Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
CF-RAY
Expect-CT
Accept-Ranges
Pragma
X-XSS-Protection
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Xss-Protection
P3P
X-Cache-Hits
X-Served-By
X-UA-Compatible
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Request-Id
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
Access-Control-Allow-Credentials
X-AspNet-Version
Accept-CH
Content-Security-Policy-Report-Only
X-Runtime
Accept-CH-Lifetime
X-DNS-Prefetch-Control
X-Ua-Compatible
X-Drupal-Cache
X-Request-ID
X-Check
X-Cache-Status
X-Generator
Server-Timing
X-Cacheable
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Iinfo
X-Drupal-Dynamic-Cache
X-Content-Security-Policy
Access-Control-Expose-Headers
Feature-Policy
X-CDN
Content-Encoding
Status
X-AspNetMvc-Version
Upgrade
CF-Ray
Access-Control-Max-Age
X-Amz-Request-Id
X-Via
X-Amz-Id-2
Cf-Edge-Cache
Host-Header
EagleId
Keep-Alive
Request-Context
X-Backend
X-Cache-Group
X-AH-Environment
X-Robots-Tag
X-Server
X-UA-Device
X-Hacker
Permissions-Policy
X-Proxy-Cache
X-Turbo-Charged-By
Xkey
X-Ws-Request-Id
X-Rq
X-Age
X-Vhost
X-Amz-Version-Id
Cf-Apo-Via
X-Dispatcher
Allow
X-Swift-SaveTime
X-Swift-CacheTime
X-Server-Powered-By
X-LiteSpeed-Cache
Grace
Ali-Swift-Global-Savetime
X-Varnish-Cache
X-Dns-Prefetch-Control
X-Page-Speed
X-Pingback
X-OneAgent-JS-Injection
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Cache-Lookup
X-Device
Cf-Railgun
X-Backend-Server
EagleEye-TraceId
X-Host
X-Server-Id
X-WebKit-CSP
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Response-Time
X-Readtime
X-Akam-SW-Version
Surrogate-Control
X-HW
Request-Id
X-Ruxit-JS-Agent
X-Cloud-Trace-Context
X-Node
Content-Location
X-Application-Context
P3p
X-Nginx-Cache-Status
X-Nginx-Upstream-Cache-Status
X-Country
X-NWS-LOG-UUID
Service-Worker-Allowed
X-Country-Code
X-Content-Type
X-CST
X-Clacks-Overhead
Cache-Tag
X-Trace
X-Litespeed-Cache
X-Url
Rating
X-Rack-Cache
X-Amz-Server-Side-Encryption
X-Times
X-FTR-Request-ID
X-TtlSet
X-PC
X-Vname
Nginx-Cache
X-Daa-Tunnel
X-Webkit-Csp
Cross-Origin-Opener-Policy
X-Edge
X-Mcache
X-Midtier
X-Server-Name
X-Browser-Type
X-Powered-By-Plesk
X-Cnection
X-ESI
X-Oneagent-Js-Injection
X-GitHub-Request-Id
X-ECACHE
X-D2id
Edge-Control
X-Element-Page-Cache
Verso
X-Ac
X-Upstream
AR-ATIME
X-MS-InvokeApp
AR-SID
AR-PoweredBy
AR-Request-ID
X-GoogleNews-Bot
X-Kinja
X-Exp-Id
X-Kinja-Server
X-Exp-Variant
X-Kinja-Build
X-Kinja-Revision
X-Cdn-Fetch
Accept-Ch-Lifetime
X-Cache-TTL
X-B3-TraceId
X-Vcap-Request-Id
X-Ser
X-Navigation-Version
X-FastCGI-Cache
X-Abt-Application-Version
AR-CACHE
X-Dw-Request-Base-Id
SPIisLatency
SPRequestDuration
X-Mod-Pagespeed
SPRequestGuid
X-SharePointHealthScore
Fastly-Restarts
X-NF-Request-ID
X-Amz-Rid
X-Erf-Bev-Bev-Is-Generated
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Instrumentation
X-Erf-Bev-Bev
X-Client-IP
Display
X-Sol
X-Middleton-Display
Pagespeed
Edge-Cache-Tag
X-Edge-Location-Klb
X-Kinsta-Cache
X-Mg-S
S
X-Powered-CMS
X-Goog-Hash
Response
X-Middleton-Response
Access-Control-Request-Method
X-Version
Cache-Status
X-Aws-Lambda-Call-Status
X-VARITI-CCR
X-Amzn-Trace-Id
X-Fastly-Request-ID
X-ARC
X-Ruxit-Js-Agent
X-Cache-Key
RTSS
X-Content-Digest
X-Ratelimit-Limit
X-TraceId
Cross-Origin-Resource-Policy
X-RateLimit-Remaining
X-T
X-Forwarded-For
Realpath
X-TTL
X-Recruiting
X-PDP-UNCACHING-HASH
X-Ua-Device
X-Varnish-TTL
Fastcgi-Cache
X-MSEdge-Ref
Front-End-Https
X-Cached
X-Ratelimit-Remaining
X-Correlation-Id
MS-Author-Via
Content-MD5
X-HS-Content-Id
X-HS-Hub-Id
X-HS-Cache-Config
X-Ua-Browser
X-Shield-Request-Id
X-FTR-Backend-Server
X-FTR-Balancer
X-FTR-Backend
X-Country-Code-Real
X-Request-Processing-Time
X-FTR-Cache-Status
X-Protected-By
Server-Node
X-Request-Received
Payment
Public-Key-Pins
X-Frontend
MicrosoftSharePointTeamServices
X-ORACLE-DMS-RID
X-LLID
X-HS-Combine-CSS
TP-Cache
X-Forwarded-Proto
Arr-Disable-Session-Affinity
X-Server-ID
X-SRCache-Fetch-Status
X-SRCache-Store-Status
Pinterest-Generated-By
X-Distributor
Pinterest-Version
X-FTR-Expires
X-Pinterest-Rid
X-HP-Trace-Id
X-HP-Webp
X-Jurisdiction
X-Accel-Expires
Count-Hit
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-GUploader-UploadID
X-NODE
X-Origin-Server
X-LB-Cache
X-PressLabs-Stats
X-Ezoic-Cdn
X-Request-Handler-Origin-Region
X-Microsite
X-Az
Host
X-AppVersion
X-Activity-Id
X-Content-Security-Policy-Report-Only
Mrf-Cache-Status
X-Www-Served-By
MRF-Tech
X-Newrelic-App-Data
X-B3-TraceId-Primal
X-Varnish-Server
X-TEC-API-VERSION
Cache-Tags
X-Cluster-Name
X-App-Server
X-Amz-Meta-S3cmd-Attrs
X-Varnish-Backend
X-TEC-API-ORIGIN
X-TEC-API-ROOT
Retry-After
Accept-Charset
Server-Name
X-Ttl
Cleartype
X-ORACLE-DMS-ECID
X-Hits
X-CSRF-Token
X-Goog-Metageneration
X-Hostname
X-Envoy-Decorator-Operation
Accept-Ch
Referer-Policy
X-NGENIX-Cache
X-Geo-Country
X-Unique-Id
Filterid
X-Upgrade-Enabled
X-Git-Hash
Access-Control-Allow-Method
X-Azure-Ref
TP-L2-Cache
X-Seen-By
X-CCDN-Origin-Time
X-DIS-Request-ID
X-Tt-Trace-Host
X-Hcs-Proxy-Type
X-Tt-Trace-Tag
X-CCDN-CacheTTL
X-Proxy
X-Load-Cache
X-F-Cache
X-Origin-Cache-Key
X-Revision
X-Id
X-XRDS-LOCATION
X-Request-Guid
X-Logged-In
X-Trace-Id
X-B
X-Cache-Control
Healthy
Section-Io-Cache
X-Grace
DC
X-FB-Debug
X-Amzn-RequestId
X-Amz-Apigw-Id
X-Contextid
X-Type
X-B3-Sampled
TCN
X-TT
X-Debug
X-Fb-Rlafr
Paypal-Debug-Id
X-N
X-Mobile
Viewport
X-Page-Id
X-Debug-Info
X-Px
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-Time
X-Varnish-Ttl
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Storage-Class
Fastly-SWR
Fastly-SIE
X-Oracle-Dms-Ecid
X-Whom
X-Webkit-CSP
X-Via-JSL
Content-Disposition
X-Datadog-Sampling-Priority
X-Datadog-Trace-Id
Charset
X-Datadog-Parent-Id
X-Varnish-Grace
X-RateLimit-Limit
X-Template
X-Content-Options
Version
X-Origin-Cache
X-Cache-Grace
X-Magnolia-Registration
X-Oracle-Dms-Rid
Surrogate-Key
X-App-Environment
X-Wix-Request-Id
X-Node-Name
X-Language
X-Signature
X-B-Cache
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
SRV
X-RemovedCookies
X-ProcessESI
X-B3-SpanId
X-Rule
SD-X-WS
Ms-Operation-Id
MS-CV
X-Datadog-Sampled
X-RTag
X-UUID
X-Tumblr-User
X-Tumblr-Pixel-1
X-Debug-IsConnected
X-Debug-IsPreview
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Amz-Replication-Status
X-Hl-Ver
X-EdgeConnect-Cache-Status
X-Yottaa-Optimizations
X-Backend-Name
X-Storage
X-Yottaa-Metrics
X-Instance
ServerID
X-FW-Server
X-FW-Version
X-FW-Static
X-Cacheable-TTL
X-FW-Hash
X-G
X-FW-Serve
X-FW-Dynamic
X-Adobe-Content
NGB
GEO-INFO
X-Adobe-Loc
X-Cache-Age
X-FW-Type
X-Is-Bot
X-Rendered-As
X-NYM-Debug-Backend
X-IPS-LoggedIn
X-NWS-UUID-VERIFY
X-Cache-Hit
X-User-Agent
X-Region
X-Status
X-L-Path
X-Environment-Context
X-Proxy-Cache-Info
X-Amzn-Remapped-Content-Length
Country
X-Device-Type
X-Real-IP
Countrycode
Liferay-Portal
X-ServerID
X-Rid
X-Source
X-WP-CF-Super-Cache-Active
Cross-Origin-Window-Policy
X-Sucuri-Cache
Akamai-GRN
X-Sucuri-ID
OT-Force-Account-Verify
X-Servername
X-RM-Cache-TTL
X-RateLimit-Reset
Front
From-Origin
X-VC-Cache
X-Framework
X-WebKit-CSP-Report-Only
X-UA
X-Air-Pt
X-Wormhole-Sdk
Upgrade-Insecure-Requests
Amp-Access-Control-Allow-Source-Origin
Backend
X-Mode
X-Air-Source
X-Air-Hostname
X-AB
X-Air-Trace-Id
X-Xrds-Location
X-URL
X-Content-Powered-By
X-Akamai-Request-ID2
X-Nginx-Cache
X-INCAP-ABP
X-Cache-Time
Xet-Cookie
X-Handled-By
Refresh
X-RID
X-Endurance-Cache-Level
X-VC
Accept-Language
X-Ratelimit-Reset
X-Edge-Location
Meta-Geo
X-RCS-CacheZone
X-Rn-Rsrv
Frame-Options
X-JoinUs
X-SaId
X-Rewrite-Enabled
X-Xfnlog-Site
Filters
X-UPSTREAM-Address
Webcakes-App-Version
Webcakes-App-Name
Webcakes-Region
X-Git-Commit
X-AWS-Id
X-Container-Uri
Cache
TWC-Locale-Group
X-Cache-Operation
TWC-Privacy
X-Origin-Hint
X-No-Session
X-Provided-By
Url
X-LJ-Flow-ID
X-Reqid
X-HTML-Minification-Powered-By
TWC-GeoIP-LatLong
ServedBy
TWC-GeoIP-Country
TWC-Connection-Speed
TWC-Device-Class
X-Origin-CC
X-Tumblr-Pixel-2
X-Origin-TTL
Property-Id
X-Cluster
X-Cache-Rule
X-VWS-Id
X-PHP-Host
X-Cms-Context
X-SRV
X-Restarts
X-Accel-Version
WPO-Cache-Message
WPO-Cache-Status
X-Origin-Date
Web-Mar-Node
X-Akamai-Edgescape
X-Labrador-Cache-Channel
X-Webstats-RespID
X-Proxied
Mn-Server-Ip
X-Cache-Debug
X-R9-Blue-Green-Version
X-Cloudmap
X-Site-Version
X-Hosted-By
X-Served-From
X-Extlb
Cache-Hits
X-Varnish-Cache-Hits
X-Locale
X-Logging-Id
Atl-Traceid
X-Zipkin-Id
X-Routing-Service
X-IPLB-Request-ID
X-Redis-Cache
X-IPLB-Instance
X-ProxyCache-Status
X-BYPASS-REASON
X-ProxyCache-Key
X-Ms-Request-Id
X-Fetched-On
X-Drupal-Cache-Tags
Section-Io-Id
Selected-Fe
X-Format
X-Frame-Option
Webserver
X-Proxy-Build
X-Director
X-Ms-Version
X-Adobe-Source
X-Azure-Ref-OriginShield
X-Web-Node
X-VCT
X-Skip-Cache
X-Tncms
X-Loop
X-Scope-Id
X-Upstream-Ct
X-Timing-Wait
X-DataDome
X-Varnish-Age
X-Upstream-Ht
X-Lambda-Id
Apigw-Requestid
X-Soup
X-Shopify-Stage
X-Tcp-Rtt
X-Storefront-Renderer-Rendered
X-Detected-As
X-Cache-Host
X-Drupal-Cache-Contexts
X-Sorting-Hat-ShopId
X-Generation-Time
Access-Control-Request-Headers
X-Sorting-Hat-PodId
X-Generated-By
X-Forwarded-Host
X-Browser-Name
X-Is-Tablet
X-S
X-Say-TTL
X-Origin
X-Say-Cacheable
X-Alternate-Cache-Key
X-ShopId
X-ShardId
X-Httpd
X-Is-Desktop
X-Is-Mobile
X-Is-Supported-Browser
X-Varnish-Beresp-Grace
X-SayCDN-TTL
X-Tb
X-Geo-Region
Xserver
X-CDN-Forward
X-Cache-Status-Check
X-Thinkindot-L3
X-CMSURLCustom
Thinkindot-Control
X-Shield-Cache-Expires
Thinkindot-CacheControl
TDXMobile
Thinkindot-CacheControl-Type
X-Buckets
X-GeoCountry
X-GeoCode
X-Optimistic-Header
X-Lagoon
X-Vcache
X-Cdn-Origin
X-Request-URI
X-Rocket-Nginx-Serving-Static
X-WP-CF-Super-Cache-Cookies-Bypass
LB
X-TA-CDN-Provider
Source
X-Worker
Azure-RegionName
Azure-InstanceId
Azure-SiteName
Azure-SlotName
Azure-Version
Onion-Location
Expiry
Protected
X-Fastcgi-Cache
AMP-Access-Control-Allow-Source-Origin
X-Api-Version
X-Pass-Why
Node
X-Vercel-Cache
Fastcgi-Useragent
X-Connection-Hash
X-Vercel-Id
X-Vcl-Version
CDN-Cache
CDN-CachedAt
CDN-RequestPullSuccess
CDN-Uid
X-App-Version
CDN-EdgeStorageId
CDN-RequestPullCode
CDN-PullZone
CDN-RequestCountryCode
Cross-Origin-Embedder-Policy
X-ID
X-Cache-Expired-At
X-Ismobilevalue
X-PHP-Backend
X-Tumblr-Pixel-3
X-Tec-Api-Version
X-GEO
X-Tec-Api-Root
X-Tec-Api-Origin
Environment
X-Tt-Logid
Cdn-Requestid
X-Cache-Server
X-XRDS-Location
Sid
Alternate-Protocol
DB-Nickname
X-Fastly-Request-Id
X-Server-W
Uber-Trace-Id
X-Proxy-Cache-Status
Priority
X-Cache-Action
X-Urbn-Context-Path
X-Urbn-Site-Id
Locale
X-Cluster-Node
X-B3-Traceid
X-Jobs
CF-IPCountry
HostName
User-Cache-Control
CDN-RequestId
X-Mg-Request-UUID
Fusion-Component-Id
Cache-Tv-Group
Fusion-Content-Id
Fusion-Content-Source
Fusion-Source
Fusion-Template-Id
Fusion-Deployment-Id
X-MP-GENERATED-AT
X-Nf-Request-Id
X-FB-TRIP-ID
X-Client-Ip
Origin-Agent-Cluster
X-Auth-Group-Type
X-Org
X-Content-Age
Origin
Ngx.Var.Host
X-Esi-Check
Odigeo-Trace-Id
X-Rojux
Rendered-Blocks
Candidate-Md5Url
X-Level-Front-Cache
X-Gen-Mode
A
X-ScT
X-SB
X-Bc-Bl
X-Epic-Correlation-Id
X-Gzip
Meta-Geo-Continent
DCR-Decision-By
Gannett-Cam-Experience-Id
X-ND-Cache
X-Cache-Id
X-Bl-Debug
X-Conf
Edge-Cache
DCR-Processing-Time-Ms
X-Developer
X-Generated-On
Lang
Magicmarker
MD5-Digest
X-NCache
X-BCube-Filmed-By
X-LSADC-Cache
X-Block-Status
X-Powered-By-VTEX-Cache
Content-Secure-Policy
Server-Host
X-Varnish-Hostname
X-A-Ccd
X-A-Dam
X-A-Dcw
X-D
X-A
X-DC
Sslversion
X-Dispatcher-Server
X-A-Dgt
X-A-Wwc
X-VTEX-Cache-Server
X-VTEX-Cache-Time
X-Vtex-Remote-Cache
X-Viewer-Country
X-Aed
X-Cache-NE
X-Vdms-Version
X-Hnp-Log
Wxu-Next-Hostname
Wxu-Next-Region
Wxu-Next-Commit
X-Op-Id-All
Surrogated-Key
X-Ec-Fail
X-SRCache-Key
X-Ec-GeoHdr
X-Jungle-Id
T-Server
Vix-Hermes-Req-Id
X-Ig-Push-State
X-Ig-Origin-Region
X-TIM-N
X-Origin-Response-Time
X-Varnish-Beresp-Ttl
X-Tx-Id
X-NMSegId
CDCHOST
X-Cache-Info
X-Node-Id
Content-Style-Type
Content-Script-Type
X-GeoIP-Region-Code
X-Nyt-Route
X-Cache-Bucket
Cdn-Request-Time
Cdn-Host
X-GeoIP-Country-Code
Sever-Int
X-HN
Server-Hostname
Server-Ext
Ssr
X-Cache-TTL-Remaining
X-HS-Content-Campaign-Id
X-Gdpr
X-Amz-Storage-Class
X-Auto-Login
X-Backend-Instance
Req-ID
Host-ID
X-Nginx-Cache-Key
Fastly-SSL
Fastly-Backend-Name
X-Clientip
X-Mvc-Supplant-Cachable
X-App-Name
X-Cdn-Srv
PFcat
NM-Fastcgi-Cache
X-Bip
Cache-Provider
X-Proto
X-VG-WebCache
X-ECache
X-Fastly-Cache
X-Via-Fastly
X-Policy
X-Service
X-UA-Device-Type
X-Scheme
X-Zone
X-Request-Time
X-Geo-Header
X-VarnishDD-TTL
X-Varnish-Director
X-Region-Sid
X-Core-Value
X-Req
X-RateLimit-Remaining-Second
X-Vdms-Path
X-Pubstack
X-Request-Start
X-RateLimit-Limit-Second
X-Fmm-Version
X-FC-Vary-Parameters
X-Platform
X-Test
X-Debug-Cache-Fetch
X-Device-Os
X-Erf-Stays-Pdp-Viaduct-Migration-Web-V2
X-Custom-Header
X-Edge-Server
C-Via
X-SD-PageType
AKAMAI
X-GeoIP-City
X-Forwarded-Site
X-Debug-Cache-Store
XM
X-Origin-Expires
X-Thanos
X-Origin-Time
X-V-Cache
X-PAYTM-SRV-ID
X-Csrf-Jwt
Tube-Get-Contents
Tube-Got-Results
Tube-Return
X-Varnish-Beresp-Status
X-Var-Ttl
W
Web-Mar-Region
We-Hiring
Tube-Got-Eval
X-Aicache-OS
Country-Code
X-Dc
X-BBC-Edge-Cache-Status
X-B3-Trace-ID
V-Age
X-LiteSpeed-Cache-Control
X-GoCache-CacheStatus
X-Cache-Backend
X-GeoIP
X-We-Are-Hiring
X-WA-Info
X-Access
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Varnishpool
X-Acquia-Purge-Cdn-Unconfigured
X-VG-TLSProxy
X-Human
X-AK-Request-ID
X-Tb-Optimization-Total-Bytes-Saved
X-CUA
Release
Gh-Request-Id
Ha-Gx-Prefs
Fastly-GeoIP-CountryCode
Esi-Enabled
X-From
HA-Ipaddr
X-Pool
X-Proxied-Request
Machine
L5d-Success-Class
L
DSUID
Apple-News-Services-Handled
Apple-News-Services-Request-Url
Cdnsip
Cdncip
Cache-Key
Click-Count-Action-Start
Click-Count-Error
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Cluster
X-NodeID
Mail-Subject
X-Eu-Site
Canary
Redirect-Candidate
Pramga
Powered-By
Req-Svc-Chain
X-Men
X-Section
X-Fastly-Backend
RNT-Time
RNT-Machine
X-Ec-Custom-Error
X-Loc
Origin-EX
X-Mly-Id
X-CGP
X-Mvc-Supplant-OutputCached
X-Micro-Cache
On-Server
X-Location
Origin-CC
X-Uri
X-AIR-PT
X-DPWN-IS-SECURE
X-Contensis-Viewer-Groups
Adler-Geo
Proxy-Firewall
X-Accel-Expires-Debug
X-SVT-ORM-VERSION
X-Cache-Aspx
X-Request-Host
X-Response-Served-From
X-CacheTTL
X-Date
X-Sn-Servicetimems
X-Up
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Hash
X-Server-IP
X-Original-Request-Id
X-SVT-ORM-RULES
Platform
Yak-Timeinfo
Producers
True-Client-Country-4JS
X-Ad-Load-Variation
Is-Eu
NGX
X-Varnish-Authentication
X-Newrelic-Synthetics
X-Pad
Mime-Version
X-Cs
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
X-Varnish-Hits
X-DefElseHash
X-Render-Time
X-PERF
X-DefHash
X-LB-ID
X-ApacheServer
WP-Super-Cache
Debug
X-TT-LOGID
X-Depends
X-CACHE-GROUP
X-HITS
X-Refresh
X-Nananana
X-NGINX-Cache
X-Via-Poph
Pics-Label
X-Datadome
X-Via-Popn
X-Via-Popv
X-HA-Backend
X-Cache-FS-Status
Fastly-Drupal-HTML
SID
X-VHOST
X-Parent-Response-Time
CloudFront-Viewer-Country
X-Akamai-Transformed
Locid
X-Servedbyhost
Datacenter
X-M-Reqid
X-VC-TTL
X-M-Log
X-CACHE-AGE
Server-Info
GeoIP-Latitude
X-Amz-Meta-Cb-Modifiedtime
X-LB-NoCache
X-Cached-By
BehaviorPad-Version
X-DynaTrace-JS-Agent
X-Litespeed-Tag
Fastly-Drupal-Html
X-Platform-Router
X-Platform-Processor
X-Platform-Cluster
X-CDN-Cache-Status
X-B3-Parentspanid
X-LiteSpeed-Tag
X-VCache
Server-ID
Ngx-Var-Key
X-APP
X-Old-Content-Length
Cf-Ipcountry
Resin-Trace
GeoIp-Country-Code
X-CS
X-TIME
X-Moov-Xdn-Version
Cdn
X-Vgn-Hpd-Reason
X-Nc
X-Moov-T
X-TH-Server
X-Wa
X-Content-Length
X-COUNTRY
X-IAuth-Set-Uid
FSS-Cache
Cross-Origin-Embedder-Policy-Report-Only
NtCoent-Length
X-TX-ID
Tcn
Uri
True-Client-Ip
X-Esi
X-Fpc
CDN
X-HostName
X-Presslabs-Stats
X-SERVER-NAME
X-ZONE
X-Application
True-Client-IP
X-Destination
Cf-Device-Type
X-External-Request-Id
X-S-Cookie
X-B-Cookie
X-Dispatcher-Number
X-User
X-Srv
Serverhost
X-Vc
X-Varnish-Beresp-TTL
X-NewRelic-App-Data
X-Zen-Fury
X-Oracle-DMS-ECID
X-Dynatrace-Js-Agent
Vc-Max-Age
S-Rt
GeoIP-Country-Code
X-RequestId
Product
X-Cdn-Forward
X-Cache-Date
X-Rocket-Build-Number
X-HOST
X-Instance-Name
X-Sigma-Backend
X-Sigma
Srv
Request-ID
X-API-Version
X-FPC
X-NC
X-VServer
X-Cdn-Cache-Status
X-Dispatch
X-WA
X-CACHE-KEY
X-Segment-20210421
X-Ckpd-Fst-Backend
X-Branch-Name
Load-Balancing
Geoip-Latitude
X-DynaTrace
Hostname
X-APP-VERSION
X-Geo
X-B3-Spanid
X-Webkit-Csp-Report-Only
Srvid
X-FL-QIT-DEBUG
ServerName
Server-Id
X-Lb-Nocache
X-Providence-Cookie
X-Is-Crawler
X-Bug-Bounty
X-Aspnet-Duration-Ms
X-Flags
X-DataCenter
X-Route-Name
CacheControlHeader
X-Correlation-ID
Ohc-File-Size
Type
X-ServedByHost
X-Ua
DataCenter
Origin-Trial
X-VCL-Version
X-Nf-Ats-Version
X-Page-View
X-HubSpot-Correlation-Id
X-Nf-Country
X-Nf-Language
X-Irp-Debug
Cloudfront-Viewer-Country
Epwk-X-Cache
Lb
X-Cache-Ttl
X-Via-PopH
X-Via-PopN
Cl-Cache
User-Agent
X-Sql-Count
X-Ha-Backend
X-App
Cross-Origin-Opener-Policy-Report-Only
X-Http-Reason
X-Via-PopV
X-Sql-Duration-Ms
PICS-Label
X-Srcache-Fetch-Status
Rtss
X-Srcache-Store-Status
X-Vmg-Version
X-Via-CDN
Cmsid
X-SIPLIST1
X-Akamai-Device-Characteristics
X-Via-Edge
Edge-Copy-Time
Cmstype
Cneonction
X-Via-SSL
ServerHost
X-MiniProfiler-Ids
X-Gamma-Serve
X-Owner
X-Info
IsBot
Ohc-Cache-HIT
X-Sqd-Ctime
X-Web-Server
X-Qloud-Router
X-Core-Mission
Sm-Log-Id
X-Service-Response-Time
XkeyRZ
Warning
X-Proxy-CacheRZ
X-Acquia-Application-Trace
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Lb-Id
X-Limited
X-MSEdge-Features
X-Datacenter
MIME-Version
X-MSEdge-Flight
Xc-Version
X-Sqd-Stime
X-Acquia-Site
Servername
WZWS-RAY
CountryCode
X-Litespeed-Cache-Control
X-LAGOON
X-IN-APIGATEWAY
X-IN-APIGATEWAYSSL
X-Snapshot-Date
X-Check-Cacheable
X-Serial
X-RAMCache
X-Akamai-Pragma-Client-IP
X-Requestid
N-Cache
X-Th-Server
X-Ramcache
X-Amz-Meta-Sha256
X-Udemy-Cache-App-Namespace
X-Amz-Meta-S3b-Last-Modified
X-Fastly-Country-Code
Ngx
X-Dw-Trace-Id