONE
X-Moov-Xdn-Caching-Status
X-Cache-Id
X-Edge-Server
Producers
X-Moov-T
X-Location
X-B3-Trace-ID
Platform
X-Proxied-Request
X-Gzip
XM
X-Origin-Response-Time
Fastly-Drupal-HTML
Mime-Version
X-Sucuri-ID
X-Source
X-Pad
NGX
Load-Balancing
X-Cached-By
Debug
X-Refresh
Cookie
X-Varnish-Hits
X-APP
X-Debug-Service
GeoIp-Country-Code
X-Datadome
X-Via-Popn
X-Servedbyhost
X-Nginx-Cache-Key
X-Via-Popv
GeoIP-Latitude
X-Via-Poph
True-Client-Country-4JS
X-Srv
X-HA-Backend
X-TH-Server
Server-Ext
X-Nananana
X-DynaTrace-JS-Agent
Sever-Int
Server-Hostname
Server-ID
X-AIR-PT
Product
HA-Ipaddr
X-Litespeed-Tag
X-Webkit-CSP
X-TT-LOGID
Cdn
Show-Do-Not-Sell-Link
X-Amz-Meta-Cb-Modifiedtime
Traceparent
X-Cdn-Forward
X-Fpc
WZWS-RAY
X-Cache-VC
X-Ez-Minify-Html
X-Nc
X-Wa
X-Zone
X-GeoIP
X-Cache-Backend
X-Newrelic-Synthetics
X-User
X-B3-Parentspanid
HostName
DataCenter
Edge-Cache
X-LB-ID
X-Unity-Cache
Fastly-Drupal-Html
Tcn
MIME-Version
SID
X-VCL-Version
X-Lsadc-Cache
X-AC
Lb
X-Request-Start
X-CDN-Provider
Akamai-Mon-Iucid-Del
X-LB-NoCache
Resin-Trace
Yjs-Id
X-Vc
X-B3-Spanid
X-Nginx-Cache
X-Proxy-Cache-La3
Sm-Log-Id
X-Service-Response-Time
Xkeylog
Wsr-Cache
A
X-Scheme
Xkey-La3
X-Proxy-CacheR9
XkeyR9
Serverhost
X-TX-ID
X-Datacenter
X-LiteSpeed-Tag
CountryCode
X-HOST
Cs
Surrogated-Key
NtCoent-Length
Hostname
X-Lb-Id
X-CS
X-RateLimit-Limit
X-Pool
X-LiteSpeed-Cache-Control
X-Request-Host
X-WA
X-Dynatrace-Js-Agent
X-NodeID
X-HubSpot-Correlation-Id
X-Akamai-Pragma-Client-IP
Datacenter
Esi-Enabled
CDN
Uri
Cdn-Requestid
X-RequestId
X-API-Version
X-Udemy-Cache-App-Namespace
X-Vgn-Hpd-Reason
X-Aspnet-Version
X-NC
X-ID
X-Cache-Grace
X-Fastly-Backend-Reqs
X-VC-Age
X-FPC
X-Air-Source
X-Air-Trace-Id
X-Air-Hostname
Yak-Timeinfo
X-Styx-Origin-Id
Content-Secure-Policy
X-Via-JSL
X-HA-Device-Type
X-Stale
X-Styx-Info
Cr
Server-Id
X-Html-Minification-Powered-By
X-TIM-N
Pramga
Proxy-Firewall
X-DataCenter
X-HA-Bot-Classification
X-DynaTrace
X-HA-Application-Name
X-CSRF-TOKEN
N1-Cache
GeoIP-Country-Code
ServerHost
X-Var-Ttl
T-Server
Geoip-Latitude
X-Srcache-Fetch-Status
Edge-Copy-Time
X-Via-Edge
X-Srcache-Store-Status
X-Ez-Minify-Js
X-Via-SSL
X-Via-CDN
X-TimeS
RATING
X-Varnish-Beresp-TTL
W
X-Lb-Nocache
X-ServedByHost
Srv
X-Jobs
X-Swift-Error
X-Geolocation
From-Cache
Req-ID
X-Zen-Fury
X-Ha-Backend
X-Oracle-DMS-ECID
X-Wp-Cf-Super-Cache
X-Aspnetmvc-Version
X-Wp-Cf-Super-Cache-Cache-Control
X-App
X-MSEdge-Flight
X-MSEdge-Features
WP-Super-Cache
True-Client-IP
X-Via-PopN
X-Via-PopV
Expect-Ct
X-CACHE-KEY
X-Via-PopH
Cloudfront-Viewer-Country
X-Shardid
X-Wp-Cf-Super-Cache-Cookies-Bypass
X-Wp-Cf-Super-Cache-Active
X-Sorting-Hat-Shopid
X-LAGOON
X-Sorting-Hat-Podid
X-Shopid
Ohc-File-Size
Ohc-Cache-HIT
X-Cdn-Srv
On-Server
X-Ramcache
X-VServer
X-Key
X-Proxy-Cache-LA2
X-ByteArk-Cache
X-Correlation-ID
X-ByteArk-ReqID
X-Ssense-Shipping-Surcharge-Enabled
FSS-Cache
X-Ssense-Gql
X-Webkit-Csp-Report-Only
X-Web-Server
X-Check-Cacheable
X-Sucuri-Id
X-VTEX-Cache-Time
X-VTEX-Cache-Server
CF-Cached-On
X-Elasticpress-Query
X-Geo
X-Cdn-Cache-Status
Cl-Cache
X-Powered-By-VTEX-Cache
Ngx
X-Th-Server
X-ATG-Version
X-PageType
X-Serial
X-Fastly-Cache
Akamai-X-True-TTL
X-DC
WebServer
Cf-Ipcountry
X-Iplb-Instance
X-Iplb-Request-Id
X-Limited
X-MiniProfiler-Ids
Xkey-G-Jp
My-App
X-Beacon
Warning
Host-Name
X-Mg-Cache
X-WA-Info
FSS-Proxy
Cneonction
X-Env
X-Fastly-Cache-Status
X-Request-Url
Coldstone-Viewer-Currency
Coldstone-Viewer-Country-Region-Name
Coldstone-Viewer-Country
User-Agent