Threat Level: green Handler on Duty: Russ McRee

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
X-Frame-Options
Strict-Transport-Security
X-Content-Type-Options
Accept-Ranges
Last-Modified
X-Powered-By
Pragma
CF-Cache-Status
X-XSS-Protection
CF-RAY
Link
ETag
Expect-CT
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
X-Cache-Hits
X-Amz-Cf-Pop
X-UA-Compatible
X-Amz-Cf-Id
Referrer-Policy
X-Served-By
X-Varnish
Alt-Svc
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Download-Options
X-Request-Id
X-AspNet-Version
Access-Control-Allow-Credentials
X-Runtime
X-Drupal-Cache
X-Adblock-Key
X-Check
X-Xss-Protection
X-Cache-Status
X-Generator
Content-Security-Policy-Report-Only
X-Permitted-Cross-Domain-Policies
X-Request-ID
X-Cacheable
X-Template
X-Language
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-AspNetMvc-Version
X-FRAME-OPTIONS
X-Buckets
Status
X-Content-Security-Policy
X-CDN
Upgrade
Content-Encoding
Access-Control-Expose-Headers
X-Ua-Compatible
Access-Control-Max-Age
Keep-Alive
X-Kinja-Server-Push
X-Turbo-Charged-By
X-Drupal-Dynamic-Cache
P3p
Xkey
X-Pass-Why
X-Cache-Group
X-AH-Environment
X-Envoy-Upstream-Service-Time
CF-Ray
X-Backend
X-Via
X-Age
X-Server
X-Amz-Request-Id
X-Amz-Id-2
X-Robots-Tag
X-Server-Powered-By
X-Page-Speed
X-Pingback
X-Ws-Request-Id
EagleId
X-Proxy-Cache
X-Nginx-Cache-Status
X-UA-Device
X-Hacker
Request-Context
X-Varnish-Cache
Feature-Policy
Server-Timing
Grace
Cf-Railgun
X-Swift-CacheTime
X-Swift-SaveTime
X-Amz-Version-Id
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
Report-To
X-Dns-Prefetch-Control
X-Rq
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Server-Id
X-WebKit-CSP
X-Host
X-Device
X-OneAgent-JS-Injection
EagleEye-TraceId
X-Origin-Cache
X-Response-Time
Content-Location
X-Ac
X-Node
Surrogate-Control
X-Vhost
X-Readtime
Request-Id
X-Cloud-Trace-Context
X-Backend-Server
X-Dispatcher
X-Origin-Upstream-Status
X-Cnection
X-HW
X-Application-Context
X-ORACLE-DMS-ECID
Fusion-Content-Source
Fusion-Source
Fusion-Content-Id
Fusion-Component-Id
Fusion-Template-Id
X-DataDome
X-ORACLE-DMS-RID
X-Cache-Lookup
X-Mod-Pagespeed
NEL
X-Rack-Cache
Rating
Edge-Control
X-Country
X-Akam-SW-Version
X-Clacks-Overhead
X-Ruxit-JS-Agent
Pinterest-Generated-By
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Allow
X-DynaTrace
X-Country-Code
X-Instart-Request-ID
Accept-Ch
X-Varnish-TTL
X-Goog-Hash
X-Vname
X-TtlSet
X-PC
X-FTR-Request-ID
X-TTL
X-ESI
Verso
Accept-Ch-Lifetime
X-Powered-By-Plesk
Service-Worker-Allowed
Content-MD5
X-Url
X-B3-TraceId
X-Forwarded-Proto
X-Version
X-MS-InvokeApp
X-GitHub-Request-Id
X-Kinja
X-Kinja-Build
X-Kinja-Revision
X-GoogleNews-Bot
X-Exp-Variant
X-Use-Magma
X-Exp-Id
X-Cdn-Fetch
X-Kinja-Server
Edge-Cache-Tag
RTSS
AR-ATIME
AR-CACHE
AR-PoweredBy
Ar-Sid
AR-Request-ID
X-Px
X-D2id
X-Debug
X-Server-Name
SPRequestGuid
Charset
X-Abt-Application-Version
X-Vcache
X-Amz-Server-Side-Encryption
X-NF-Request-ID
X-Cached
X-Accel-Expires
X-Sol
X-Middleton-Display
X-MSEdge-Ref
X-Middleton-Response
Response
Display
Pagespeed
X-Amz-Rid
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-Vcap-Request-Id
Arr-Disable-Session-Affinity
X-Powered-CMS
X-Navigation-Version
X-Fastcgi-Cache
Pinterest-Version
X-Pinterest-Rid
X-SharePointHealthScore
TCN
X-SRCache-Store-Status
X-Trace
X-SRCache-Fetch-Status
X-Cdn
X-VARITI-CCR
Realpath
Public-Key-Pins
X-Client-IP
Cache-Tag
Access-Control-Request-Method
X-Fastly-Request-ID
X-Ser
MS-Author-Via
S
X-DynaTrace-JS-Agent
X-Upstream
X-Shard
SPIisLatency
SPRequestDuration
Nginx-Cache
X-Id
Mrf-Cache-Status
MRF-Tech
X-Mrf-Item-Lastmod
X-Mrf-Section-Lastmod
X-Ezoic-Cdn
X-B3-TraceId-Primal
X-Hp-Webp
X-Content-Type
X-Forwarded-For
X-T
X-Grace
X-Amz-Meta-S3cmd-Attrs
X-Amzn-Trace-Id
Nel
DynaTrace
X-ASPNET-VERSION
X-Recruiting
Front-End-Https
X-Hits
X-Aspnet-Version
X-Edge-O15-RID
Fastcgi-Cache
X-Varnish-Age
ServerID
X-Server-ID
MicrosoftSharePointTeamServices
X-Dw-Request-Base-Id
X-DIS-Request-ID
X-Mobile-URL
X-Node-Name
X-Element-Page-Cache
NR-ENABLED
X-Content-Digest
X-Cache-TTL
X-FTR-Expires
X-HS-Hub-Id
X-HS-Content-Id
X-Country-Code-Real
X-FTR-Cache-Status
X-HS-Combine-CSS
X-HS-Cache-Config
X-Frontend
Powered
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-GUploader-UploadID
X-Goog-Metageneration
X-Goog-Storage-Class
X-Goog-Generation
X-Jurisdiction
X-FTR-Backend
X-FTR-DC
X-FTR-Realm
X-FTR-Backend-Server
X-FTR-Balancer
Server-Name
Alternate-Protocol
Server-Node
TP-L2-Cache
X-Logged-In
TP-Cache
X-Correlation-Id
X-Request-Processing-Time
X-Request-Received
AMP-Access-Control-Allow-Source-Origin
X-Microsite
X-Request-Handler-Origin-Region
X-Webkit-Csp
X-ATS-Timestamp
Upgrade-Insecure-Requests
Backend-Timing
X-Page-Id
X-Cache-Hit
X-XRDS-LOCATION
Refresh
X-Content-Options
X-Content-Security-Policy-Report-Only
X-Akamai-Edgescape
X-Origin-Server
X-Amzn-RequestId
X-Revision
X-Amz-Apigw-Id
X-F-Cache
X-User-Agent
X-Rid
X-Type
X-Varnish-Grace
X-XRDS-Location
X-Zen-Fury
Fastly-Restarts
X-Shield-Request-Id
X-Content-Powered-By
X-CST
X-B3-Sampled
X-LB-Cache
X-Webapp-Samesite-None-Activated-N
X-B
X-URL
X-Geo-Country
X-Activity-Id
X-AppVersion
X-Az
X-N
X-FTR-Cache-Host
X-Pad
PB-PID
PB-RID
X-Kinsta-Cache
Arc-Version
Cache-Status
X-Mobile-Rewrite
X-Analytics
X-RateLimit-Remaining
X-Cache-Age
X-TT
X-AOL-HN
X-WebKit-CSP-Report-Only
X-Instance
Actual-Object-TTL
X-App-Environment
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-User
Paypal-Debug-Id
X-Jobs
X-Request-Guid
X-Framework
X-Debug-Info
X-Signature
DC
X-Time
X-B-Cache
X-Cache-Action
X-PHP-Backend
X-FB-Debug
Access-Control-Allow-Method
X-Load-Cache
X-Cached-By
X-Git-Hash
Surrogate-Key
X-Varnish-Backend
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
Fastcgi-Useragent
X-Tt-Trace-Tag
X-Ttl
Host-Header
X-Amz-Replication-Status
X-IPLB-Instance
X-Contextid
X-Tt-Trace-Host
FilterID
MS-CV
X-Ruxit-Js-Agent
X-SS-Set-Cookie
X-ATG-Version
X-Cluster
X-WA-Info
Tracecode
X-Cache-Key
NGB
X-Response-Served-From
X-Accel-Buffering
WPE-Backend
X-Mobile
X-Srv
Host
Frame-Options
Payment
X-Cache-NE
X-Varnish-Server
X-FW-Server
X-FW-Serve
Xserver
X-Host-Name
X-Region
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-FW-Hash
X-FW-Static
X-FW-Type
Source
X-Cache-2
Eomportal-Instance
X-Tumblr-Pixel-2
X-Cache-Operation
X-Cache-Rule
X-Tumblr-Pixel-1
X-Adobe-Content
X-IPS-LoggedIn
X-Is-Bot
X-Rendered-As
X-GeoIP
X-Adobe-Loc
X-Varnish-Hostname
Filters
X-Cache-Enabled
X-Cacheable-TTL
Cache-Tv-Group
X-TX-ID
X-RequestSource
X-ORACLE-APMCS-TAG
X-ORACLE-APMCS-REQUEST-ID
X-Via-JSL
X-EdgeConnect-Cache-Status
X-Hostname
X-Presslabs-Stats
X-Origin-Response-Time
X-NewRelic-App-Data
Cleartype
X-Seen-By
X-FastCGI-Cache
X-Cache-TTL-Remaining
Retry-After
X-VCache
Server-Info
Cache
Accept-CH
X-NWS-LOG-UUID
X-B3-Traceid
X-ProcessESI
X-RemovedCookies
X-UA
X-HTML-Minification-Powered-By
X-Dc
Datacenter
X-Cache-Control
Liferay-Portal
X-RTag
Ms-Operation-Id
Healthy
X-Source
X-Environment-Context
X-L-Path
X-FireWall-Port
X-RateLimit-Limit
From-Origin
X-Endurance-Cache-Level
X-Upgrade-Enabled
X-Cache-Server
X-CACHE-KEY
X-PressLabs-Stats
X-App-Server
Accept-CH-Lifetime
X-Rule
X-Status
Version
X-Wix-Request-Id
X-Backend-Name
Meta-Geo
X-Path-Route
X-RN-RSRV
X-ES-SERVER
X-Handled-By
X-Cache-Var-Map
X-Cache-Var
X-APP-VERSION
X-Section
X-Proxy-Build
X-Format
OT-Force-Account-Verify
Selected-Fe
X-Access
X-Tb
X-Timing-Wait
X-PCL
X-Sorting-Hat-ShopId
Mn-Server-Ip
Azure-Version
X-Human
Cache-Tags
Azure-SiteName
X-Content-Age
Akamai-GRN
X-Alternate-Cache-Key
X-EIG-Tracking-Id
Azure-InstanceId
X-Sorting-Hat-PodId
Azure-RegionName
X-BYPASS-REASON
Azure-SlotName
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Shopify-Generated-Cart-Token
X-ShopId
X-Shopify-Stage
X-Request-Time
X-OCL
X-Origin
X-ProxyCache-Status
X-ShardId
X-Proto
X-ProxyCache-Key
Decoy-Debug-Status
X-SaId
Decoy-Debug-TTL
X-Proxy
X-Yottaa-Optimizations
X-Cluster-Node
X-Debug-Cache
Ec-Rule-Version
X-Vgn-Hpd-Reason
X-Pubstack
X-AWS-Id
X-Akamai-Request-ID2
X-Akamai-Request-ID
X-Qloud-Router
X-Cache-Host
X-MP-GENERATED-AT
X-ServerID
X-Redis-Cache
DB-Nickname
Decoy-Debug-Key
X-Yottaa-Metrics
X-Hosted-By
X-JoinUs
X-LJ-Flow-ID
X-Storage
X-Hl-Ver
X-Hyper-Cache
X-Trafficlayer-App-Name
X-Viewer-Country
X-VWS-Id
X-UUID
X-Trafficlayer-App-Scope
Origin-Cache-Control
Origin-Edge-Control
X-FC-Vary-Parameters
NGX
X-Generated-By
X-FW-Dynamic
Now
TWC-Privacy
X-Origin-Hint
TWC-Connection-Speed
X-Proxy-Cache-Status
X-Soup
S-Rt
Webcakes-App-Name
Webcakes-App-Version
TWC-Locale-Group
Property-Id
TWC-GeoIP-Country
Webcakes-Region
Cross-Origin-Window-Policy
TWC-GeoIP-LatLong
X-CCM
Srv
X-Time-Microsecs
TWC-Device-Class
X-Locale
X-Detected-As
X-Generated
X-Www-Served-By
X-RCS-CacheZone
X-Web-Node
X-Site-Version
X-Varnish-Hits
X-IP
X-Cache-Config
X-NYM-Debug-Backend
X-SayCDN-TTL
X-Xfnlog-Site
GEO-INFO
X-R9-Blue-Green-Version
X-Say-Cacheable
X-Say-TTL
X-Oneagent-Js-Injection
X-TNCMS
L5d-Success-Class
X-Loop
X-Amzn-Remapped-Content-Length
Node
X-Akamai-Transformed
X-FB-TRIP-ID
Accept-Charset
X-BCube-Filmed-By
X-CS
Cache-Name
X-NCache
Viewport
X-Esi
Uber-Trace-Id
X-Unique-Id
X-Drupal-Cache-Tags
Webserver
Cache-Key
X-UA-Device-Type
Time
X-From
X-Cache-Remote
Mime-Version
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
X-Cluster-Name
X-Origin-TTL
Accept-Language
X-Origin-CC
X-Mode
X-TT-TIMESTAMP
X-Backend-TTL
X-UnsetCookies
X-Forwarded-Host
Country
X-CDN-Forward
Odigeo-Trace-Id
X-Drupal-Cache-Contexts
Rt-Fastcgi-Cache
X-Microcachable
X-Info
X-CLOUD-TRACE-CONTEXT
X-Edge-Location
X-Whom
X-B3-Spanid
X-Newrelic-Synthetics
X-Varnish-Cache-Hits
X-Magnolia-Registration
X-Geo
X-ApacheServer
X-PERF
X-EC-Lua
ServedBy
X-NGENIX-Cache
Proxy-Connection
X-UPSTREAM-Address
Content-Disposition
X-No-Session
Ohc-Cache-HIT
Ohc-File-Size
X-Device-Type
X-Zipkin-Id
X-Routing-Service
X-Proxied
X-Via-Fastly
X-Daa-Tunnel
X-TA-CDN-Provider
Cf-Ipcountry
X-Request-UUID
X-CF-Lambda-Version
X-Region-Sid
X-Uri
X-External-Request-Id
X-Application
X-ARC
X-Date
X-Rewrite-Enabled
X-CF-Lambda-Fn
X-GeoIP-Country-Code
Mobile-Detection-Method
Machine
MD5-Digest
X-Geo-Header
Meta-Geo-Continent
Rendered-Blocks
X-B-Cookie
GEO-REGION-INFO
Fastcgi-X-Cache-Version
X-G
X-D
Apple-News-Services-Host
Viewtype
X-Connection-Hash
X-Vdms-Version
X-Nc
X-A-Ccd
X-Twitter-Response-Tags
BehaviorPad-Version
X-Transaction
X-Rocket-Build-Number
X-A-Dam
X-VG-TLSProxy
X-VG-WebCache
W
Content-Style-Type
X-Destination
Xc-Version
Content-Script-Type
X-A
X-VG-WebServer
VivaBuild
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
X-A-Dcw
X-Trv-Group
AsisCache
X-DPWN-IS-SECURE
X-Sigma-Backend
Apple-News-Services-Handled
X-Session-Fingerprint
T-Server
X-Rojux
X-S
X-S-Cookie
X-ScT
X-SRCache-Key
X-Sigma
X-A-Wwc
X-A-Dgt
X-Aed
X-Accel-Expires-Debug
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
HitType
X-Real-IP
X-C
User-Cache-Control
X-Epic-Correlation-Id
X-Eu-Site
X-Contensis-Viewer-Groups
Locid
X-Distil-CS
X-CGP
CDCHOST
X-Developers
IsBot
X-Agile
Geo-Info
X-SIPLIST1
X-PHP-Host
X-Wikidot-Static-Cache
Server-Surrogate-Control
Environment
X-Render-Time
X-Sucuri-Cache
X-Thanos
X-VC-Cache
X-Cache-Time
X-WebServer
X-Varnish-Authentication
X-Tumblr-Pixel-3
X-TrackingId
X-Labrador-Cache-Channel
HA-Ipaddr
X-Agile-Age
Gh-Request-Id
X-Cache-ASPX
X-Bip
Fastly-Soc-X-Request-Id
X-Cache-Debug
X-Hit
Ha-Gx-Prefs
Powered-By
X-Logging-Id
Server-Cache-Control
X-Agile-Id
X-CUA
X-App-Name
X-Backend-State
X-Auto-Login
X-Wikidot-Backend
Fastly-SSL
X-GoCache-CacheStatus
X-App-Version
X-Core-Mission
X-AK-Request-ID
X-Block-Status
X-BBXSRF
X-Azure-Ref
X-Cache-Backend
X-Cache-Bucket
X-Cdn-Srv
X-Cache-URL
X-Cache-Info
X-Clara-WADP
X-IN-APIGATEWAYSSL
X-Owner
X-OVcl-Cache
X-Proxy-Upstream
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-OVcl
X-Origin-Expires
X-Nginx-Cache-Key
X-Ms-Version
X-NodeID
X-NX-Host
X-Origin-Date
X-Request-URI
X-Server-W
X-Urbn-Site-Id
X-Urbn-Context-Path
X-VServer
X-WADP-Cache
X-Webstats-RespID
X-TT-LOGID
X-Trace-Id
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Swa-Ws
X-TH-Server
X-Ms-Request-Id
X-Micro-Cache
X-FW-Version
X-Fetched-On
X-Gamma-Serve
X-Gen-Mode
X-Generated-In
X-Fastly-Cache
X-Distributor
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-Debug-Cookies
X-Debug-Log
X-Dispatcher-Server
X-Generation-Time
X-GeoIP-City
X-Li-Fabric
X-Key
X-Li-Pop
X-LI-Proto
X-LI-UUID
X-Irp-Debug
X-Instart-Isnd
X-Hash
X-Hnp-Log
X-IN-APIGATEWAY
Web-Mar-Node
X-Debug-Cache-Expiry
X-Cms-Context
X-Varnish-Beresp-Ttl
AKAMAI
Cache-Host
X-Varnish-Beresp-Status
Request-Country
RNT-Machine
IBM-Web2-Location
Request-EU
Cdncip
Memcached
Locale
Kp-EeAlive
Heartbleed
Fastly-Backend-Name
Mail-Subject
Cdnsip
Country-Code
RNT-Time
X-Varnish-Beresp-Grace
Server-Int
V-Age
True-Client-Country-4JS
We-Hiring
Server-ID
Section-Io-Cache
X-Core-Value
Countrycode
X-Nginx-Cache
X-Thinkindot-L3
X-We-Are-Hiring
Fastly-SIE
Fastly-SWR
X-User
X-Trafficlayer-App-Version
FNAC-ModuleRouting
X-Service
X-Rebelmouse-Surrogate-Control
X-Level-Front-Cache
X-Rebelmouse-Cache-Control
X-Old-Content-Length
X-Reboot
X-Generated-On
X-Location
X-Req
Access-Control-Request-Headers
ServerName
X-ServiceProvider
X-Matched-Rule
Thinkindot-CacheControl-Type
Thinkindot-Control
PFcat
Wxu-Next-Region
Server-Host
Wxu-Next-Hostname
Thinkindot-CacheControl
X-Clientip
Wxu-Next-Commit
X-Up
X-Servername
X-Has-Esi
Platform
X-Internal-Host
X-NU-AKA-ACS-Version
X-S-Maxage
X-Response-By
X-Platform-Server
X-Variation
X-Lb-Id
X-SERVER
X-JWT-State
X-Is-Gdpr
Adler-Geo
Cache-Hits
Is-Eu
X-Cache-Tags
X-B3-Parentspanid
RequestId
X-Refresh
X-Tb-Optimization-Total-Bytes-Saved
X-Air-Hostname
X-Parent-Response-Time
X-Cdn-Forward
X-B3-SpanId
X-CF-Powered-By
Filterid
X-Tec-Api-Version
X-Var-Ttl
X-Tec-Api-Origin
X-Tec-Api-Root
X-Cache-Expired-At
ProcessTime
Group
X-BACKEND-TTL
X-CSRF-TOKEN
Pragrma
X-Pjax-Url
X-Server-IP
Memory
S-Cnection
Origin
Powered-By-ChinaCache
X-NC
X-CSRF-Token
X-Wa
User-Agent
X-Pf-Uncompressing
X-Cdn-Request-ID
Media-Length
TTL
Geoip-Latitude
X-Correlation-ID
SRV
X-Ua
X-Unique-ID
GeoIp-Country-Code
X-Vcl-Version
X-Sucuri-Id
X-Sucuri-ID
X-Varnish-Cacheable
X-NGINX-Cache
X-COUNTRY
PICS-Label
Geoip-City
X-Via-CDN
X-NWS-UUID-VERIFY
X-Rocket-Nginx-Bypass
Dnion-Transfer-Encoding
Esi-Enabled
X-Reqid
X-Developer
X-Webkit-CSP
X-Servedbyhost
SN
X-Litespeed-Cache
X-AIR-PT
X-HS-Status
X-Via-Ucdn
X-Node-Id
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
X-Cache-Grace
X-Varnish-Ttl
X-Sn-Servicetimems
X-Cdn-Origin
X-Policy
X-Ocache
X-LAGOON
X-Device-Os
XServer
X-TIME
M-TraceId
X-Request-Start
X-Azure-Ref-OriginShield
On-Server
HostName
X-FORWARDED-FOR
A
X-Fastly-Country-Code
X-MSEdge-Features
Rt-Proxy-Cache
X-Request-Host
X-MSEdge-Flight
Resin-Trace
Cdn
Who
X-Cache-Ttl
X-Cache-Status-Check
Cloudfront-Viewer-Country
Hostname
X-Ftr-Cache-Host
X-VHOST
Tcn
X-Beluga-Trace
X-ServedByHost
Magicmarker
X-Beluga-Response-Time
X-Beluga-Node
X-Beluga-Record
X-Beluga-Status
X-Beluga-Cache-Status
X-Method
X-Oss-Object-Type
X-Oss-Hash-Crc64ecma
X-Oss-Server-Time
X-Oss-Request-Id
X-Oss-Storage-Class
Pics-Label
CF-Cached-On
X-APP
NtCoent-Length
GeoIP-Country-Code
X-Bc
X-VCL-Version
Load-Balancing
X-Varnish-URL
Host-ID
X-Zone
X-Oracle-Dms-Rid
MIME-Version
Cteonnt-Length
Ttl
GeoIP-Latitude
X-Be
X-Varnish-Url
X-Fastly-Backend-Reqs
X-Svr
Ohc-Response-Time
X-Ratelimit-Remaining
X-DC
X-LiteSpeed-Cache-Control
DSUID
X-Slack-Backend
GeoIP-City
X-MServer
X-VarnishDD-TTL
X-Newrelic-App-Data
Vix-Hermes-Req-Id
X-PF-Uncompressing
Release
X-VCT
X-Hp-Ccpa-Warning
X-DI
X-PJAX-URL
X-DW
X-DB
X-RPM
WebServer
Amp-Access-Control-Allow-Source-Origin
X-Ftr-Request-Id
X-SRV
X-RPS
X-Action
X-DSS
X-RSL
CACHE
X-HostName
X-Swift-Error
X-Processor
X-BE
Processtime
X-Server-Time
X-Dynatrace
X-PAYTM-SRV-ID
Arc-Country
X-Tid
Pramga
X-Cache-FS-Status
X-Configured-By
X-Dispatch
Servername
X-Dynatrace-Js-Agent
X-Ratelimit-Limit
X-WR-MODIFICATION
X-ID
Cache-Provider
X-ABtesting
X-Flog
X-Hello
X-ND-Cache
X-SD-PageType
Fastly-Drupal-HTML
SD-X-WS
X-Upstream-Ht
X-FPC
X-Aicache-OS
X-Skip-Cache
X-Upstream-Ct
X-Frame-Option
X-SN
Lfy
X-Compress-Hint
X-Cache-Id
X-Fastly-Cache-Hits
X-StackifyID
X-DevSite-Last-Modified
X-Branch-Name
L
X-ServerName
CDN
X-Ftr-Backend
Requestid
X-LB-ID
X-Ftr-Backend-Server
X-Ftr-Balancer
X-Snapshot-Date
X-Ftr-Dc
X-Ftr-Realm
X-Edge-Server
N-Cache
CF-IPCountry
Cdn-Host
Dynatrace
X-Served-From
Cdn-Request-Time
Pagetype
X-CACHE-AGE
Proxy-Firewall
X-ZONE
X-Edge-IP
X-Amzn-Remapped-Connection
X-WA
X-Amzn-Remapped-Date
X-Bc-Bl
X-Apw-Hits
X-VC
Warning
X-Via-NSCOPI
X-Varnish-Beresp-TTL
V-Cache
X-Request-Url
X-Release
D-Cc-Upstream
X-SB
X-Apw-Access-Token
X-Apw-Access-Action
X-Cc-Via
X-Apw-Access-Object
X-Cc-Req-Id
X-Scheme
WP-Super-Cache
X-App
Backend-Name
X-Backend-Host
X-Worker
Lb
X-Fastly-Cache-Status
X-Request-URL
Correlation-Id
X-Powered-Y
LB
X-Check-Cacheable
X-BC
X-ElasticPress-Search