Threat Level: green Handler on Duty: Renato Marinho

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
CF-RAY
Cf-Request-Id
CF-Cache-Status
Accept-Ranges
Link
X-XSS-Protection
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
P3P
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-UA-Compatible
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Request-Id
X-Varnish
Access-Control-Allow-Methods
X-Xss-Protection
Access-Control-Allow-Credentials
X-Runtime
X-AspNet-Version
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Cache-Status
X-Generator
X-Ua-Compatible
X-Cacheable
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Content-Security-Policy
X-Iinfo
X-Request-ID
Content-Encoding
X-CDN
Feature-Policy
X-AspNetMvc-Version
Status
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
Access-Control-Max-Age
X-Via
Keep-Alive
X-Ws-Request-Id
X-AH-Environment
X-Robots-Tag
X-Age
Request-Context
X-Turbo-Charged-By
EagleId
X-Cache-Group
X-Proxy-Cache
Server-Timing
X-Server
X-Backend
X-Hacker
X-Dns-Prefetch-Control
Host-Header
X-Server-Powered-By
Report-To
X-Amz-Request-Id
X-Nginx-Cache-Status
Grace
X-Amz-Id-2
X-UA-Device
X-Rq
X-Varnish-Cache
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
X-Page-Speed
CONTENT-SECURITY-POLICY
X-OneAgent-JS-Injection
Cf-Railgun
X-Pingback
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
X-CST
X-Amz-Version-Id
NEL
X-Cache-Spec
Allow
X-Vhost
X-Host
X-Backend-Server
X-WebKit-CSP
X-ASPNET-VERSION
X-Server-Id
X-Dispatcher
Surrogate-Control
X-Node
Xkey
EagleEye-TraceId
Request-Id
X-Response-Time
Content-Location
X-Akam-SW-Version
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Accept-CH
X-Ruxit-JS-Agent
P3p
X-Cache-Lookup
X-Application-Context
X-Country
X-Ac
Accept-CH-Lifetime
X-Mod-Pagespeed
X-Cloud-Trace-Context
X-Template
X-Readtime
X-Language
MS-Author-Via
X-B3-TraceId
X-HW
Rating
Accept-Ch-Lifetime
X-Url
X-Cnection
X-MS-InvokeApp
Accept-Ch
X-Origin-Cache
X-Vname
X-PC
X-TtlSet
Edge-Control
X-Clacks-Overhead
X-ESI
X-GitHub-Request-Id
X-Trace
X-Varnish-TTL
X-D2id
Display
X-Middleton-Response
Verso
X-Middleton-Display
X-Content-Type
Response
Pagespeed
X-Sol
Arr-Disable-Session-Affinity
X-Kinja-Build
X-Kinja-Revision
X-Kinja-Server
X-Use-Magma
X-Cdn-Fetch
X-Exp-Variant
X-GoogleNews-Bot
X-Kinja
X-Exp-Id
X-Powered-By-Plesk
X-Vcap-Request-Id
X-Country-Code
X-Rack-Cache
X-TTL
X-ORACLE-DMS-RID
X-Goog-Hash
X-Webkit-CSP
X-FastCGI-Cache
X-ORACLE-DMS-ECID
X-VARITI-CCR
X-Navigation-Version
X-Server-Name
X-Abt-Application-Version
X-Amz-Rid
Service-Worker-Allowed
Fastly-Restarts
X-Fastly-Request-ID
X-Client-IP
X-Cached
X-Buckets
X-MSEdge-Ref
X-Release
X-Cache-TTL
X-Element-Page-Cache
X-Dw-Request-Base-Id
Cache-Tag
X-NF-Request-ID
MRF-Tech
X-B3-TraceId-Primal
Mrf-Cache-Status
Public-Key-Pins
X-SharePointHealthScore
SPRequestGuid
Access-Control-Request-Method
RTSS
SPRequestDuration
SPIisLatency
AR-ATIME
AR-Request-ID
AR-CACHE
Ar-Sid
X-Edge
AR-PoweredBy
X-LLID
X-Powered-CMS
X-Ezoic-Cdn
Pinterest-Generated-By
Pinterest-Version
X-Pinterest-Rid
X-Upstream
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Version
S
Content-MD5
X-HP-Webp
X-Jurisdiction
X-Recruiting
X-Oneagent-Js-Injection
X-MCACHE
X-Mid
X-ECACHE
X-Kinsta-Cache
Charset
X-Mg-S
X-PressLabs-Stats
X-DynaTrace
X-Origin-Upstream-Status
X-T
Cache-Tags
X-Content-Digest
X-Accel-Expires
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Template-Id
Fusion-Component-Id
Fusion-Source
Fusion-Content-Id
X-Forwarded-Proto
Fastcgi-Cache
X-Litespeed-Cache
X-Px
X-Content-Security-Policy-Report-Only
X-Id
X-Logged-In
Filters
X-Ttl
TP-L2-Cache
TP-Cache
Server-Node
Edge-Cache-Tag
TCN
Server-Name
X-Correlation-Id
X-Amz-Server-Side-Encryption
X-Ruxit-Js-Agent
Front-End-Https
X-Forwarded-For
X-Request-Received
X-Request-Processing-Time
MicrosoftSharePointTeamServices
Nginx-Cache
X-Grace
X-Shield-Request-Id
X-XRDS-Location
X-Hits
X-B3-Sampled
X-Amzn-Trace-Id
X-Kong-Proxy-Latency
Alternate-Protocol
X-Kong-Upstream-Latency
X-Request-Handler-Origin-Region
X-Microsite
X-Server-ID
X-Az
X-AppVersion
X-Activity-Id
X-NWS-LOG-UUID
X-HS-Hub-Id
X-HS-Combine-CSS
X-F-Cache
X-HS-Content-Id
X-Fastcgi-Cache
X-HS-Cache-Config
X-Varnish-Age
X-Amz-Replication-Status
X-Debug
X-Origin-Server
X-Goog-Storage-Class
X-Goog-Generation
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-Goog-Metageneration
X-Goog-Stored-Content-Encoding
X-Yandex-Sdch-Disable
X-Rid
Nel
X-Frontend
X-Geo-Country
Host
Section-Io-Cache
Surrogate-Key
X-DIS-Request-ID
X-Daa-Tunnel
X-Cache-Age
X-RateLimit-Remaining
Accept-Charset
X-Ser
X-Hostname
Realpath
X-Git-Hash
Access-Control-Allow-Method
X-VCache
X-Respond-Thread
X-Mobile-URL
X-Seen-By
X-Upgrade-Enabled
MS-CV
X-AOL-HN
X-Source
X-DataDome
Paypal-Debug-Id
X-Type
ServerID
X-XRDS-LOCATION
X-LB-Cache
X-Time
Cleartype
X-TT
X-IPLB-Instance
Healthy
Payment
X-Contextid
X-Varnish-Backend
X-Cache-Action
X-Debug-Info
X-Providence-Cookie
X-Request-Guid
X-Flags
X-Aspnet-Duration-Ms
X-Signature
X-B-Cache
X-Route-Name
X-Content-Options
X-Is-Crawler
X-Cache-Key
X-Whom
X-WebKit-CSP-Report-Only
X-Page-Id
X-Load-Cache
X-App-Environment
Fastcgi-Useragent
X-N
Cache
X-FB-Debug
X-Jobs
Node
X-Webkit-Csp
X-Rule
X-Mobile
X-Cache-Expired-At
Refresh
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-FTR-Request-ID
X-FireWall-Port
X-Wix-Request-Id
X-Accel-Buffering
Viewport
X-Response-Served-From
X-Original-Request-Id
Ms-Operation-Id
X-RTag
DC
X-Cacheable-TTL
Access-Control-Request-Headers
X-Cluster-Name
X-Drupal-Cache-Tags
X-Zen-Fury
Referer-Policy
X-Content-Powered-By
X-HTML-Minification-Powered-By
X-RemovedCookies
X-ProcessESI
X-Framework
X-Debug-IsPreview
X-Distributor
X-Instance
X-Debug-IsConnected
X-UUID
X-Cache-Time
X-Real-IP
X-Cache-Control
Eomportal-Instance
VIX-Pulpo-Node
X-IPS-LoggedIn
VIX-Pulpo-Upstream-Status
X-B
X-Proxy
X-Page-View
X-Region
X-Tt-Trace-Host
X-Tt-Trace-Tag
Version
Countrycode
X-Drupal-Cache-Contexts
X-Www-Served-By
X-FW-Serve
X-FW-Dynamic
X-App-Server
X-FW-Hash
X-FW-Type
X-FW-Static
X-FW-Server
X-G
X-Tumblr-User
X-Tumblr-Pixel
X-Cached-By
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Cache-Operation
X-Cache-Rule
Liferay-Portal
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-Protected-By
X-Via-JSL
X-Nginx-Cache
Powered-By-ChinaCache
X-Akamai-Edgescape
X-Environment-Context
X-L-Path
X-Cache-Hit
X-Pinterest-Direct
Section-Io-Origin-Status
Section-Io-Id
Xserver
Section-Io-Origin-Time-Seconds
X-Pass-Why
Section-Origin-Responded
X-Varnish-Grace
SRV
X-Device-Type
CF-IPCountry
GEO-INFO
Server-Info
DynaTrace
X-TA-CDN-Provider
X-User-Agent
X-Adobe-Loc
X-Adobe-Content
X-Varnish-Server
Cache-Status
Retry-After
From-Origin
Ec-Rule-Version
X-Tumblr-Pixel-2
X-Mode
X-ES-SERVER
X-Hl-Ver
X-Endurance-Cache-Level
X-RN-RSRV
X-UPSTREAM-Address
Meta-Geo
Frame-Options
Webserver
X-Handled-By
X-Backend-Name
X-FB-TRIP-ID
Cache-Tv-Group
X-Access
Apigw-Requestid
TWC-Locale-Group
X-MP-GENERATED-AT
Webcakes-Region
TWC-Privacy
X-TEC-API-ROOT
X-OCL
X-ProxyCache-Key
X-Section
X-TEC-API-VERSION
X-NYM-Debug-Backend
X-TEC-API-ORIGIN
TWC-GeoIP-LatLong
X-Request-Time
Fastly-SSL
X-Uri
X-Be
X-PCL
X-Pubstack
X-Varnishpool
Country
X-Origin-Hint
X-Storage
X-Soup
TWC-GeoIP-Country
Webcakes-App-Version
X-Format
Webcakes-App-Name
X-BYPASS-REASON
TWC-Device-Class
Property-Id
X-ProxyCache-Status
TWC-Connection-Speed
X-Cache-Server
X-Proto
X-S-Maxage
X-PHP-Host
X-R9-Blue-Green-Version
X-Server-W
X-AWS-Id
X-Labrador-Cache-Channel
X-Info
X-UA-Device-Type
X-Timing-Wait
X-LJ-Flow-ID
Decoy-Debug-TTL
Decoy-Debug-Key
Decoy-Debug-Status
Mn-Server-Ip
Cache-Name
Selected-Fe
X-No-Session
X-VWS-Id
X-Proxy-Cache-Status
X-Proxy-Build
X-ApacheServer
Uber-Trace-Id
X-WA-Info
X-Via-Fastly
X-PERF
X-Human
Azure-Version
Azure-SlotName
X-Cache-TTL-Remaining
X-GG-Cache-Date
Azure-SiteName
X-Origin-Date
Azure-InstanceId
Azure-RegionName
X-Proxied
X-SayCDN-TTL
X-Routing-Service
X-Sql-Count
X-Say-Cacheable
X-Say-TTL
X-LAGOON
X-Web-Node
X-Xfnlog-Site
X-Zipkin-Id
X-Sql-Duration-Ms
X-Status
Protected
X-TNCMS
X-Loop
X-Alternate-Cache-Key
X-Redis-Cache
X-Sorting-Hat-ShopId
X-Hyper-Cache
X-Hosted-By
X-ShardId
X-ShopId
X-Shopify-Stage
X-Storefront-Renderer-Rendered
X-Sorting-Hat-PodId
X-Cache-Enabled
X-Locale
X-NWS-UUID-VERIFY
X-Rendered-As
X-Content-Age
X-Site-Version
X-Ratelimit-Limit
X-Backend-Host
X-SRV
X-Is-Bot
X-FW-Version
X-Microcachable
X-Azure-Ref
Amp-Access-Control-Allow-Source-Origin
X-Cluster
S-Cnection
X-AIR-PT
X-Cache-Grace
X-Forwarded-Host
X-TT-LOGID
AMP-Access-Control-Allow-Source-Origin
X-B3-Traceid
X-Platform
X-Qloud-Router
X-App-Version
X-Dc
X-Trace-Id
Akamai-GRN
X-Varnish-Ttl
X-Via-CDN
X-Aspnetmvc-Version
X-Revision
ServedBy
X-Cache-PHP
X-ATG-Version
X-Varnish-Hostname
X-CSRF-Token
X-EdgeConnect-Cache-Status
Cache-Hits
X-RCS-CacheZone
X-Cache-NGX
X-Debug-Cache
X-CCM
X-Node-Name
Who
X-Akamai-Transformed
DB-Nickname
X-Detected-As
X-RateLimit-Limit
X-Cache-Host
X-B3-SpanId
Country-Code
X-Amzn-Remapped-Content-Length
X-Amzn-RequestId
X-Amz-Apigw-Id
Filterid
X-CS
X-CACHE-KEY
X-Adobe-Source
X-Nc
X-TX-ID
X-BCube-Filmed-By
X-Oss-Server-Time
X-Varnish-Beresp-Grace
X-Correlation-ID
SD-X-WS
X-Oss-Object-Type
X-Oss-Storage-Class
X-Oss-Hash-Crc64ecma
X-Oss-Request-Id
X-Ms-Version
X-Ms-Request-Id
X-D
X-Destination
X-External-Request-Id
X-GEO
MD5-Digest
X-Generation-Time
X-Generated-On
X-From
Machine
X-ARC
X-A-Ccd
X-A-Dam
X-A-Dcw
X-Varnish-Cache-Hits
X-A
T-Server
Rendered-Blocks
Odigeo-Trace-Id
X-A-Dgt
X-A-Wwc
X-CF-Lambda-Fn
X-CF-Lambda-Version
Meta-Geo-Continent
X-Cache-NE
Mobile-Detection-Method
X-Aed
X-Application
X-B-Cookie
X-Connection-Hash
X-Level-Front-Cache
X-Rojux
X-S
X-S-Cookie
X-ScT
X-Varnish-Beresp-Ttl
X-Request-UUID
X-FTR-DC
DCR-Processing-Time-Ms
X-FTR-Realm
DCR-Decision-By
X-Session-Fingerprint
X-VG-WebServer
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
BehaviorPad-Version
X-VG-WebCache
X-Vdms-Version
X-SRCache-Key
X-Trv-Group
X-Vdms-Path
X-FTR-Cache-Status
X-Rewrite-Enabled
X-Owner
X-Location
X-NAPM-TraceId
X-Origin-CC
X-Processor
X-Origin-TTL
Fastcgi-X-Cache-Version
X-PAYTM-SRV-ID
X-FTR-Backend-Server
X-FTR-Balancer
X-Country-Code-Real
Expiry
X-PBS-Appsvrname
X-FTR-Backend
X-Time-Microsecs
X-Magnolia-Registration
HostName
X-Ratelimit-Remaining
X-Unique-Id
X-Varnish-Beresp-Status
Release
Arc-Version
PB-PID
PB-RID
Server-Host
Gh-Request-Id
CacheControlHeader
Content-Disposition
Magicmarker
Cf-Device-Type
Cache-Host
Host-ID
Pagetype
Path
X-Device-Os
X-OVcl
X-OVcl-Cache
X-Policy
X-JWT-State
X-Is-Gdpr
X-GeoIP-City
X-Has-Esi
X-Reqid
X-ServerID
Fastly-Backend-Name
X-Cache-Bucket
X-Tumblr-Pixel-3
X-TrackingId
X-Thanos
X-Thinkindot-L3
X-Geo-Header
X-Generated-In
V-Age
Wxu-Next-Commit
Wxu-Next-Hostname
UCS
Thinkindot-Control
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Wxu-Next-Region
X-Azure-Ref-OriginShield
AKAMAI
X-Fetched-On
X-Developers
X-Core-Value
X-Bip
X-Cms-Context
Ssr
X-FC-Vary-Parameters
X-Backend-TTL
X-EC-Lua
X-APP-VERSION
Backend
X-Unique-ID
X-Fastly-Cache
X-Epic-Correlation-Id
X-Envoy-Decorator-Operation
X-Eu-Site
X-GoCache-CacheStatus
X-Li-Pop
X-LI-UUID
X-Li-Fabric
X-HS-Content-Campaign-Id
X-DPWN-IS-SECURE
X-HN
X-GeoIP
X-Developer
Vix-Hermes-Req-Id
X-Branch-Name
True-Client-Country-4JS
Sever-Int
Server-Ext
Server-Hostname
X-Cache-Debug
X-Cache-Info
X-DefHash
X-Method
X-Csrf-Jwt
X-Clientip
X-Cache-Tags
X-CGP
X-Dispatcher-Server
X-Mvc-Supplant-Cachable
X-User
X-Variation
NGB
Esi-Enabled
X-Skip-Cache
X-Backend-State
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-VG-TLSProxy
X-VServer
X-VarnishDD-TTL
X-Varnish-Remaining-TTL
X-Varnish-Hits
X-SIPLIST1
Apple-News-Services-Handled
X-Var-Ttl
X-Origin
X-NU-AKA-ACS-Version
X-Node-Id
Platform
X-Nginx-Cache-Key
X-Platform-Server
X-Rebelmouse-Cache-Control
X-Irp-Debug
X-IP
X-DynaTrace-JS-Agent
X-Request-URI
X-Rebelmouse-Surrogate-Control
X-Micro-Cache
X-DefElseHash
NM-Fastcgi-Cache
CDN-Uid
Cf-Bgj
L
CDN-RequestId
CDN-EdgeStorageId
CDN-PullZone
IsBot
Is-Eu
Fastly-SWR
Ha-Gx-Prefs
Origin
Fastly-SIE
HA-Ipaddr
DSUID
On-Server
NGX
CDN-RequestCountryCode
CDN-Cache
CDN-CachedAt
CDCHOST
PFcat
C-Via
Adler-Geo
Apple-News-Services-Request-Url
L5d-Success-Class
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Locid
User-Cache-Control
X-ID
X-Amz-Meta-S3cmd-Attrs
X-NewRelic-App-Data
Location
X-Fastly-Backend
X-Gamma-Serve
X-Loc
X-Wikidot-Static-Cache
X-Planisys-CDN-TTL
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Esi-Check
X-Fmm-Version
X-Origin-Response-Time
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Block-Status
X-Swa-Ws
X-Tb
X-WADP-Cache
Xc-Version
Web-Mar-Node
X-Gen-Mode
X-Generated-By
X-Request-Host
X-Origin-Expires
Fastly-Drupal-HTML
X-Sucuri-ID
X-Ratelimit-Reset
X-Scheme
X-Hnp-Log
X-Old-Content-Length
X-Wikidot-Backend
X-Gzip
X-Cache-Id
X-Aicache-OS
X-Clara-WADP
X-FTR-Expires
X-Air-Hostname
X-Goog-Meta-Goog-Reserved-File-Mtime
Rt-Fastcgi-Cache
X-LB-ID
Req-Svc-Chain
X-Hash
X-Varnish-Url
X-Instrumentation
X-Kraken-Routeconfig-Destination
X-Server-Lifecycle-Phase
X-Edge-Location-Klb
X-Kraken-Loop-Name
Tracecode
Kp-EeAlive
Svr
Cmstype
Cmsid
Pics-Label
X-PF-Uncompressing
X-Slack-Backend
X-Mvc-Supplant-OutputCached
X-Servername
X-Cdn-Forward
X-Served-From
A
X-Refresh
X-Via-Popv
Instruction
X-Vgn-Hpd-Reason
SR-User-Adfree
X-Via-Poph
X-Via-Popn
X-Cache-Var-Map
X-Cache-Var
Viewtype
Url
M-TraceId
VivaBuild
X-CUA
Arc-Country
X-Matched-Rule
X-NGENIX-Cache
Lfy
X-SaId
Cross-Origin-Opener-Policy
Cache-Key
X-JoinUs
SID
X-TraceId
X-PHP-Backend
X-Edge-Location
CloudFront-Viewer-Country
TDXMobile
X-Ua-Device
X-Tb-Optimization-Total-Bytes-Saved
X-Cdn-Origin
X-Cache-Expires
MIME-Version
X-Sn-Servicetimems
Sid
X-CDN-Forward
X-Cache-Backend
Pramga
X-DC
X-NCache
X-Vc
X-NC
Geo-Info
X-CLOUD-TRACE-CONTEXT
X-Extlb
X-Servedbyhost
X-Cache-Date
X-Webkit-CSP-Report-Only
X-Core-Mission
Server-ID
Content-Secure-Policy
DataCenter
NtCoent-Length
X-Internal-Host
X-Srv
X-Service
X-Request-Start
X-Wa
Geoip-Latitude
Tcn
GeoIp-Country-Code
Source
X-Bc-Bl
X-LI-Proto
X-FireWall-Protection
X-Error
X-B3-Spanid
X-HS-Status
X-Forwarded-Site
FSS-Cache
X-Varnish-Cacheable
Memcached
X-Proxy-Upstream
LB
Surrogated-Key
X-Esi
X-Req
X-Via-NSCOPI
X-Newrelic-Synthetics
CACHE
X-VHOST
X-Air-Source
Mail-Subject
X-Vcl-Version
X-VC-Cache
Hostname
X-PJAX-URL
We-Hiring
X-Response-By
X-VCL-Version
Resin-Trace
X-HOST
X-Geo
Upgrade-Insecure-Requests
X-Hcs-Proxy-Type
Env
X-Accel-Expires-Debug
X-Date
X-RateLimit-Limit-Second
X-Rocket-Build-Number
X-RateLimit-Remaining-Second
X-App
X-CCDN-CacheTTL
XServer
Request-ID
X-Proxy-Cachei7
X-Sigma
X-Viewer-Country
X-Sigma-Backend
X-CCDN-Origin-Time
Xkeyi7
X-Li-Proto
X-LiteSpeed-Cache-Control
X-DB
X-DI
X-DSS
Memory
N-Cache
GeoIP-Latitude
HitType
X-Zone
X-DW
X-RPM
X-TIM-N
X-MSEdge-Features
X-MSEdge-Flight
Server-Ttl
CF-Cached-On
X-RPS
X-RSL
GeoIP-Country-Code
Time
X-BBXSRF
X-WA
X-RAMCache
X-APP
X-Cache-2
X-Cs
X-Men
VNS-Age
CPC-Cache
X-ZONE
X-Cc-Via
X-Varnish-Authentication
X-Action
CPC-Age
VNS-Cache
D-Cc-Upstream
X-Contensis-Viewer-Groups
X-UA
X-Air-Trace-Id
ProcessTime
X-ServedByHost
X-Svr
S-Rt
X-Cc-Req-Id
X-Cache-ASPX
X-TIME
X-Mg-Request-UUID
X-HostName
Server-Id
X-Oss-Cdn-Auth
My-App
X-FPC
Fastcgi-Cache-TTL
X-Region-Sid
X-Swift-Error
X-Dynatrace-Js-Agent
X-Provided-By
Mime-Version
X-Cache-Config
X-CF-Powered-By
W
X-CSRF-TOKEN
Cache-Provider
X-Fpc
X-API-Version
X-Nyt-Route
X-Minions-Version
X-Origin-Time
X-FORWARDED-FOR
X-Gdpr
X-Server-IP
X-Depends-On
State
Cteonnt-Length
X-Cdn-Request-ID
X-Cache-Remote
Srv
X-Cache-Type
X-URL
Cross-Origin-Window-Policy
X-Cache-Ttl
CDN
X-UnsetCookies
X-BACKEND-TTL
X-Erf-Stays-Bingo-Pdp-Web
X-Sucuri-Cache
Ohc-File-Size
X-NGINX-Cache
X-Dw-Trace-Id
X-Akamai-Pragma-Client-IP
X-ServerName
X-Client-Ip
X-Xrds-Location
Cdn
X-SN
X-ABtesting
X-VC
X-Flog
X-NodeID
X-Hello
OT-Force-Account-Verify
X-Parent-Response-Time
X-Check-Cacheable
Proxy-Connection
X-Fastly-Request-Id
Ohc-Cache-HIT
X-Ftr-Cache-Host
X-Pad
X-SB
X-Forwarded-Path
X-SD-PageType
X-Snapshot-Date
X-Fastly-Backend-Reqs
X-ND-Cache
Dnion-Transfer-Encoding
X-Webstats-RespID
Cf-Ipcountry
X-Tenant
X-Orig-Expires
X-Shop-Environment
X-Presslabs-Stats
X-Oracle-DMS-ECID
Vha6-Origin
X-Pf-Uncompressing
Media-Length
X-Host-Name
X-Lb-Id
X-ElasticPress-Search
X-BBC-Edge-Cache-Status
X-Air-Pt
X-Via-PopH
X-Via-PopN
WZWS-RAY
X-Cluster-Node
X-LiteSpeed-Tag
PICS-Label
X-Via-PopV
Epwk-X-Cache
Datacenter
Warning
X-Varnish-URL
X-Acquia-Purge-Tags
X-Ftr-Request-Id
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Acquia-Site
Xet-Cookie
X-Cache-Tag
X-BBC-Origin-Response-Status
X-Akamai-ERRuleID
X-Vcache
X-Traceid
X-Akamai-ERPolicy
X-Render-Time
X-Request-URL
X-MiniProfiler-Ids
X-Ms-Meta-Originalurl
EpKe-Alive
X-Ms-Meta-Staticbatchstarttime
X-Varnish-Beresp-TTL
CountryCode
X-Tx-Id
X-Conf
X-Mg-Request-Id
X-Cache-Status-Check
X-Apw-Hits
X-C
Environment
X-Yottaa-OS
X-Apw-Access-Token
X-Pjax-Url
X-Redis-Duration-Ms
Ohc-Response-Time
Phost
X-B3-Parentspanid
X-Amz-Meta-Cb-Modifiedtime
X-Debug-Cache-Fetch
X-Debug-Cache-Store
X-Tid
X-Litespeed-Cache-Control
NnCoection
X-Redis-Count
X-Apw-Access-Action
Inserted-Into-Cache-At
URI
Content-Script-Type
Content-Style-Type
X-Apw-Access-Object