Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
Strict-Transport-Security
X-Frame-Options
X-Content-Type-Options
Last-Modified
Link
CF-Cache-Status
Cf-Request-Id
CF-RAY
Accept-Ranges
ETag
Expect-CT
Pragma
X-Powered-By
X-Cache
X-XSS-Protection
Via
Age
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Xss-Protection
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
X-Served-By
X-FRAME-OPTIONS
X-Download-Options
X-Timer
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-Adblock-Key
X-AspNet-Version
X-Permitted-Cross-Domain-Policies
Alt-Svc
X-Runtime
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-DNS-Prefetch-Control
X-Check
X-Cache-Status
X-Generator
X-Request-ID
X-Cacheable
X-Iinfo
X-Envoy-Upstream-Service-Time
P3p
Timing-Allow-Origin
Feature-Policy
X-Content-Security-Policy
Status
X-Drupal-Dynamic-Cache
Content-Encoding
X-AspNetMvc-Version
Access-Control-Expose-Headers
Upgrade
X-CDN
X-Ua-Compatible
Access-Control-Max-Age
CF-Ray
X-Via
X-Robots-Tag
X-Cache-Group
Server-Timing
X-UA-Device
X-Dns-Prefetch-Control
Request-Context
Keep-Alive
X-AH-Environment
X-Amz-Request-Id
X-Turbo-Charged-By
X-Proxy-Cache
X-Backend
X-Amz-Id-2
X-Age
X-Ws-Request-Id
Host-Header
X-Hacker
X-Server-Powered-By
X-Server
X-Rq
X-Vhost
X-LiteSpeed-Cache
X-Varnish-Cache
X-Amz-Version-Id
Grace
X-Dispatcher
EagleId
Cf-Edge-Cache
Allow
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Device
X-Page-Speed
X-Nginx-Cache-Status
X-Swift-CacheTime
X-Swift-SaveTime
Accept-CH
X-WebKit-CSP
Ali-Swift-Global-Savetime
X-Aws-Lambda-Call-Status
X-Node
X-Host
Cf-Railgun
X-Pingback
X-Cache-Spec
X-Server-Id
X-Backend-Server
X-Akam-SW-Version
Surrogate-Control
X-OneAgent-JS-Injection
Request-Id
EagleEye-TraceId
X-Akamai-Path-Stats
X-Response-Time
X-Cache-Lookup
X-Readtime
Accept-CH-Lifetime
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Content-Location
X-HW
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
X-Application-Context
Rating
X-Trace
Fastly-Restarts
X-WebKit-CSP-Report-Only
X-Clacks-Overhead
X-Country
X-Nginx-Upstream-Cache-Status
X-Oneagent-Js-Injection
Accept-Ch-Lifetime
X-Url
X-Ruxit-Js-Agent
X-MS-InvokeApp
X-Amz-Server-Side-Encryption
X-Rack-Cache
X-Edge
X-Vname
X-TtlSet
X-PC
X-CST
Edge-Control
X-Mod-Pagespeed
X-Content-Type
X-Vcap-Request-Id
X-B3-TraceId
X-ESI
X-D2id
Verso
Xkey
X-FastCGI-Cache
X-GitHub-Request-Id
X-Kinja-Server
X-Use-Magma
X-Kinja-Build
X-Kinja-Revision
X-GoogleNews-Bot
X-Kinja
X-Exp-Variant
X-Exp-Id
X-Cdn-Fetch
Cache-Tag
X-Mcache
X-Amz-Rid
Service-Worker-Allowed
X-Powered-By-Plesk
RTSS
X-Varnish-TTL
X-ECACHE
X-Navigation-Version
X-VARITI-CCR
X-Upstream
Cf-Apo-Via
X-Version
X-Abt-Application-Version
X-Ruxit-JS-Agent
X-Client-IP
X-Cached
X-Ac
X-Server-Name
X-Cnection
X-Element-Page-Cache
X-Ttl
X-Dw-Request-Base-Id
Arr-Disable-Session-Affinity
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Instrumentation
X-SharePointHealthScore
SPRequestGuid
Permissions-Policy
X-Px
SPRequestDuration
SPIisLatency
Public-Key-Pins
X-Middleton-Display
X-Sol
Display
Pagespeed
X-Country-Code
X-Cache-TTL
X-NWS-LOG-UUID
Response
X-Middleton-Response
X-RateLimit-Remaining
X-Kinsta-Cache
X-Ser
X-Edge-Location-Klb
X-Midtier
X-Cache-Key
X-Goog-Hash
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Forwarded-For
Content-MD5
X-Correlation-Id
X-NF-Request-ID
Access-Control-Request-Method
X-MSEdge-Ref
Front-End-Https
X-ORACLE-DMS-ECID
X-Shield-Request-Id
X-ORACLE-DMS-RID
X-T
X-Recruiting
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
Edge-Cache-Tag
AR-PoweredBy
AR-SID
AR-CACHE
AR-Request-ID
AR-ATIME
X-HP-Trace-Id
X-HP-Webp
X-Jurisdiction
TP-L2-Cache
TP-Cache
Nginx-Cache
X-DataDome
MicrosoftSharePointTeamServices
X-RateLimit-Limit
X-Accel-Expires
X-Webkit-Csp
X-Daa-Tunnel
Accept-Ch
X-Mg-S
TCN
X-Powered-CMS
X-Content-Digest
X-Grace
X-Erf-Bev-Bev
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
X-Request-Received
X-Request-Processing-Time
X-Hits
X-Amzn-Trace-Id
X-HS-Content-Id
Server-Node
X-HS-Combine-CSS
X-HS-Cache-Config
X-Id
X-HS-Hub-Id
Filters
Server-Name
MS-Author-Via
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-TEC-API-VERSION
Fastcgi-Cache
X-Geo-Country
X-Frontend
X-XRDS-Location
X-Distributor
X-PressLabs-Stats
X-Fastly-Request-Id
Count-Hit
X-Origin-Server
X-Ezoic-Cdn
X-Ua-Browser
S
X-Protected-By
Filterid
Cross-Origin-Opener-Policy
X-LLID
X-Forwarded-Proto
X-Request-Handler-Origin-Region
Charset
X-B3-Sampled
X-F-Cache
X-Microsite
X-Amz-Meta-S3cmd-Attrs
X-Language
X-Ratelimit-Reset
X-LB-Cache
Cache-Status
Payment
X-FB-Debug
Host
X-Seen-By
X-Git-Hash
X-Ab
X-Page-Id
X-ASPNET-VERSION
X-VCache
X-Cluster-Name
X-Fastcgi-Cache
Surrogate-Key
X-Rid
X-Www-Served-By
Cache-Tags
Realpath
X-Logged-In
Retry-After
Access-Control-Allow-Method
Accept-Charset
X-Cdn
X-Upgrade-Enabled
X-Source
X-Origin-Cache
Alternate-Protocol
X-DIS-Request-ID
X-NGENIX-Cache
X-Varnish-Backend
X-Az
X-AppVersion
X-Activity-Id
X-Type
X-TTL
Paypal-Debug-Id
X-Cache-Age
Cleartype
DC
X-Amz-Replication-Status
X-Envoy-Decorator-Operation
X-Tb
X-TT
X-Template
X-B
ServerID
X-Signature
X-B-Cache
X-Wix-Request-Id
X-App-Environment
X-Aspnet-Duration-Ms
X-Flags
X-Is-Crawler
X-Hostname
X-Route-Name
X-Providence-Cookie
X-Request-Guid
X-Varnish-Grace
X-Revision
X-DynaTrace
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Node-Name
Frame-Options
X-Contextid
X-Cache-Rule
X-Drupal-Cache-Tags
X-Tt-Trace-Host
X-Tt-Trace-Tag
X-Proxy
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
X-Fastly-Request-ID
X-Goog-Storage-Class
X-Goog-Metageneration
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-Goog-Generation
X-Debug
Refresh
X-Mobile
X-Load-Cache
X-Content-Options
Amp-Access-Control-Allow-Source-Origin
Referer-Policy
X-N
Node
Cross-Origin-Resource-Policy
Country
X-Cache-Control
X-EdgeConnect-Cache-Status
X-Response-Served-From
NGB
X-Original-Request-Id
X-Magnolia-Registration
X-Varnish-Server
X-Varnish-Age
X-Debug-IsConnected
Akamai-GRN
X-Debug-IsPreview
Content-Disposition
X-Cache-TTL-Remaining
X-Environment-Context
X-L-Path
X-Status
X-Content-Powered-By
Viewport
Access-Control-Request-Headers
VIX-Pulpo-Upstream-Status
X-G
X-Whom
VIX-Pulpo-Node
X-Cache-Time
X-Instance
X-XRDS-LOCATION
X-NYM-Debug-Backend
X-Framework
X-Cacheable-TTL
X-Adobe-Content
X-ProcessESI
X-Adobe-Loc
X-Cache-Grace
X-Mid
X-Real-IP
Uber-Trace-Id
X-Akamai-Request-ID2
X-RemovedCookies
X-Jobs
X-Yottaa-Optimizations
X-User-Agent
Srv
Url
X-Yottaa-Metrics
X-Page-View
X-Is-Bot
X-Rendered-As
X-Servername
X-Trace-Id
X-COUNTRY
X-Unique-Id
X-Cache-Expired-At
X-Via-JSL
Countrycode
X-CDN-Forward
X-Drupal-Cache-Contexts
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-User
Version
X-Cache-Hit
X-URL
X-Cache-Operation
Accept-Language
X-APP-VERSION
X-Time
X-Http-Reason
Healthy
X-Backend-Name
X-Mg-Request-UUID
X-Rule
X-Ratelimit-Remaining
X-Content
X-Api-Version
Protected
X-Litespeed-Cache
X-App-Server
X-Akamai-Edgescape
X-Oracle-Dms-Ecid
X-Oracle-Dms-Rid
Content-Secure-Policy
X-Azure-Ref
X-Cache-Action
X-IPLB-Request-ID
X-IPLB-Instance
X-B3-Traceid
X-Restarts
X-Tt-Logid
Section-Io-Cache
X-Debug-Info
X-VC-Cache
Backend
X-Server-ID
X-Hosted-By
X-Generation-Time
Xserver
Server-Info
X-Storage
X-Mobile-URL
X-RN-RSRV
Load-Balancing
Meta-Geo
X-UPSTREAM-Address
X-Device-Type
GEO-INFO
Liferay-Portal
CF-IPCountry
X-HTML-Minification-Powered-By
X-Nginx-Cache-Key
X-Generated-By
X-FW-Serve
X-FW-Hash
X-SRV
Onion-Location
X-FW-Server
X-FW-Type
X-FW-Static
X-FW-Dynamic
X-Amzn-RequestId
X-RTag
X-Amz-Apigw-Id
X-Cache-Status-Check
X-Section
X-PCL
X-Mode
Azure-RegionName
X-Access
X-Format
S-Rt
MS-CV
Ms-Operation-Id
X-OCL
X-Locale
X-FireWall-Port
Azure-SlotName
Azure-Version
Azure-InstanceId
Azure-SiteName
TWC-Privacy
TWC-Locale-Group
Webcakes-App-Name
Webcakes-Region
CDN-RequestCountryCode
TWC-GeoIP-LatLong
X-Cms-Context
Webcakes-App-Version
CDN-EdgeStorageId
Property-Id
CDN-Cache
X-Handled-By
Eomportal-Instance
X-Varnish-Cache-Hits
CDN-CachedAt
TWC-Connection-Speed
TWC-GeoIP-Country
TWC-Device-Class
X-Redis-Cache
X-Origin-Hint
CDN-PullZone
X-R9-Blue-Green-Version
X-Edge-Location
CDN-RequestId
X-Proxy-Cache-Status
Web-Mar-Node
X-Region
X-Urbn-Context-Path
X-Varnish-Beresp-Grace
X-Urbn-Site-Id
X-Cache-Server
CDN-Uid
Locale
X-JoinUs
X-Site-Version
X-Cache-Host
X-SaId
X-Skip-Cache
X-Forwarded-Host
X-Shopify-Stage
X-ShopId
X-Cache-Type
X-Extlb
X-Routing-Service
X-Labrador-Cache-Channel
X-Say-Cacheable
X-SayCDN-TTL
X-ShardId
X-Sorting-Hat-PodId
X-Content-Age
X-No-Session
X-Proto
X-Zipkin-Id
X-Xfnlog-Site
Cache-Name
X-AWS-Id
X-LJ-Flow-ID
X-Varnish-Hostname
X-VWS-Id
X-PHP-Backend
Apigw-Requestid
X-Web-Node
X-Sql-Count
X-Sorting-Hat-ShopId
X-Adobe-Source
X-PHP-Host
X-Proxied
X-Via-Fastly
X-Server-W
X-Sql-Duration-Ms
X-Alternate-Cache-Key
X-Say-TTL
X-ProxyCache-Status
X-ProxyCache-Key
X-Hl-Ver
X-Storefront-Renderer-Rendered
X-Tid
X-Varnishpool
X-Request-Time
X-UA-Device-Type
X-BYPASS-REASON
Mn-Server-Ip
X-DynaTrace-JS-Agent
X-Datadome
X-Ms-Request-Id
WP-Super-Cache
X-Ms-Version
X-Provided-By
X-Ratelimit-Limit
X-GeoCountry
X-Detected-As
X-GeoCode
X-ServerID
X-Cache-Enabled
DB-Nickname
X-Uri
X-FB-TRIP-ID
Selected-Fe
X-Timing-Wait
X-ECache
X-Proxy-Build
X-WP-CF-Super-Cache
X-WP-CF-Super-Cache-Cache-Control
X-Cache-NGX
X-Ua
X-Amzn-Remapped-Content-Length
Fastcgi-Useragent
X-Loop
X-Varnish-Ttl
X-TNCMS
X-Nginx-Cache
X-Vgn-Hpd-Reason
X-UUID
X-LSADC-Cache
X-Pubstack
X-Reqid
X-Origin-Date
Xet-Cookie
X-Dc
X-Tumblr-Pixel-2
X-Zen-Fury
X-Soup
X-Tec-Api-Origin
X-Tec-Api-Root
X-Correlation-ID
X-Tec-Api-Version
X-App-Version
ServedBy
X-Aspnetmvc-Version
X-Service
X-MP-GENERATED-AT
X-TA-CDN-Provider
X-Varnish-Hits
X-Human
X-Newrelic-Synthetics
X-Origin-CC
Origin
X-Origin-TTL
X-Webkit-CSP
From-Origin
X-TIME
Source
X-GEO
X-Cache-Debug
X-Cached-By
Cache
Cross-Origin-Window-Policy
X-Varnish-Beresp-Ttl
Fastly-Drupal-HTML
X-Cache-Tags
X-RCS-CacheZone
X-NewRelic-App-Data
Webserver
Rip
LB
X-ScT
MD5-Digest
Rendered-Blocks
BehaviorPad-Version
X-Debug-Cache
SD-X-WS
X-Rewrite-Enabled
WPO-Cache-Status
X-Request-Host
WPO-Cache-Message
Host-ID
X-Rojux
X-S
CPC-Age
Meta-Geo-Continent
X-NAPM-TraceId
Sslversion
A
X-Forwarded-Path
Lang
X-SRCache-Key
X-D
CPC-Cache
DCR-Decision-By
X-PBS-Appsvrname
X-Parent-Response-Time
DCR-Processing-Time-Ms
X-Connection-Hash
X-Orig-Expires
Environment
Odigeo-Trace-Id
X-S-Cookie
X-Processor
Ngx.Var.Host
X-TIM-N
Expiry
X-Shop-Environment
X-Tenant
X-B-Cookie
X-Vdms-Path
X-A-Dcw
X-Ec-GeoHdr
X-Bc-Bl
X-ARC
X-Application
X-Ec-Fail
VNS-Cache
VNS-Age
X-Aed
X-A
Xc-Version
X-BCube-Filmed-By
Surrogated-Key
X-External-Request-Id
X-User
X-A-Wwc
X-A-Dgt
X-Cache-NE
X-VG-WebCache
X-A-Ccd
X-Destination
X-Vdms-Version
X-A-Dam
T-Server
X-Developer
Upgrade-Insecure-Requests
X-Cluster
Cdnsip
Cdncip
X-Origin-Time
X-AK-Request-ID
X-Owner
X-Aicache-OS
X-Dispatcher-Number
Redirect-Candidate
X-Nyt-Route
X-Gdpr
X-AOL-HN
X-Served-From
X-CMSURLCustom
TDXMobile
X-Core-Value
X-Geo-Header
X-Developers
X-Generated-On
X-Cdn-Srv
Thinkindot-Control
Thinkindot-CacheControl
Server-Host
Fastly-Backend-Name
AKAMAI
X-INCAP-ABP
Thinkindot-CacheControl-Type
X-Auto-Login
X-HS-Content-Campaign-Id
X-Sucuri-ID
Mime-Version
OT-Force-Account-Verify
X-Sucuri-Cache
X-Thinkindot-L3
X-Level-Front-Cache
X-Clara-WADP
X-Cdn-Origin
Cluster
Click-Count-Action-Start
Cmstype
Candidate-Md5Url
Apple-News-Services-Request-Url
X-Fastly-Backend
Click-Count-Error
Country-Code
X-Cache-Info
Svr
Cmsid
X-Cache-Id
CloudFront-Viewer-Country
Servername
X-Fmm-Version
Machine
X-ATG-Version
X-Gzip
X-Azure-Ref-OriginShield
Tube-Return
IsBot
L
V-Age
Mobile-Detection-Method
Web-Mar-Region
Origin-EX
Origin-CC
X-Gamma-Serve
Vix-Hermes-Req-Id
NGX
Release
State
Gh-Request-Id
Decoy-Debug-Status
Tube-Got-Eval
Decoy-Debug-TTL
Tube-Get-Contents
Decoy-Debug-Key
X-GeoIP-City
Traceparent
X-Minions-Version
Tube-Got-Results
Req-Svc-Chain
Fastly-GeoIP-CountryCode
X-Core-Mission
X-Loc
X-BBC-Edge-Cache-Status
X-Esi-Check
X-Cache-Bucket
X-RateLimit-Remaining-Second
X-Accel-Buffering
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Sn-Servicetimems
X-Proxy-Cache-Info
X-SIPLIST1
X-Planisys-CDN-TTL
X-WADP-Cache
X-VG-TLSProxy
X-RateLimit-Limit-Second
X-Slack-Backend
X-S-Maxage
X-SB
X-Scale
X-Scheme
X-Rocket-Nginx-Serving-Static
X-Varnish-Beresp-Status
X-FW-Version
X-Region-Sid
X-Request-URI
X-Planisys-CDN-Rules
X-Pool
X-Viewer-Country
Apple-News-Services-Parsed-Url
X-NCache
Apple-News-Services-Host
Apple-News-Services-Handled
X-NodeID
X-Epic-Correlation-Id
X-Planisys-CDN-Cache
X-Origin
X-Origin-Response-Time
X-Is-Gdpr
X-JWT-State
X-Worker
X-WP-CF-Super-Cache-Active
X-Has-Esi
X-Cache-Remote
X-Gateway-Cache-Status
X-IPS-LoggedIn
X-Gateway-Cache-Key
X-SplitTest
X-V-Cache
X-Sigma
X-Hash
X-GeoIP
X-Gateway-Request-Id
We-Hiring
X-Rocket-Build-Number
User-Cache-Control
X-Gateway-Skip-Cache
X-Sigma-Backend
X-Varnish-Remaining-TTL
X-Block-Status
X-Bip
X-Wix-Viewer-Type
X-DPWN-IS-SECURE
X-VServer
X-Eu-Site
X-Ec-Custom-Error
X-CacheTTL
Datacenter
Kp-EeAlive
X-FC-Vary-Parameters
Wxu-Next-Commit
X-Variation
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
Memcached
X-Fetched-On
NM-Fastcgi-Cache
X-Ad-Defer-Variation
X-Forwarded-Site
HA-Ipaddr
Ha-Gx-Prefs
X-Irp-Debug
Fastly-SWR
X-Hnp-Log
Is-Eu
X-CGP
L5d-Success-Class
X-Qloud-Router
Fastly-SSL
Fastly-SIE
Adler-Geo
CDCHOST
Cache-Host
X-Csrf-Jwt
X-Optimistic-Header
X-Policy
X-Platform-Server
DSUID
Mail-Subject
X-Datadog-Parent-Id
X-Thanos
Wxu-Next-Region
X-DefElseHash
X-Var-Ttl
X-DefHash
X-Cluster-Node
X-Ckpd-Fst-Backend
X-Branch-Name
X-Clientip
Wxu-Next-Hostname
X-Datadog-Trace-Id
X-Gen-Mode
X-Datadog-Sampling-Priority
Platform
X-Udemy-Cache-App-Namespace
Producers
X-Device-Os
X-Mvc-Supplant-Cachable
X-Esi
Ec-Rule-Version
X-CSRF-Token
Sever-Int
X-Tx-Id
Canary
X-Mvc-Supplant-OutputCached
HostName
Server-Hostname
Server-Ext
X-LB-NoCache
X-Pass-Why
WebServer
X-Trace-ID
X-VC
AMP-Access-Control-Allow-Source-Origin
X-Tumblr-Pixel-3
Pics-Label
X-Up
Sid
X-ND-Cache
X-Via-NSCOPI
X-Nf-Request-Id
X-B3-SpanId
Time
X-GG-Cache-Date
Memory
Cache-Tv-Group
X-WA-Info
X-Tb-Optimization-Total-Bytes-Saved
X-Newrelic-App-Data
X-Presslabs-Stats
Fastcgi-Cache-TTL
Request-ID
Ssr
X-Via-Popv
X-Refresh
X-Via-Popn
X-Dispatch
X-Via-Poph
X-Akamai-Transformed
My-App
X-ZONE
X-Edge-Pop
X-Session-Fingerprint
X-CACHE-AGE
Cache-Hits
Server-ID
X-Cs
SID
X-Pod-Name
X-Zone
X-Fastly-Cache
X-Origin-Expires
X-Lambda-Id
X-Servedbyhost
X-Release
Env
X-Rebelmouse-Cache-Control
X-Rebelmouse-Surrogate-Control
X-Req
X-Generated-In
X-Wa
X-B3-Spanid
X-Fpc
X-DC
X-PX
CacheControlHeader
True-Client-Country-4JS
X-LB-ID
X-ID
GeoIp-Country-Code
X-NGINX-Cache
X-TX-ID
X-NWS-UUID-VERIFY
X-EC-Lua
X-Vc
X-Cache-Date
X-Ig-Push-State
X-MSEdge-Features
X-MSEdge-Flight
Hostname
X-MCACHE
X-Xrds-Location
True-Client-IP
X-CSRF-TOKEN
X-Buckets
X-VCL-Version
X-Op-Id-All
X-NC
X-Conf
X-Endurance-Cache-Level
X-Microcachable
CDN
X-Webkit-CSP-Report-Only
X-TH-Server
X-CACHE-KEY
X-CS
X-Dmc
X-Srv
X-TRACE-ID
X-Date
X-Accel-Expires-Debug
X-GeoIP-Country-Code
X-HS-Status
Resin-Trace
X-GeoIP-Region-Code
WWW-Authenticate
Magicmarker
X-Vcl-Version
X-RAMCache
X-RateLimit-Reset
Tcn
X-Wikidot-Static-Cache
X-Wikidot-Backend
X-Old-Content-Length
X-Be
Path
Fastly-Drupal-Html
X-Vercel-Cache
X-Vercel-Id
X-Check-Cacheable
True-Client-Ip
X-Varnish-Beresp-TTL
Powered-By
X-LiteSpeed-Cache-Control
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
X-Akamai-Pragma-Client-IP
X-Alfa-Service
Proxy-Connection
X-Datacenter
Section-Origin-Responded
X-Hyper-Cache
Pramga
Section-Io-Id
X-Geo
Yjs-Id
X-Cache-Ttl
X-CLOUD-TRACE-CONTEXT
X-Location
X-Micro-Cache
X-Webstats-RespID
X-FPC
GeoIP-Country-Code
X-M-Log
X-M-Reqid
X-CF-Lambda-Version
X-CF-Lambda-Fn
X-API-Version
X-Varnish-Authentication
X-Contensis-Viewer-Groups
X-Cache-ASPX
FSS-Cache
Tracecode
X-App
X-Qnm-Cache
X-Via-CDN
ENV
X-Lb-Id
X-Mly-Id
X-WA
YJS-ID
X-Edge-POP
X-Air-Hostname
X-Air-Source
X-Air-Trace-Id
User-Agent
Server-Id
C-Via
X-ServedByHost
X-Response-By
X-Director
Lb
X-Air-Pt
X-DataCenter
X-Cdn-Forward
X-Dw-Trace-Id
X-Via-PopH
X-Platform-Cluster
X-HA-Backend
X-Test
X-TrackingId
N-Cache
X-Server-IP
X-Platform-Processor
X-Client-Ip
Cdn
HIT
X-Akamai-ERPolicy
X-Akamai-ERRuleID
X-Via-PopV
X-Platform-Router
X-Via-PopN
Sm-Log-Id
X-AIR-PT
X-Service-Response-Time
X-SERVER-NAME
X-From
Swift-Performance
X-Cache-Expires
X-Cache-Backend
M-TraceId
Location
Srvid
Hit
X-Traceid
Fastcgi-X-Cache-Version
NtCoent-Length
X-Fastly-Backend-Reqs
X-Instance-Name
On-Server
X-FL-EDGE
Locid
X-LI-Proto
X-LI-UUID
Esi-Enabled
X-Li-Pop
X-TT-LOGID
Dnion-Transfer-Encoding
Geoip-Latitude
X-Li-Fabric
X-LiteSpeed-Tag
X-Platform
X-UA
X-FORWARDED-FOR
X-PAYTM-SRV-ID
X-Cc-Via
X-RSL
PICS-Label
X-We-Are-Hiring
Nginx-CQVIP
X-RPS
Ohc-File-Size
Uri
XServer
X-RPM
X-CUA
X-DW
X-DB
CountryCode
X-DI
X-DSS
X-Wp-Cf-Super-Cache
X-Edge-Origin-Shield-Bytes
X-Edge-Origin-Shield-Region
X-Wp-Cf-Super-Cache-Cache-Control
X-Litespeed-Cache-Control
X-Cdn-Request-ID
X-Slack-Shared-Secret-Outcome
XM
X-Fastly-Cache-Hits
Vha6-Origin
X-B3-ParentSpanId
X-Cache-Proxy
X-HostName
X-Vtex-Remote-Cache
X-Vtex-Processado-Em
X-Request-Url
X-CF-Powered-By
X-Conten-Type-Options
X-Lb-Nocache
Wpo-Cache-Message
X-Info
Wpo-Cache-Status
GeoIP-Latitude
X-Node-Id
X-Fastly-Country-Code
X-B3-Parentspanid
X-Cache-Ngx
X-Ips-Loggedin
Wp-Super-Cache
Warning
X-Nerd
X-Newegg-Flow
X-MTS-Cache
X-Matched-Rule
X-Loadbalancer
X-LbNode
X-Newegg-Index
X-Matome-Cached
X-Kebabable
X-Keep
X-N-OperationId
X-OVcl-Cache
X-Onedio-Env
X-Okws-Version
X-Origin-Ops
X-OVcl
X-Kebab
X-Odoo-Frontend
X-Nyt-Data-Last-Modified
X-NFL-Geo
X-NS-Authorization
X-Ntj-Investigation-Id
X-NXG
X-NFL-Dma
X-Eid
X-ETag
X-PageType
X-Eventloop-Lag
X-F-Status
X-Farm
X-Ee-Request-Id
X-Ee-Request-Date
X-DT-Node
X-Doge
X-Edge-IP
X-Ee-Generated-By
X-Ee-Origin
X-Fastly-Is-Edge
X-Frame-Option
X-Header-Sub
X-Group
X-IBD-Cache
X-IBD-SID
X-Is-SSL
X-GoCache-CacheStatus
X-Global-Transaction-ID
X-Fstrz
X-Full-Ttl
X-GG-Cache-Status
X-Git-Commit
X-Ittl
X-Toujours-Debout-Location
X-Wag-Acs
X-Ver
X-Waitingroom
X-Web-Hosting
X-WP-Bypass
X-Vary-Devices
X-V2-Infrastructure
X-U-Cache
X-True-Client-Ip
X-Upstream-State
X-User-Auth
X-Utime
X-WSR2
X-Xms-Page-Cache-Actions
Timeexpire
X-Developed-By
PFcat
X-ApacheServer
X-PERF
X-HN
X-Ramcache
X-YSpaceId
XV-Cache
XV-H
X-VarnishDD-TTL
X-Tried-To-Kebabify
X-Toujours-Debout-Branch
X-Request-Origin
X-Render-Time
X-Route
X-Route-Akamai
X-Ruby
X-Render-Method
X-Redis
X-PGF-Deflate
X-PG-ACCESS
X-Pver
X-R-Cache
X-Reboot
X-Save-Cache
X-Server-L
X-SVR-IIS
X-Stack-Name
X-Svr-Proxy
X-Test-Nginx-Ingress
X-Timestamp
X-SSLProxy
X-Square
X-ServiceName
X-Sh
X-Site
X-SMP-JWT
X-Paywall
Scheme
Nikkei-App-Version
NB-ESI
NLCacheNote
Npm-Cost
Npm-Remaining
Joe-X
Is-Https
Ec-Policy-Id
Deeplink
H1
HServer
HTTPProtocol
Ns
Ns-Ua
Request-Uuid
Region
Rt-Proxy-Cache
Selected-Route
Served
RawURL
Proxy-Cache
OK-Edge-Date
Ok-Cache-Status
Ok-Edge-Key
Origin-Site
Panzer-Cache-Control
CMS-200
Cluster-Host
DynaTrace
X-LAGOON
WZWS-RAY
X-Mg-Cache
X-ElasticPress-Query
SRV
Fastcgi-Cache-Ttl
X-Moov-T
X-SD-PageType
X-Moov-Xdn-Version
X-Request-Start
Req-ID
X-Yottaa-OS
CF-Cached-On
Cdn-Country-Code
Cachekey
Cf-Device-Type
Cf-Locale
Cf-Wrk
Cache-Stat
Akamai-X-Url
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
Cneonction
X-Serial
X-Th-Server
Service-Uuid
SFRVia
X-BeanStalkStage
X-BeanStalkRole
X-Cache-Cookie
X-Cache-IsMobileDevice
X-Cache-Length
X-Backside-Transport
X-Backend-TTL
X-Arena-Request-Id
X-Ar-Stats
X-ARRRG1
X-ASF-Cache
X-AspNetWebPages-Version
X-Cache-NPR
X-Cache-Reason
X-Colour
X-Coindesk-Cache
X-Container-Uri
X-Dcm-Pdtf
X-Dehri-Date
X-Cms-Device
X-Cf-Node-Idx
X-Cache-Response
X-Cache-ReqUri
X-CacheVersion
X-CDN-Pop
X-CDN-Pop-IP
X-Apache-Server
X-Amz-Meta-Cb-Modifiedtime
TWC-AK-Req-ID
Ttl
TWC-PATH-LOCALE
TWC-Subs
TWC-Unit
Time-Cloud-Cache
Technodrome
SII
Shieldsquare-Response
Store-Cloud-Cache
Sw
T-Request-Id
Uniqueid
Userver
X-Akamai-CacheKeyMod
X-AEO-Platform
X-Akamai-DeviceOS
X-Akamai-DeviceType
X-Akamai-Native
X-Accor-Asset
X-Accepted-Language
X-77-NZT
Vttl
X-77-NZT-Ray
X-Accel-Version
X-Accepted-Fulllang
X-Delivery