Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-Cache-Status
Link
Accept-Ranges
CF-RAY
ETag
X-XSS-Protection
Expect-CT
Pragma
X-Powered-By
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
P3P
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-AspNet-Version
X-Adblock-Key
X-Runtime
X-Permitted-Cross-Domain-Policies
X-DNS-Prefetch-Control
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Cache-Status
X-Check
X-Generator
X-Cacheable
Timing-Allow-Origin
X-Content-Security-Policy
X-Iinfo
Feature-Policy
Status
X-Envoy-Upstream-Service-Time
Content-Encoding
Access-Control-Expose-Headers
P3p
X-Drupal-Dynamic-Cache
X-AspNetMvc-Version
X-CDN
Upgrade
X-Via
CF-Ray
Report-To
X-Ws-Request-Id
Access-Control-Max-Age
X-Request-ID
Server-Timing
EagleId
X-Cache-Group
X-Turbo-Charged-By
Keep-Alive
X-UA-Device
Request-Context
X-Age
X-Backend
X-Proxy-Cache
X-Server-Powered-By
X-AH-Environment
X-Robots-Tag
X-Hacker
X-Server
X-Amz-Request-Id
Host-Header
NEL
X-Amz-Id-2
Grace
X-Rq
X-LiteSpeed-Cache
X-Swift-CacheTime
X-Swift-SaveTime
X-Varnish-Cache
X-Nginx-Cache-Status
Ali-Swift-Global-Savetime
X-WebKit-CSP
X-Page-Speed
EagleEye-TraceId
X-Vhost
X-Ua-Compatible
X-Amz-Version-Id
X-OneAgent-JS-Injection
X-Pingback
X-Dispatcher
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Device
Accept-CH
X-Cache-Spec
X-Host
X-Server-Id
Cf-Railgun
X-Node
X-Backend-Server
X-Readtime
Surrogate-Control
X-Akam-SW-Version
X-Dns-Prefetch-Control
Request-Id
X-Response-Time
X-HW
X-Application-Context
Xkey
Content-Location
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
Rating
Accept-Ch-Lifetime
X-Ruxit-JS-Agent
X-Country
X-B3-TraceId
X-Cloud-Trace-Context
X-Cache-Lookup
Accept-CH-Lifetime
X-Trace
Allow
X-Url
X-Ac
X-Content-Type
X-TtlSet
X-Vname
X-PC
X-Aws-Lambda-Call-Status
X-Varnish-TTL
X-Clacks-Overhead
Edge-Control
X-Server-Name
Fastly-Restarts
X-Mod-Pagespeed
X-ESI
Cache-Tag
X-Rack-Cache
Service-Worker-Allowed
X-FastCGI-Cache
Verso
X-VARITI-CCR
X-Element-Page-Cache
MS-Author-Via
X-Vcap-Request-Id
X-Upstream
X-Amz-Rid
X-MS-InvokeApp
Public-Key-Pins
X-GitHub-Request-Id
X-Dw-Request-Base-Id
X-Cached
X-Client-IP
X-Cache-TTL
X-D2id
X-Abt-Application-Version
X-Cnection
RTSS
X-Px
X-Kinja-Revision
X-Kinja-Build
X-Exp-Id
X-Kinja
X-Use-Magma
X-Exp-Variant
X-Kinja-Server
X-Cdn-Fetch
X-GoogleNews-Bot
X-Navigation-Version
X-TTL
Access-Control-Request-Method
X-Powered-By-Plesk
Arr-Disable-Session-Affinity
X-Country-Code
X-Goog-Hash
X-NF-Request-ID
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Middleton-Display
X-Sol
Pagespeed
Display
AR-SID
AR-PoweredBy
AR-CACHE
X-Powered-CMS
AR-Request-ID
AR-ATIME
X-Version
X-Origin-Cache
X-Middleton-Response
Response
X-MSEdge-Ref
X-LLID
X-CST
Nginx-Cache
TCN
X-Edge-Location-Klb
X-Kinsta-Cache
X-Amz-Server-Side-Encryption
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Edge
X-Protected-By
X-RateLimit-Remaining
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-T
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
X-Shield-Request-Id
X-Content-Security-Policy-Report-Only
X-Mg-S
X-Forwarded-For
X-Id
X-Aspnetmvc-Version
X-Language
Edge-Cache-Tag
S
Content-MD5
SPIisLatency
SPRequestDuration
Front-End-Https
Fastcgi-Cache
X-Mid
Realpath
Filters
Server-Node
X-Frontend
X-Request-Received
X-Pinterest-Rid
X-Recruiting
Pinterest-Version
X-Request-Processing-Time
Pinterest-Generated-By
Server-Name
X-Cache-Key
X-Ser
X-Content
X-Ab
X-Ua-Browser
X-NWS-LOG-UUID
X-Correlation-Id
X-MCACHE
X-HS-Cache-Config
X-Template
X-HS-Content-Id
X-HS-Hub-Id
X-Yandex-Sdch-Disable
X-HS-Combine-CSS
X-Ruxit-Js-Agent
X-DynaTrace
X-Ezoic-Cdn
X-SharePointHealthScore
SPRequestGuid
X-Hits
X-ECACHE
X-Parallel-Accel
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
MicrosoftSharePointTeamServices
X-Tt-Trace-Host
X-Tt-Trace-Tag
X-Page-Id
Charset
Cache-Tags
X-B3-Sampled
Host
Cleartype
X-Daa-Tunnel
X-Debug-Info
X-Www-Served-By
X-Git-Hash
X-Geo-Country
Alternate-Protocol
X-Content-Options
Accept-Ch
X-DIS-Request-ID
X-Ratelimit-Limit
Fusion-Content-Id
Fusion-Component-Id
Fusion-Content-Source
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Source
X-Content-Digest
X-Amzn-Trace-Id
X-Hostname
X-Ttl
Cross-Origin-Opener-Policy
X-Amz-Replication-Status
Filterid
X-Varnish-Age
X-FB-Debug
X-F-Cache
X-Grace
X-Activity-Id
ServerID
X-DataDome
X-AppVersion
X-Az
X-VCache
X-Accel-Expires
X-N
X-Nginx-Upstream-Cache-Status
X-Upgrade-Enabled
X-Rid
X-Forwarded-Proto
X-Fastly-Request-ID
X-Mobile-URL
X-Providence-Cookie
X-Request-Guid
Access-Control-Allow-Method
X-Aspnet-Duration-Ms
X-Is-Crawler
X-Route-Name
X-Flags
X-Origin-Server
X-Type
X-Server-ID
X-Whom
X-Seen-By
X-LB-Cache
X-TT
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-App-Environment
X-Varnish-Grace
X-Goog-Metageneration
X-GUploader-UploadID
X-Goog-Storage-Class
Payment
X-Goog-Stored-Content-Length
X-Tb
X-FW-Dynamic
X-FW-Serve
X-FW-Hash
X-WebKit-CSP-Report-Only
Viewport
X-FW-Type
X-FW-Static
X-FW-Server
Fastcgi-Useragent
X-User-Agent
X-Distributor
Node
X-Ratelimit-Reset
X-Wix-Request-Id
Paypal-Debug-Id
TP-L2-Cache
TP-Cache
Accept-Charset
DC
Country
X-Fastly-Request-Id
X-XRDS-LOCATION
X-App-Server
X-Cache-Rule
X-Litespeed-Cache
X-Webkit-Csp
X-Tec-Api-Origin
X-Tec-Api-Root
X-Cache-Control
X-Tec-Api-Version
X-Via-JSL
X-NGENIX-Cache
X-Fastcgi-Cache
X-Cluster-Name
Version
X-Drupal-Cache-Tags
X-Signature
X-B-Cache
X-Contextid
X-Buckets
X-Request-Handler-Origin-Region
X-Microsite
Referer-Policy
Cache-Status
X-Origin-Upstream-Status
X-Oracle-Dms-Ecid
X-Logged-In
Amp-Access-Control-Allow-Source-Origin
X-Oracle-Dms-Rid
X-Node-Name
VIX-Pulpo-Upstream-Status
X-Erf-Bev-Bev-Is-Generated
SD-X-WS
X-Original-Request-Id
VIX-Pulpo-Node
X-Cache-Age
Refresh
X-Browser-Type
X-Erf-Bev-Bev
X-Response-Served-From
X-Is-Bot
X-Jobs
X-Page-View
X-Cache-Expired-At
X-IPLB-Instance
X-Rendered-As
X-Vgn-Hpd-Reason
X-Revision
Access-Control-Request-Headers
X-Mobile
X-B
X-Debug
X-Proxy-Cache-Status
X-Real-IP
NGB
X-Varnish-Backend
X-Load-Cache
X-UUID
X-Rule
X-Instance
X-Device-Type
X-Cacheable-TTL
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Cache-Action
X-G
X-ProcessESI
X-RemovedCookies
X-Drupal-Cache-Contexts
Surrogate-Key
Akamai-GRN
X-Cache-Time
X-FW-Version
X-Framework
X-Proxy
X-Debug-IsPreview
X-Debug-IsConnected
CF-IPCountry
SID
X-Accel-Buffering
GEO-INFO
X-Air-Source
X-Air-Trace-Id
X-Air-Hostname
Count-Hit
X-Ratelimit-Remaining
X-Cache-NGX
X-Oneagent-Js-Injection
Uber-Trace-Id
X-Nginx-Cache
X-PressLabs-Stats
X-Cache-Operation
X-Azure-Ref
X-Source
X-Presslabs-Stats
X-Zen-Fury
DynaTrace
X-XRDS-Location
X-EdgeConnect-Cache-Status
Protected
X-Ms-Request-Id
X-Ms-Version
X-APP-VERSION
Liferay-Portal
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-TEC-API-VERSION
Frame-Options
X-CDN-Forward
WPO-Cache-Status
WPO-Cache-Message
X-RTag
MS-CV
Ms-Operation-Id
X-Servername
X-Cache-Hit
Healthy
X-Backend-Name
Ec-Rule-Version
X-RateLimit-Limit
Countrycode
Cross-Origin-Window-Policy
X-IPS-LoggedIn
X-Hyper-Cache
X-Cache-TTL-Remaining
X-Tumblr-Pixel-0
X-L-Path
X-Mode
X-Tumblr-Pixel-1
X-Tumblr-User
X-Tumblr-Pixel
X-Environment-Context
Xserver
X-Adobe-Loc
X-Varnish-Server
X-Trace-Id
X-Adobe-Content
Backend
Content-Disposition
Meta-Geo
X-Content-Age
X-JoinUs
X-Detected-As
X-RN-RSRV
X-Tid
X-SaId
X-Rewrite-Enabled
X-UPSTREAM-Address
X-ShopId
X-ShardId
X-Proxied
X-Cache-Grace
X-Generation-Time
Decoy-Debug-TTL
Url
X-Sql-Duration-Ms
X-Sql-Count
X-Debug-Cache
X-Sorting-Hat-ShopId
X-Zipkin-Id
Country-Code
Decoy-Debug-Status
Decoy-Debug-Key
Eomportal-Instance
X-Alternate-Cache-Key
X-Extlb
Apigw-Requestid
X-Format
X-Region
X-Shopify-Stage
X-Uri
X-Hosted-By
X-Sorting-Hat-PodId
X-Routing-Service
X-Forwarded-Host
X-Redis-Cache
X-OCL
CDN-PullZone
CDN-EdgeStorageId
CDN-RequestCountryCode
CDN-RequestId
CDN-Uid
CDN-CachedAt
CDN-Cache
X-PCL
X-Origin-Date
Mn-Server-Ip
Fastly-SSL
X-PHP-Backend
X-UA-Device-Type
X-FB-TRIP-ID
X-Access
X-Cache-Server
X-ServerID
X-Section
X-Status
Webcakes-App-Version
Cache-Tv-Group
X-Web-Node
X-Human
X-Site-Version
X-Varnish-Beresp-Grace
Webcakes-App-Name
Webcakes-Region
X-ApacheServer
X-Cache-Host
X-Cache-Type
X-Cluster-Node
X-BYPASS-REASON
X-Content-Powered-By
X-Microcachable
X-Akamai-Edgescape
Cache-Name
LB
X-No-Session
X-Proxy-Build
TWC-Device-Class
TWC-GeoIP-Country
TWC-GeoIP-LatLong
X-Timing-Wait
X-ProxyCache-Key
Selected-Fe
Property-Id
X-Server-W
X-ProxyCache-Status
X-PERF
X-Storage
X-Say-TTL
X-SayCDN-TTL
TWC-Connection-Speed
X-Say-Cacheable
TWC-Privacy
X-NYM-Debug-Backend
X-NCache
TWC-Locale-Group
X-Origin-Hint
X-Hl-Ver
Section-Io-Cache
X-Generated-By
X-Pubstack
X-Varnishpool
X-Be
X-R9-Blue-Green-Version
X-Soup
Retry-After
Content-Secure-Policy
X-Via-Fastly
Azure-Version
X-LSADC-Cache
Azure-InstanceId
Azure-SlotName
Azure-RegionName
Azure-SiteName
X-Nginx-Cache-Key
X-Ua
X-Webkit-CSP
X-NewRelic-App-Data
X-TIME
X-Cache-Remote
DB-Nickname
X-Unique-Id
OT-Force-Account-Verify
X-Cached-By
X-TT-LOGID
X-Platform-Server
X-Bc-Bl
X-Azure-Ref-OriginShield
X-Dc
X-Xfnlog-Site
X-Auto-Login
Cache
X-Cache-Tags
X-GEO
Source
X-Akamai-Transformed
Upgrade-Insecure-Requests
SRV
X-Cdn
X-LAGOON
From-Origin
X-Origin-TTL
X-Origin-CC
X-Varnish-Cache-Hits
HostName
Xet-Cookie
X-AOL-HN
Mime-Version
X-Request-Time
ServedBy
X-Loop
X-TNCMS
X-CSRF-Token
X-Varnish-Hits
X-HTML-Minification-Powered-By
X-Varnish-Hostname
X-NWS-UUID-VERIFY
WP-Super-Cache
X-App-Version
X-Request-Host
X-Time
Cache-Hits
X-S-Maxage
Onion-Location
X-EC-Lua
X-SRV
Webserver
X-FireWall-Port
X-ECache
X-Cache-Enabled
Web-Mar-Node
X-Tumblr-Pixel-2
X-Tumblr-Pixel-3
X-Endurance-Cache-Level
X-B3-SpanId
S-Rt
X-Proto
X-Handled-By
N-Cache
Nel
X-Http-Reason
X-Xrds-Location
X-Correlation-ID
X-Adobe-Source
X-Akamai-Request-ID2
X-RCS-CacheZone
X-Origin-Response-Time
X-Tenant
X-Reqid
Vix-Hermes-Req-Id
X-A
X-A-Dam
X-A-Ccd
X-A-Dcw
X-A-Dgt
V-Age
X-A-Wwc
X-Aed
Rendered-Blocks
Expiry
Fastcgi-X-Cache-Version
DCR-Processing-Time-Ms
DCR-Decision-By
A
BehaviorPad-Version
Meta-Geo-Continent
Mobile-Detection-Method
Sslversion
Surrogated-Key
Redirect-Candidate
Pramga
Odigeo-Trace-Id
User-Cache-Control
X-Conf
X-S
X-S-Cookie
X-ScT
X-SD-PageType
X-Rojux
X-Processor
X-PBS-Appsvrname
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
X-Session-Fingerprint
X-Shop-Environment
X-VG-WebCache
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
Xc-Version
X-Vdms-Version
X-Vdms-Path
X-Slack-Backend
X-SRCache-Key
X-TIM-N
X-V-Cache
X-PAYTM-SRV-ID
X-Orig-Expires
X-CF-Lambda-Version
X-Ckpd-Fst-Backend
X-Cluster
X-Connection-Hash
X-CF-Lambda-Fn
X-Cache-NE
X-ARC
X-B-Cookie
X-Backend-TTL
X-Block-Status
X-D
X-Destination
X-Hnp-Log
X-Ig-Push-State
X-NAPM-TraceId
X-ND-Cache
X-GG-Cache-Date
X-Gen-Mode
X-Developer
X-Epic-Correlation-Id
X-Forwarded-Path
X-Ftr-Request-Id
X-Application
X-External-Request-Id
X-VWS-Id
X-LJ-Flow-ID
X-AWS-Id
X-Amz-Meta-S3cmd-Attrs
X-Edge-Location
X-Time-Microsecs
Server-Info
X-Magnolia-Registration
X-MP-GENERATED-AT
X-Mg-Request-UUID
X-Mvc-Supplant-Cachable
X-Men
X-Sucuri-ID
X-NodeID
X-Sucuri-Cache
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-LI-UUID
Fastcgi-Cache-TTL
Traceparent
X-Viewer-Country
X-Cache-Date
X-Cache-Bucket
X-Li-Pop
X-Li-Fabric
Gh-Request-Id
X-Location
Origin-CC
Wxu-Next-Hostname
X-Request-URI
Wxu-Next-Region
X-Origin-Time
Wxu-Next-Commit
State
True-Client-Country-4JS
X-Proxy-Upstream
X-Policy
X-Origin-Expires
X-Fastly-Cache
Origin-EX
DSUID
Origin
X-Nyt-Route
X-Accel-Expires-Debug
X-Origin
X-Old-Content-Length
X-Server-IP
X-Aicache-OS
X-VG-TLSProxy
X-Cdn-Srv
X-Core-Mission
X-Hash
X-Fastly-Backend
X-GeoIP-Country-Code
X-VServer
Apple-News-Services-Handled
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
CacheControlHeader
X-Date
Cmstype
X-Forwarded-Site
X-Webstats-RespID
X-Fetched-On
Cmsid
X-Cache-Info
X-Gdpr
X-Device-Os
CDCHOST
X-GeoIP-Region-Code
X-Via-NSCOPI
Environment
X-Locale
X-Irp-Debug
X-Envoy-Decorator-Operation
X-Gamma-Serve
X-HS-Content-Campaign-Id
X-Labrador-Cache-Channel
X-Developers
Web-Mar-Region
We-Hiring
X-Eu-Site
X-Cache-Id
X-Esi-Check
X-Cache-Debug
X-PHP-Host
X-Platform
X-Branch-Name
X-Datadog-Trace-Id
X-GeoIP
X-Backend-State
X-GeoIP-City
X-Gzip
X-CGP
X-ATG-Version
X-BBC-Edge-Cache-Status
X-Core-Value
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-Geo-Header
X-HN
X-Csrf-Jwt
X-Node-Id
X-Scheme
HA-Ipaddr
X-UnsetCookies
X-RateLimit-Limit-Second
Fastly-GeoIP-CountryCode
X-VarnishDD-TTL
Host-ID
L
X-Thinkindot-L3
X-TrackingId
Locid
L5d-Success-Class
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Is-Gdpr
X-JWT-State
X-Restarts
X-Sn-Servicetimems
X-Has-Esi
X-FC-Vary-Parameters
Arc-Country
AKAMAI
Fastly-Drupal-Html
X-Cdn-Origin
Mail-Subject
Ha-Gx-Prefs
Thinkindot-CacheControl-Type
Thinkindot-Control
TDXMobile
Server-Host
X-Req
Ssr
Svr
X-RateLimit-Remaining-Second
Thinkindot-CacheControl
X-TH-Server
X-Rocket-Nginx-Serving-Static
X-Rocket-Build-Number
X-Sigma-Backend
X-Storefront-Renderer-Rendered
PFcat
X-Sigma
Req-Svc-Chain
Release
CloudFront-Viewer-Country
X-Varnish-Beresp-Ttl
X-Loc
X-NU-AKA-ACS-Version
X-Worker
X-Varnish-CookieINHashed-On
X-Rebelmouse-Cache-Control
X-Generated-On
X-Response-By
X-Rebelmouse-Surrogate-Control
X-Varnish-CookieHashed-On
X-Variation
X-Varnish-Remaining-TTL
X-Owner
X-Cache-Var
Adler-Geo
X-Varnish-Beresp-Status
X-Level-Front-Cache
X-Skip-Cache
X-Served-From
Cf-Device-Type
Fastly-SIE
X-DefElseHash
X-DefHash
X-Region-Sid
Platform
Fastly-SWR
Is-Eu
X-DPWN-IS-SECURE
X-Pod-Name
Memcached
Magicmarker
X-Tx-Id
NM-Fastcgi-Cache
X-Amzn-Remapped-Content-Length
Machine
X-Zone
X-Cache-Var-Map
X-Trace-ID
X-Ua-Device
Accept-Language
X-VC-Cache
X-Wix-Viewer-Type
X-Qloud-Router
AMP-Access-Control-Allow-Source-Origin
X-NC
Kp-EeAlive
NGX
X-CS
Edge-Cache
X-Cache-Backend
X-RSL
CDN
X-RPS
X-Action
X-Mvc-Supplant-OutputCached
X-TraceId
X-Up
X-Request-Start
X-DB
X-DW
X-DSS
X-RPM
X-DI
X-LB-ID
X-Srv
X-Optimistic-Header
Ms-Author-Via
X-Minions-Version
X-LB-NoCache
Pics-Label
X-CacheTTL
X-Generated-In
X-Thanos
X-Bip
X-Tb-Optimization-Total-Bytes-Saved
X-M-Reqid
X-M-Log
X-Qnm-Cache
Env
Time
X-Urbn-Context-Path
X-Urbn-Site-Id
Memory
Locale
X-API-Version
X-URL
X-Via-Popv
X-Via-Popn
X-DC
WebServer
X-Varnish-Ttl
X-Via-Poph
X-Refresh
X-Cache-Config
X-Tt-Logid
X-HA-Backend
X-Edge-Pop
Datacenter
X-CACHE-KEY
X-User
GeoIp-Country-Code
X-Ec-GeoHdr
X-Ec-Fail
X-Parent-Response-Time
X-DynaTrace-JS-Agent
X-TA-CDN-Provider
Candidate-Md5Url
X-Esi
X-Servedbyhost
Server-ID
NtCoent-Length
X-MSEdge-Features
X-Dynatrace
X-ZONE
X-MSEdge-Flight
X-Webkit-Csp-Report-Only
X-CLOUD-TRACE-CONTEXT
X-Cs
X-Vc
WWW-Authenticate
Cdnsip
On-Server
Cdncip
X-AK-Request-ID
X-Datadome
X-TX-ID
Esi-Enabled
My-App
X-Varnish-Beresp-TTL
X-Clara-WADP
X-WADP-Cache
X-Fmm-Version
X-VCL-Version
X-Fpc
X-Var-Ttl
X-Traceid
X-App
X-CUA
X-Cache-Ttl
Tracecode
Cluster
Geoip-Latitude
X-LI-Proto
X-Service
T-Server
Lfy
X-Cache-PHP
X-Li-Proto
C-Via
X-From
X-Unique-ID
DataCenter
X-VC
X-Pass-Why
X-FPC
X-Newrelic-Synthetics
X-B3-Spanid
Lang
X-Fragments
Fastly-Drupal-HTML
X-NODE
X-Webkit-CSP-Report-Only
Cf-Int-Pingora-Origin-Digest
Target-Params
X-Vcl-Version
Proxy-Connection
Test
Geo-Info
X-Mcache
M-TraceId
X-Render-Time
X-WP-CF-Super-Cache-Cache-Control
X-Cache-Status-Check
X-WP-CF-Super-Cache
Resin-Trace
X-Provided-By
Server-Id
X-RAMCache
X-LiteSpeed-Cache-Control
X-CSRF-TOKEN
X-Api-Version
Permissions-Policy
GeoIP-Country-Code
X-ID
X-Ha-Backend
MIME-Version
Hostname
Hit
X-Proxy-Cache-Info
X-Httpd
X-Edge-POP
Servername
WZWS-RAY
X-ServedByHost
X-Clientip
X-Dynatrace-Js-Agent
X-Geo
X-Via-PopH
X-Via-PopN
Producers
X-Via-PopV
FSS-Cache
X-Cdn-Forward
X-Pad
X-SB
X-Oss-Request-Id
X-Platform-Router
X-Oss-Server-Time
X-Oss-Storage-Class
X-LiteSpeed-Tag
X-Platform-Cluster
X-NGINX-Cache
X-Fastly-Backend-Reqs
X-Oss-Hash-Crc64ecma
X-Oss-Object-Type
X-Platform-Processor
X-Edge-Cache
HIT
UCS
Cache-Host
ENV
X-Udemy-Cache-App-Namespace
X-Scale
Section-Origin-Responded
X-AIR-PT
X-Ucs
X-Info
X-ElasticPress-Query
S-Cnection
X-Pool
Section-Io-Origin-Time-Seconds
X-Ec-Custom-Error
Section-Io-Origin-Status
Section-Io-Id
MD5-Digest
PICS-Label
Uri
X-Acquia-Purge-Tags
X-Acquia-Site
X-Cache-CFC
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Lb-Nocache
ServerName
X-UP
Server-Ext
X-Check-Cacheable
URI
X-Cache-Expires
X-GoCache-CacheStatus
X-Dispatcher-Number
X-BBC-Origin-Response-Status
Server-Hostname
X-HS-Status
Cneonction
Sever-Int
Ohc-File-Size
X-Srcache-Fetch-Status
X-Srcache-Store-Status
X-Release
User-Agent
X-SIPLIST1
X-Micro-Cache
X-Via-Ucdn
X-Nc
X-Swift-Error
X-Lb-Id
Cteonnt-Length
Fastly-Backend-Name
IsBot
Tcn
X-CACHE-AGE
Server-Ttl
X-Cdn-Request-ID
X-Fastly-Cache-Hits
X-RateLimit-Reset
X-Dw-Trace-Id
Wpo-Cache-Message
X-Akamai-ERPolicy
X-B3-ParentSpanId
Wpo-Cache-Status
X-Cms-Context
X-Backend-Host
Ngx
X-Akamai-ERRuleID
X-Snapshot-Date
Cf-Ipcountry
X-Yottaa-OS
CF-Cached-On
X-Vcache
Vha6-Origin
X-Newrelic-App-Data
X-ServerName
Load-Balancing
X-Cache-Ngx
Sid
X-Air-Pt
X-HostName
X-Akamai-Pragma-Client-IP
CountryCode
Req-ID
X-IN-APIGATEWAY
X-APP
X-B3-Parentspanid
X-UA
X-Fetch-By
GeoIP-Latitude
X-Via-CDN
X-CacheKey
Inserted-Into-Cache-At
X-BCube-Filmed-By
X-Litespeed-Cache-Control
X-Logging-Id
X-IN-APIGATEWAYSSL
X-Sentry-ID
X-Te-Duration-Ms
X-Apw-Access-Action
X-Te-Count
X-Apw-Access-Object
X-Apw-Access-Token
EpKe-Alive
X-Apw-Hits
X-Http-Duration-Ms
X-Http-Count
X-Shopify-Generated-Cart-Token
Shield-Pop
X-Last-Modified
X-Contensis-Viewer-Groups
X-Varnish-Authentication
X-Akamai-Request-ID
X-Cache-ASPX