Threat Level: green Handler on Duty: Daniel Wesemann

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
Pragma
X-Powered-By
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
P3P
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Xss-Protection
X-Served-By
CF-Ray
X-Download-Options
X-Timer
Access-Control-Allow-Headers
X-Request-Id
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
X-FRAME-OPTIONS
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Generator
X-Cache-Status
X-Check
X-Request-ID
X-Cacheable
X-Envoy-Upstream-Service-Time
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Dns-Prefetch-Control
X-Iinfo
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Content-Encoding
Access-Control-Expose-Headers
Upgrade
Status
X-CDN
X-AspNetMvc-Version
Server-Timing
X-XSS-PROTECTION
Access-Control-Max-Age
X-Amz-Request-Id
Request-Context
X-Amz-Id-2
X-Turbo-Charged-By
X-AH-Environment
X-Robots-Tag
X-Via
X-Backend
X-Cache-Group
Cf-Edge-Cache
Host-Header
Keep-Alive
X-Proxy-Cache
X-Hacker
X-Server
X-Rq
X-UA-Device
X-Age
X-Server-Powered-By
Allow
X-Vhost
X-Varnish-Cache
X-Ws-Request-Id
EagleId
X-Amz-Version-Id
X-Dispatcher
Grace
Cf-Apo-Via
P3p
X-LiteSpeed-Cache
Nel
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
X-Page-Speed
Cf-Railgun
EagleEye-TraceId
X-Swift-CacheTime
X-Swift-SaveTime
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-WebKit-CSP
X-Pingback
X-Node
X-Host
Accept-CH
X-Server-Id
Surrogate-Control
X-OneAgent-JS-Injection
X-Backend-Server
X-CST
X-Nginx-Cache-Status
X-Readtime
X-Akam-SW-Version
X-Content-Security-Policy-Report-Only
Permissions-Policy
X-Cache-Lookup
Request-Id
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Application-Context
X-Nginx-Upstream-Cache-Status
X-Cloud-Trace-Context
X-Trace
Accept-Ch-Lifetime
X-Response-Time
X-Edge
X-HW
X-Litespeed-Cache
X-Ua-Compatible
X-Mod-Pagespeed
X-Url
Content-Location
X-Clacks-Overhead
X-Ruxit-JS-Agent
Accept-CH-Lifetime
X-Oneagent-Js-Injection
X-Midtier
X-ECACHE
X-ESI
X-Mcache
Rating
X-Amz-Server-Side-Encryption
X-Upstream
X-Country
X-PC
X-Vname
X-TtlSet
Xkey
X-Vcap-Request-Id
X-MS-InvokeApp
Cache-Tag
X-D2id
X-Rack-Cache
Verso
Fastly-Restarts
Accept-Ch
X-Element-Page-Cache
X-Kinja
X-GoogleNews-Bot
X-Exp-Id
X-Cdn-Fetch
X-Kinja-Revision
X-Exp-Variant
X-Kinja-Build
X-Kinja-Server
X-Use-Magma
X-Cache-TTL
Edge-Control
RTSS
X-Content-Type
X-Powered-By-Plesk
X-VARITI-CCR
Origin-Trial
X-Ac
X-Navigation-Version
X-Cached
X-Abt-Application-Version
X-WebKit-CSP-Report-Only
X-Goog-Hash
Service-Worker-Allowed
X-GitHub-Request-Id
X-Ttl
X-Ruxit-Js-Agent
X-Country-Code
X-Amz-Rid
Display
Pagespeed
X-Middleton-Display
X-Sol
X-Mg-S
X-B3-TraceId
X-Dw-Request-Base-Id
X-SharePointHealthScore
X-Browser-Type
SPRequestGuid
X-Server-Name
Arr-Disable-Session-Affinity
Cross-Origin-Opener-Policy
X-Varnish-TTL
X-Server-Lifecycle-Phase
X-Erf-Bev-Bev
X-Instrumentation
X-Kraken-Loop-Name
X-Powered-CMS
X-Erf-Bev-Bev-Is-Generated
AR-SID
AR-PoweredBy
AR-Request-ID
AR-ATIME
X-Amzn-Trace-Id
Response
X-Middleton-Response
SPRequestDuration
SPIisLatency
X-Cache-Key
X-Ua-Device
AR-CACHE
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Cnection
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-HP-Webp
X-HP-Trace-Id
X-Jurisdiction
X-Version
X-Accel-Expires
X-Fastly-Request-ID
X-NF-Request-ID
X-T
Front-End-Https
Cache-Status
X-Times
Cache-Tags
Edge-Cache-Tag
X-Client-IP
X-Ser
X-Px
X-MSEdge-Ref
X-Fastcgi-Cache
Public-Key-Pins
Pinterest-Version
X-Pinterest-Rid
Pinterest-Generated-By
X-Hits
Nginx-Cache
X-Recruiting
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
X-RateLimit-Remaining
X-Shield-Request-Id
X-Request-Received
X-Frontend
X-Request-Processing-Time
Access-Control-Request-Method
X-LLID
Server-Node
X-Ua-Browser
X-NWS-LOG-UUID
Payment
X-Webkit-CSP
X-DIS-Request-ID
TP-Cache
X-FastCGI-Cache
X-HS-Hub-Id
MicrosoftSharePointTeamServices
X-HS-Content-Id
X-HS-Cache-Config
X-RateLimit-Limit
X-HS-Combine-CSS
S
TP-L2-Cache
X-Goog-Metageneration
X-B3-Traceid
X-LB-Cache
X-Content-Digest
X-Webkit-Csp
Content-MD5
X-PressLabs-Stats
X-Distributor
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Kinja-CCPA
X-Hostname
X-Microsite
X-Request-Handler-Origin-Region
X-Geo-Country
Realpath
X-Ezoic-Cdn
X-Forwarded-For
X-Page-Id
Access-Control-Allow-Method
Fastcgi-Cache
Accept-Charset
X-FB-Debug
X-Envoy-Decorator-Operation
X-Webkit-CSP-Report-Only
X-Cluster-Name
X-GUploader-UploadID
X-Rid
X-Correlation-Id
X-Protected-By
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Seen-By
TCN
X-Ratelimit-Remaining
Cleartype
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-B3-Sampled
DC
X-Origin-Cache
X-Origin-Server
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Goog-Storage-Class
X-Debug-Info
X-Goog-Stored-Content-Length
X-Mobile
X-Git-Hash
X-Logged-In
X-Varnish-Backend
X-Ratelimit-Limit
Referer-Policy
X-Newrelic-App-Data
X-Edge-Location-Klb
X-Kinsta-Cache
X-XRDS-Location
Cross-Origin-Resource-Policy
X-Azure-Ref
X-TTL
X-Contextid
Alternate-Protocol
Healthy
X-Varnish-Grace
Surrogate-Key
X-App-Environment
X-Aspnet-Version
X-Is-Crawler
X-Route-Name
X-Grace
X-Providence-Cookie
X-Request-Guid
X-Fb-Rlafr
X-Flags
X-Amz-Replication-Status
X-Revision
X-Aspnet-Duration-Ms
X-Content-Options
Count-Hit
X-Amz-Meta-S3cmd-Attrs
X-TT
X-Server-ID
X-Wix-Request-Id
X-Forwarded-Proto
X-Whom
Charset
Filterid
MS-Author-Via
X-IPS-LoggedIn
Viewport
Frame-Options
X-Akamai-Edgescape
WPO-Cache-Status
X-App-Server
X-Id
WPO-Cache-Message
X-Hosted-By
X-B
Paypal-Debug-Id
X-Magnolia-Registration
X-Kong-Proxy-Latency
X-Backend-Name
X-Kong-Upstream-Latency
X-Trace-Id
X-Az
X-Activity-Id
X-Cache-Control
X-AppVersion
X-Www-Served-By
X-Daa-Tunnel
Retry-After
X-Cache-Age
X-Client-Ip
Section-Io-Cache
X-COUNTRY
Server-Name
X-F-Cache
Refresh
Amp-Access-Control-Allow-Source-Origin
X-Varnish-Ttl
X-Type
X-Upgrade-Enabled
X-Proxy-Cache-Info
Version
X-Varnish-Server
X-Proxy
X-Response-Served-From
X-Original-Request-Id
Akamai-GRN
SD-X-WS
X-Rule
Protected
X-App-Version
X-Http-Reason
X-Cache-Rule
X-Instance
X-Varnish-Age
X-User-Agent
X-UUID
X-ARC
VIX-Pulpo-Upstream-Status
X-Is-Bot
X-Edge-Location
VIX-Pulpo-Node
X-Region
Host
X-Rocket-Nginx-Serving-Static
X-Unique-Id
X-Status
X-Framework
X-Rendered-As
Front
SRV
X-Akamai-Request-ID2
X-Cacheable-TTL
X-Cache-Grace
X-Jobs
Fastly-SWR
X-FW-Dynamic
X-Page-View
X-FW-Static
X-FW-Type
X-FW-Version
X-EdgeConnect-Cache-Status
X-FW-Server
Fastly-SIE
X-Oracle-Dms-Ecid
X-FW-Hash
X-FW-Serve
X-Adobe-Content
From-Origin
X-Source
X-Time
X-Environment-Context
X-L-Path
X-Tumblr-User
X-Tumblr-Pixel-1
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-G
X-N
X-Cache-Time
X-Adobe-Loc
X-ProcessESI
Access-Control-Request-Headers
X-Oracle-Dms-Rid
X-RemovedCookies
X-Load-Cache
ServerID
Content-Disposition
X-Drupal-Cache-Tags
X-CDN-Forward
Country
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-Datadog-Parent-Id
X-Language
X-RateLimit-Reset
X-HTML-Minification-Powered-By
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Vcache
Accept-Language
Countrycode
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-DynaTrace
X-Amzn-Remapped-Content-Length
Liferay-Portal
X-Datadog-Sampled
X-DataDome
X-Mg-Request-UUID
X-Generated-By
X-Debug-IsConnected
X-DynaTrace-JS-Agent
X-Debug-IsPreview
X-B3-SpanId
Xet-Cookie
X-ID
X-Xrds-Location
Backend
X-Nf-Request-Id
CF-IPCountry
X-WP-CF-Super-Cache
X-WP-CF-Super-Cache-Cache-Control
Webserver
X-ECache
X-Drupal-Cache-Contexts
X-Tt-Logid
X-Content-Powered-By
X-B-Cache
X-Signature
X-Device-Type
X-Mode
X-NYM-Debug-Backend
X-Zen-Fury
X-Httpd
Xserver
GEO-INFO
X-Erf-Web-Scheduler
Url
X-Ratelimit-Reset
X-Nginx-Cache
X-Servername
X-Rewrite-Enabled
X-Cache-Operation
Filters
X-Sucuri-ID
Meta-Geo
X-SaId
X-Director
X-Sucuri-Cache
X-Container-Uri
X-Content-Age
Load-Balancing
Azure-SlotName
Azure-Version
X-Git-Commit
X-UPSTREAM-Address
Azure-SiteName
X-JoinUs
Azure-InstanceId
Azure-RegionName
X-LAGOON
X-Tb
Locale
S-Rt
X-Cluster-Node
X-Cache-Action
X-Proto
X-Soup
X-Urbn-Site-Id
X-Storage
X-Varnish-Cache-Hits
X-Say-TTL
X-SayCDN-TTL
Uber-Trace-Id
Onion-Location
X-Urbn-Context-Path
X-Say-Cacheable
X-Logging-Id
X-Ms-Request-Id
X-Detected-As
X-VCT
X-Ms-Version
X-VC-Cache
X-XRDS-LOCATION
Web-Mar-Node
X-Varnish-Hostname
X-Generation-Time
X-Served-From
X-RM-Cache-TTL
X-Origin-Hint
X-RCS-CacheZone
X-Proxied
TWC-Privacy
TWC-GeoIP-Country
TWC-Device-Class
Mn-Server-Ip
Node
TWC-GeoIP-LatLong
X-Extlb
TWC-Locale-Group
Property-Id
DB-Nickname
X-GeoCountry
X-Labrador-Cache-Channel
Fastcgi-Useragent
X-Forwarded-Host
X-GeoCode
Webcakes-Region
Webcakes-App-Name
Webcakes-App-Version
TWC-Connection-Speed
X-Adobe-Source
X-Sql-Duration-Ms
X-Zipkin-Id
X-Sql-Count
X-Routing-Service
X-PHP-Host
X-Cache-Server
X-ServerID
X-Timing-Wait
X-Format
X-Fetched-On
X-Tumblr-Pixel-2
X-Skip-Cache
X-Tumblr-Pixel-3
Selected-Fe
X-Proxy-Build
X-LSADC-Cache
X-R9-Blue-Green-Version
X-FB-TRIP-ID
X-Debug
CDN-RequestId
X-Tec-Api-Version
X-Uri
X-Tec-Api-Origin
X-Tec-Api-Root
Fastly-Drupal-HTML
X-Lambda-Id
X-Cache-Expired-At
X-Origin-Date
X-Via-JSL
Source
X-NGENIX-Cache
OT-Force-Account-Verify
X-MP-GENERATED-AT
X-Fastly-Request-Id
X-Template
X-Cache-Hit
X-Varnish-Hits
X-MCACHE
X-Node-Name
Content-Secure-Policy
X-AIR-PT
X-Cache-TTL-Remaining
X-Pass-Why
X-Tncms
X-Loop
X-UA-Device-Type
X-Ua
X-Endurance-Cache-Level
X-Pubstack
Upgrade-Insecure-Requests
X-Srv
Cross-Origin-Window-Policy
X-Redis-Cache
X-Server-W
NGB
X-Origin-TTL
X-PHP-Backend
X-Origin-CC
X-Real-IP
Cache-Hits
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-RTag
Ms-Operation-Id
MS-CV
Section-Origin-Responded
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
Section-Io-Id
Cache-Name
X-S
Cache-Provider
X-Optimistic-Header
X-Restarts
X-Xfnlog-Site
X-Reqid
X-Cache-Host
X-Cms-Context
X-IPLB-Instance
X-IPLB-Request-ID
X-GEO
CDN-CachedAt
CDN-EdgeStorageId
CDN-Uid
CDN-RequestPullSuccess
CDN-RequestPullCode
CDN-PullZone
CDN-Cache
CDN-RequestCountryCode
X-Cache-Type
X-No-Session
X-BYPASS-REASON
X-Hl-Ver
X-ProxyCache-Key
X-ProxyCache-Status
Apigw-Requestid
X-Datadome
X-CSRF-Token
X-Cluster
X-LJ-Flow-ID
X-Aspnetmvc-Version
X-AWS-Id
X-CACHE-AGE
X-Via-Fastly
X-VWS-Id
X-Access
X-Rn-Rsrv
X-Section
Meta-Geo-Continent
MD5-Digest
X-Cache-NE
X-CF-Lambda-Version
Sslversion
X-Cache-Info
X-CacheTTL
X-Cdn-Diag
X-CF-Lambda-Fn
X-Csrf-Jwt
X-Ec-Custom-Error
X-Cache-Bucket
N-Cache
X-Dispatcher-Number
X-Developer
X-Ec-Fail
X-Ec-GeoHdr
X-D
X-Conf
X-Destination
X-Debug-Cache-Fetch
X-Debug-Cache-Store
X-CGP
BehaviorPad-Version
We-Hiring
W
VNS-Cache
VNS-Age
Web-Mar-Region
Redirect-Candidate
X-A
DCR-Decision-By
DCR-Processing-Time-Ms
Fastly-Backend-Name
Fastly-GeoIP-CountryCode
HA-Ipaddr
L
L5d-Success-Class
Ha-Gx-Prefs
Lang
T-Server
Gannett-Cam-Experience-Id
Gh-Request-Id
CPC-Cache
CPC-Age
X-Application
Canary
Candidate-Md5Url
X-Aed
X-B-Cookie
Ngx.Var.Host
Mail-Subject
X-BCube-Filmed-By
X-Bc-Bl
X-A-Wwc
X-A-Dgt
X-Epic-Correlation-Id
Odigeo-Trace-Id
X-A-Ccd
Surrogated-Key
X-A-Dam
Magicmarker
Rendered-Blocks
X-A-Dcw
X-Bl-Debug
X-GeoIP-Country-Code
X-ScT
X-Eu-Site
X-SD-PageType
X-Shop-Environment
X-SRCache-Key
X-Rojux
X-Request-Host
X-Newrelic-Synthetics
X-Origin-Time
X-Policy
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Tenant
X-TIM-N
X-We-Are-Hiring
X-Vtex-Remote-Cache
X-Wikidot-Backend
X-Wikidot-Static-Cache
Xc-Version
X-Akamai-Transformed
X-Viewer-Country
X-Vdms-Path
X-Var-Ttl
X-Proxy-Cache-Status
X-Vdms-Version
X-VG-WebCache
X-Orig-Expires
X-S-Cookie
X-Mvc-Supplant-Cachable
X-External-Request-Id
X-Fastly-Backend
X-FC-Vary-Parameters
X-Forwarded-Path
X-Gdpr
X-Irp-Debug
X-GeoIP-Region-Code
X-Nyt-Route
Thinkindot-Control
X-Handled-By
Thinkindot-CacheControl-Type
X-Hash
Thinkindot-CacheControl
X-Varnishpool
Vix-Hermes-Req-Id
X-Geo-Header
X-VG-TLSProxy
X-Forwarded-Site
X-Generated-On
Origin
X-Fmm-Version
X-Is-Gdpr
X-Has-Esi
X-JWT-State
Release
X-Worker
X-Wix-Viewer-Type
Req-Svc-Chain
X-Accel-Buffering
X-Thinkindot-L3
TDXMobile
Fastly-SSL
True-Client-Country-4JS
Server-Host
X-WADP-Cache
X-Test
X-Core-Mission
X-Bip
X-Pool
X-Core-Value
X-BBC-Edge-Cache-Status
X-Auto-Login
X-Request-Time
X-Node-Id
X-Cache-Debug
X-Clara-WADP
X-Org
X-Origin-Response-Time
X-CMSURLCustom
X-PERF
X-PAYTM-SRV-ID
X-Mly-Id
X-App-Name
X-INCAP-ABP
X-Slack-Shared-Secret-Outcome
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Old-Content-Length
X-Human
X-Slack-Backend
X-Server-IP
X-S-Maxage
X-Date
X-ApacheServer
X-Mid
X-Level-Front-Cache
X-Accel-Expires-Debug
X-Thanos
X-Clientip
Machine
Datacenter
Host-ID
X-TimeS
Cmstype
Cmsid
Memcached
AKAMAI
User-Cache-Control
WP-Super-Cache
X-TIME
X-Vcl-Version
X-Web-Node
X-From
X-NodeID
Platform
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
Is-Eu
X-Alternate-Cache-Key
X-Loc
Country-Code
X-Device-Os
X-TA-CDN-Provider
X-Cs
X-Up
CDCHOST
Apple-News-Services-Handled
X-Varnish-Remaining-TTL
X-Cache-Id
X-Nananana
X-Mvc-Supplant-OutputCached
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Vmg-Version
X-Nginx-Cache-Key
X-Block-Status
Producers
X-Qloud-Router
X-Variation
X-VServer
X-Cdn-Srv
Apple-News-Services-Host
CloudFront-Viewer-Country
X-ShopId
X-Shopify-Stage
Sever-Int
X-WA-Info
X-Gzip
Adler-Geo
X-DPWN-IS-SECURE
Server-Hostname
Server-Ext
X-Gen-Mode
X-DefHash
X-DefElseHash
X-Storefront-Renderer-Rendered
X-Sorting-Hat-ShopId
ServedBy
X-Sorting-Hat-PodId
Expect-Staple
X-ShardId
X-Owner
Esi-Enabled
DSUID
X-Platform
Environment
X-Parent-Response-Time
X-Hnp-Log
X-Esi-Check
X-Air-Source
X-Air-Hostname
X-Air-Trace-Id
NM-Fastcgi-Cache
Wxu-Next-Region
X-Origin
Wxu-Next-Hostname
Origin-CC
X-GeoIP
Origin-EX
X-Instance-Name
X-Dispatcher-Server
Pics-Label
X-Sn-Servicetimems
X-LB-NoCache
X-Presslabs-Stats
Ssr
Wxu-Next-Commit
X-Scale
C-Via
X-App
X-Cdn-Origin
X-NCache
X-Azure-Ref-OriginShield
X-Op-Id-All
Time
X-Amz-Meta-Cb-Modifiedtime
X-Akamai-Device-Characteristics
X-Cache-Enabled
Memory
Server-Info
X-Refresh
X-Nitro-Cache
AMP-Access-Control-Allow-Source-Origin
X-Tx-Id
Cache-Host
X-Platform-Cluster
X-Platform-Processor
X-Platform-Router
Server-ID
X-Cache-Status-Check
X-Microcachable
X-Site-Version
X-Locale
NGX
X-Correlation-ID
XM
X-HA-Backend
X-Origin-Expires
Hostname
PFcat
GeoIP-Latitude
X-VarnishDD-TTL
X-HN
X-Tb-Optimization-Total-Bytes-Saved
X-Dc
X-VHOST
X-API-Version
X-ZONE
X-CACHE-GROUP
Resin-Trace
Cf-Device-Type
Origin-Agent-Cluster
X-Ad-Defer-Variation
Locid
Srvid
X-Via-Edge
X-Via-CDN
X-Via-SSL
Edge-Copy-Time
X-DC
X-FL-QIT-DEBUG
A
X-FL-EDGE
X-Zone
X-Wp-Cf-Super-Cache-Active
X-Vgn-Hpd-Reason
X-Upstream-Ht
X-Upstream-Ct
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Grace
Sid
Cdn-Requestid
X-Fpc
X-ATG-Version
X-Webkit-Csp-Report-Only
X-Internal-Host
X-FireWall-Port
YJS-ID
Uri
Cache-Key
X-Contensis-Viewer-Groups
X-Cache-ASPX
X-Micro-Cache
X-WP-CF-Super-Cache-Active
X-Varnish-Authentication
X-Pod-Name
X-Github-Request-Id
X-Moov-T
X-DataCenter
X-Moov-Xdn-Version
X-TraceId
User-Agent
True-Client-Ip
X-Cached-By
X-Provided-By
X-LiteSpeed-Cache-Control
X-NGINX-Cache
State
X-SIPLIST1
IsBot
X-Info
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
X-HS-Content-Campaign-Id
X-Planisys-CDN-Rules
X-Buckets
X-B3-Spanid
Location
X-URL
X-B3-Parentspanid
X-AB
X-Fastly-Cache
X-RN-RSRV
X-Platform-Server
GeoIP-Country-Code
X-Sigma-Backend
X-Sigma
X-Nitro-Cache-From
GeoIp-Country-Code
XServer
X-Release
X-Backend-Instance
X-VC
X-Cache-Remote
X-VCache
X-Nitro-Rev
X-Rocket-Build-Number
X-LiteSpeed-Tag
X-NewRelic-App-Data
X-Geo-Region
X-Api-Version
Cdn
X-Accel-Version
Cache
X-Datacenter
X-MSEdge-Features
X-MSEdge-Flight
SID
X-CSRF-TOKEN
X-Generated-In
X-Gamma-Serve
CF-Ctrl
True-Client-IP
X-CS
X-FTR-Request-ID
X-Geo
Srv
X-Vgn-Hpd-Variations-Key
X-GeoIP-City
X-Vgn-Hpd-Cached
Path
Lb
Cache-Tv-Group
X-Vgn-Hpd-Ssi
NtCoent-Length
X-HS-Status
X-Rebelmouse-Surrogate-Control
X-Scheme
X-Is-Tablet
X-Tcp-Rtt
X-Is-Supported-Browser
X-Is-Mobile
X-Browser-Name
X-Is-Desktop
X-TRACE-ID
X-Rebelmouse-Cache-Control
X-SRV
Epwk-X-Cache
X-Frame-Option
Fastly-Drupal-Html
X-FPC
Kp-EeAlive
HostName
X-HostName
Tcn
Ohc-File-Size
X-GoCache-CacheStatus
X-Hyper-Cache
X-Amz-Meta-Opti
X-Mobile-URL
X-Location
Serverid
Cf-Ipcountry
X-UA
X-APP-VERSION
CountryCode
X-TX-ID
Cdnsip
On-Server
X-Developers
X-Esi
X-Aicache-OS
X-Webstats-RespID
X-Men
X-Air-Pt
X-Region-Sid
X-AK-Request-ID
CacheControlHeader
Cdncip
X-Service
X-Guploader-Uploadid
X-Cache-FS-Status
Mime-Version
X-B3-Trace-ID
RNT-Time
X-Traceid
Tube-Got-Results
Tube-Got-Eval
Tube-Get-Contents
Tube-Return
V-Age
RNT-Machine
X-Acquia-Purge-Cdn-Unconfigured
Click-Count-Action-Start
Click-Count-Error
X-Branch-Name
X-CDN-Cache-Status
X-EC-Lua
Proxy-Connection
X-SB
X-Cache-Ttl
X-Cache-Tags
X-LB-ID
X-Minions-Version
X-Via-Popv
X-Req
X-Wp-Cf-Super-Cache-Cache-Control
WebServer
X-V-Cache
X-Via-Poph
X-Wp-Cf-Super-Cache
X-Via-Popn
X-Wp-Cf-Super-Cache-Cookies-Bypass
X-Cdn-Cache-Status
Yak-Timeinfo
WWW-Authenticate
X-Proxy-CacheRZ
Env
WZWS-RAY
X-Pad
ENV
XkeyRZ
X-Vc
CF-Cached-On
Ohc-Cache-HIT
X-Nc
X-Servedbyhost
X-Wa
X-VCL-Version
X-CACHE-KEY
CDN
Cdn-Host
LB
X-Vercel-Id
X-Akamai-Pragma-Client-IP
Ngx
Cdn-Request-Time
Geoip-Latitude
X-Cdn-Forward
X-Vercel-Cache
X-Edge-Server
X-Ha-Backend
X-Edge-Pop
X-User
X-NWS-UUID-VERIFY
X-Fastly-Country-Code
X-Check-Cacheable
X-Lb-Cache
X-FTR-Expires
X-FTR-Balancer
X-FTR-Cache-Status
Content-Style-Type
Content-Script-Type
M-TraceId
X-TH-Server
X-Ckpd-Fst-Backend
X-FTR-Backend
X-Country-Code-Real
X-Processor
X-WP-CF-Super-Cache-Cookies-Bypass
X-FTR-Backend-Server
Server-Id
X-Origin-Cache-Key
X-TT-LOGID
X-Acquia-Application-Trace
X-Acquia-Application-UUID
PICS-Label
X-Acquia-Purge-Tags
X-Lb-Nocache
X-Acquia-Site
X-Via-Ucdn
X-NMSegId
X-CUA
X-Litespeed-Cache-Control
Cluster
X-Ad-Load-Variation
X-Cdn-Request-ID
HIT
X-Render-Time
X-APP
X-Edge-POP
X-Dw-Trace-Id
Req-ID
X-Snapshot-Date
X-MiniProfiler-Ids
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
Yjs-Id
X-Miniprofiler-Ids
Cneonction
X-Serial
X-Udemy-Cache-App-Namespace
X-Fastly-Backend-Reqs
X-Iauth-Set-Uid
X-Service-Response-Time
X-Response-By
Sm-Log-Id
Edge-Cache
X-Cache-Date
CACHE-MISS-TO-ORIGIN
Inserted-Into-Cache-At
Log-Origin
X-M-Log
X-M-Reqid
X-ElasticPress-Query
X-Cached-Since
X-Fastly-Cache-Hits
Vha6-Origin
X-RAMCache