Threat Level: green Handler on Duty: Daniel Wesemann

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
CF-RAY
Expect-CT
Accept-Ranges
X-XSS-Protection
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-Xss-Protection
X-UA-Compatible
X-Served-By
X-Download-Options
X-Timer
X-Request-Id
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
Access-Control-Allow-Credentials
Accept-CH
Content-Security-Policy-Report-Only
X-DNS-Prefetch-Control
X-Runtime
Accept-CH-Lifetime
X-AspNet-Version
X-Check
X-Drupal-Cache
X-Ua-Compatible
X-Generator
X-Cache-Status
Server-Timing
X-Cacheable
Timing-Allow-Origin
X-Envoy-Upstream-Service-Time
X-FRAME-OPTIONS
X-Iinfo
X-Request-ID
X-Drupal-Dynamic-Cache
X-Content-Security-Policy
Feature-Policy
Access-Control-Expose-Headers
Content-Encoding
X-CDN
Upgrade
Status
X-AspNetMvc-Version
CF-Ray
Access-Control-Max-Age
X-Amz-Request-Id
X-Amz-Id-2
Cf-Edge-Cache
Permissions-Policy
X-Via
Host-Header
EagleId
Keep-Alive
Request-Context
X-Cache-Group
X-Robots-Tag
X-Backend
X-UA-Device
X-Hacker
X-AH-Environment
X-Proxy-Cache
X-Server
X-Turbo-Charged-By
X-Rq
X-Age
X-Ws-Request-Id
X-Vhost
Cf-Apo-Via
X-Amz-Version-Id
Xkey
X-Dispatcher
X-Swift-SaveTime
X-Swift-CacheTime
Grace
X-Server-Powered-By
Ali-Swift-Global-Savetime
Allow
X-Varnish-Cache
P3p
X-LiteSpeed-Cache
X-OneAgent-JS-Injection
X-Page-Speed
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Dns-Prefetch-Control
X-Device
X-Cache-Lookup
EagleEye-TraceId
X-WebKit-CSP
X-Host
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Backend-Server
Cf-Railgun
X-Server-Id
X-Readtime
X-Response-Time
Surrogate-Control
X-Akam-SW-Version
X-Ruxit-JS-Agent
X-HW
Request-Id
X-Cloud-Trace-Context
X-Litespeed-Cache
X-Node
X-Country
Content-Location
X-Nginx-Cache-Status
X-Application-Context
Accept-Ch-Lifetime
X-Nginx-Upstream-Cache-Status
X-ASPNET-VERSION
X-NWS-LOG-UUID
X-Country-Code
Service-Worker-Allowed
X-Content-Type
X-Trace
X-Url
Cache-Tag
X-Clacks-Overhead
X-Amz-Server-Side-Encryption
Rating
X-Times
X-Rack-Cache
X-Vname
X-PC
X-TtlSet
Cross-Origin-Opener-Policy
X-Mcache
X-Edge
X-Midtier
X-Browser-Type
X-Server-Name
X-Daa-Tunnel
Nginx-Cache
Accept-Ch
AR-SID
AR-PoweredBy
AR-ATIME
AR-Request-ID
X-Powered-By-Plesk
X-Cache-TTL
X-Cnection
X-FTR-Request-ID
X-ESI
X-Ac
X-GitHub-Request-Id
X-D2id
Verso
Edge-Control
X-Element-Page-Cache
X-GoogleNews-Bot
X-Kinja
X-Kinja-Revision
X-Kinja-Server
X-Exp-Id
X-Kinja-Build
X-Exp-Variant
X-Cdn-Fetch
X-CST
X-MS-InvokeApp
AR-CACHE
X-Ser
X-Vcap-Request-Id
X-Abt-Application-Version
X-Dw-Request-Base-Id
X-Upstream
X-Navigation-Version
Fastly-Restarts
X-Webkit-Csp
X-B3-TraceId
X-ECACHE
SPRequestDuration
SPIisLatency
X-FastCGI-Cache
X-Mod-Pagespeed
X-Amz-Rid
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Server-Lifecycle-Phase
X-Instrumentation
X-PDP-UNCACHING-HASH
X-Kraken-Loop-Name
X-Client-IP
X-SharePointHealthScore
SPRequestGuid
X-ARC
X-Goog-Hash
X-Edge-Location-Klb
X-Kinsta-Cache
X-Sol
Display
Pagespeed
X-Middleton-Display
X-Oneagent-Js-Injection
X-Powered-CMS
X-Mg-S
X-Ratelimit-Limit
X-Amzn-Trace-Id
Edge-Cache-Tag
Cache-Status
S
X-Version
Access-Control-Request-Method
Response
X-Middleton-Response
X-VARITI-CCR
X-Ratelimit-Remaining
X-NF-Request-ID
RTSS
X-Forwarded-For
Realpath
X-Cache-Key
X-T
X-Content-Digest
Cross-Origin-Resource-Policy
X-Server-ID
X-TTL
Fastcgi-Cache
X-Cached
X-Recruiting
X-Correlation-Id
X-ORACLE-DMS-RID
X-Fastly-Request-ID
X-MSEdge-Ref
X-NODE
X-Shield-Request-Id
X-TraceId
MicrosoftSharePointTeamServices
Front-End-Https
X-Forwarded-Proto
X-PressLabs-Stats
X-Ruxit-Js-Agent
X-SRCache-Store-Status
X-SRCache-Fetch-Status
TP-Cache
X-Frontend
Payment
X-Ua-Browser
X-HS-Cache-Config
X-HS-Hub-Id
X-LLID
Arr-Disable-Session-Affinity
X-HS-Content-Id
Public-Key-Pins
X-Request-Received
X-Request-Processing-Time
Count-Hit
X-Protected-By
Server-Node
Content-MD5
X-GUploader-UploadID
X-Newrelic-App-Data
X-HS-Combine-CSS
X-RateLimit-Remaining
X-LB-Cache
X-Accel-Expires
X-Distributor
MS-Author-Via
X-Varnish-TTL
X-Origin-Server
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-TEC-API-ROOT
Surrogate-Key
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Ezoic-Cdn
X-ORACLE-DMS-ECID
X-Microsite
X-Request-Handler-Origin-Region
X-Content-Security-Policy-Report-Only
X-Country-Code-Real
X-FTR-Balancer
X-FTR-Backend-Server
X-FTR-Backend
X-Jurisdiction
X-FTR-Cache-Status
X-HP-Webp
X-HP-Trace-Id
Accept-Charset
Mrf-Cache-Status
X-Varnish-Server
X-Www-Served-By
X-Az
X-AppVersion
X-Activity-Id
X-App-Server
MRF-Tech
X-B3-TraceId-Primal
X-Ua-Device
Host
X-Cluster-Name
Cache-Tags
Retry-After
X-Varnish-Backend
X-Amz-Meta-S3cmd-Attrs
Cleartype
X-Unique-Id
Filterid
X-Goog-Metageneration
X-FTR-Expires
X-Ttl
X-Hits
X-Debug
Server-Name
X-Git-Hash
X-Aspnet-Version
Access-Control-Allow-Method
X-Logged-In
X-Varnish-Ttl
X-Load-Cache
X-Id
X-Upgrade-Enabled
X-Azure-Ref
X-NGENIX-Cache
X-FB-Debug
X-Envoy-Decorator-Operation
X-CSRF-Token
X-Geo-Country
X-Amzn-RequestId
X-Amz-Apigw-Id
TCN
X-Hostname
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-B
X-Seen-By
X-TT
TP-L2-Cache
Section-Io-Cache
X-Proxy
X-Revision
X-Request-Guid
X-Cache-Control
X-Grace
Healthy
X-Type
X-Contextid
X-Fb-Rlafr
Viewport
X-B3-Sampled
X-Trace-Id
DC
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Goog-Stored-Content-Length
Fastly-SWR
Fastly-SIE
X-Time
X-F-Cache
X-N
X-Ratelimit-Reset
X-CCDN-CacheTTL
X-Hcs-Proxy-Type
X-CCDN-Origin-Time
Content-Disposition
X-Mobile
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Paypal-Debug-Id
Referer-Policy
X-Varnish-Grace
X-Nf-Request-Id
X-Amz-Replication-Status
X-XRDS-LOCATION
X-Webkit-CSP
X-Origin-Cache
X-Magnolia-Registration
X-Pinterest-Rid
X-Via-JSL
Pinterest-Version
Pinterest-Generated-By
X-DIS-Request-ID
X-Debug-Info
X-Page-Id
X-Wormhole-Sdk
X-Px
Version
X-Oracle-Dms-Ecid
X-Ismobilevalue
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-UUID
X-Content-Options
X-G
X-Datadog-Trace-Id
X-Adobe-Loc
X-Adobe-Content
X-App-Environment
X-Rule
Amp-Access-Control-Allow-Source-Origin
X-Yottaa-Metrics
X-Wix-Request-Id
X-ProcessESI
X-RemovedCookies
NGB
X-Datadog-Sampled
X-Region
X-Template
X-Yottaa-Optimizations
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-Rid
SD-X-WS
Ms-Operation-Id
X-Hl-Ver
X-RTag
X-Node-Name
Cross-Origin-Window-Policy
X-Instance
X-Whom
X-Source
MS-CV
X-NYM-Debug-Backend
X-Debug-IsPreview
X-Debug-IsConnected
X-Backend-Name
X-User-Agent
X-Is-Bot
X-B-Cache
X-Storage
X-Proxy-Cache-Info
X-Tumblr-User
X-Rendered-As
X-Tumblr-Pixel
X-Signature
X-Device-Type
GEO-INFO
X-Cacheable-TTL
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Status
Country
X-FW-Static
X-FW-Version
X-FW-Type
X-FW-Serve
X-Environment-Context
X-ServerID
X-FW-Server
X-L-Path
X-FW-Dynamic
X-FW-Hash
X-Cache-Age
Charset
X-RM-Cache-TTL
Countrycode
SRV
ServerID
Akamai-GRN
X-IPS-LoggedIn
Front
X-NWS-UUID-VERIFY
X-Real-IP
X-Framework
X-EdgeConnect-Cache-Status
X-WP-CF-Super-Cache-Active
X-Cache-Grace
X-AB
X-ECache
X-Amzn-Remapped-Content-Length
Liferay-Portal
X-Cache-Hit
X-Language
X-B3-SpanId
X-Oracle-Dms-Rid
X-Air-Pt
X-Xrds-Location
X-Content-Powered-By
X-Api-Version
X-Akamai-Request-ID2
X-Fastly-Request-Id
X-DataDome
X-Air-Source
X-WebKit-CSP-Report-Only
X-Air-Trace-Id
X-Air-Hostname
X-Servername
OT-Force-Account-Verify
Xet-Cookie
Accept-Language
X-UA
X-Sucuri-ID
X-Sucuri-Cache
X-VC
X-Mode
From-Origin
X-URL
X-VC-Cache
X-Cache-Status-Check
Access-Control-Request-Headers
X-SRV
Backend
X-Tt-Logid
LB
Webserver
Refresh
X-HTML-Minification-Powered-By
X-Nginx-Cache
X-Handled-By
X-Mg-Request-UUID
Upgrade-Insecure-Requests
X-Container-Uri
X-RCS-CacheZone
X-JoinUs
Filters
X-SaId
X-Cache-Time
X-UPSTREAM-Address
X-Git-Commit
X-Rewrite-Enabled
X-Rn-Rsrv
Meta-Geo
Xserver
TWC-GeoIP-Country
Webcakes-Region
Webcakes-App-Version
X-Forwarded-Host
TWC-Locale-Group
X-Origin-Hint
TWC-GeoIP-LatLong
Property-Id
Webcakes-App-Name
X-Generated-By
X-Cms-Context
TWC-Privacy
X-RateLimit-Limit
TWC-Connection-Speed
X-PHP-Host
X-Adobe-Source
X-Hosted-By
X-Webstats-RespID
X-Origin-Date
X-Request-URI
X-Labrador-Cache-Channel
X-Provided-By
X-S
X-R9-Blue-Green-Version
TWC-Device-Class
Cache
X-Loop
X-Cache-Debug
X-Browser-Name
Section-Io-Id
X-Served-From
X-Cache-Host
X-Reqid
Mn-Server-Ip
X-Storefront-Renderer-Rendered
X-Restarts
Apigw-Requestid
X-ProxyCache-Status
X-BYPASS-REASON
X-Vcl-Version
Atl-Traceid
X-Scope-Id
X-Accel-Version
X-Locale
X-Is-Desktop
X-Shopify-Stage
X-Httpd
X-Xfnlog-Site
X-Alternate-Cache-Key
X-Tb
X-Is-Mobile
X-Is-Supported-Browser
X-Varnish-Age
X-Site-Version
X-Lambda-Id
X-Web-Node
X-Tncms
X-Is-Tablet
X-Geo-Region
X-Akamai-Edgescape
X-ProxyCache-Key
Url
X-Fetched-On
X-Logging-Id
ServedBy
X-Format
Web-Mar-Node
X-Tcp-Rtt
X-VCT
X-Varnish-Cache-Hits
X-Detected-As
X-Varnish-Beresp-Grace
X-Soup
X-Director
X-Origin
Selected-Fe
X-Upstream-Ct
X-Upstream-Ht
X-Redis-Cache
X-Frame-Option
X-Proxy-Build
X-Optimistic-Header
X-No-Session
X-Say-Cacheable
Onion-Location
X-SayCDN-TTL
X-IPLB-Instance
X-IPLB-Request-ID
X-Cluster
X-Skip-Cache
X-Say-TTL
X-Timing-Wait
X-Proxied
X-AWS-Id
X-Cache-Operation
X-Zipkin-Id
X-Extlb
X-Cache-Rule
X-ShopId
X-RID
X-LJ-Flow-ID
X-VWS-Id
X-Tumblr-Pixel-2
X-ShardId
X-Sorting-Hat-ShopId
X-Routing-Service
X-Cloudmap
X-Edge-Location
X-Sorting-Hat-PodId
X-Vcache
X-Cache-Expired-At
X-Ms-Version
X-Ms-Request-Id
X-Endurance-Cache-Level
X-INCAP-ABP
X-CDN-Forward
X-Connection-Hash
X-Aws-Lambda-Call-Status
Expiry
X-Lagoon
X-GeoCode
X-GeoCountry
X-WP-CF-Super-Cache-Cookies-Bypass
WPO-Cache-Message
WPO-Cache-Status
Cdn-Requestid
Frame-Options
Source
Priority
Environment
Protected
X-Azure-Ref-OriginShield
X-Fastcgi-Cache
X-Cache-Action
X-Proxy-Cache-Status
CF-IPCountry
Thinkindot-CacheControl
TDXMobile
X-CMSURLCustom
Thinkindot-Control
X-Generation-Time
Thinkindot-CacheControl-Type
Fastcgi-Useragent
X-Thinkindot-L3
X-Shield-Cache-Expires
Uber-Trace-Id
X-Origin-CC
X-PHP-Backend
X-Origin-TTL
X-Drupal-Cache-Tags
X-Drupal-Cache-Contexts
X-App-Version
X-Cluster-Node
X-Cdn-Origin
X-Urbn-Context-Path
X-Urbn-Site-Id
X-ID
X-GEO
Locale
X-Pass-Why
X-Rocket-Nginx-Serving-Static
X-Aspnetmvc-Version
Azure-SlotName
Azure-InstanceId
Azure-RegionName
Azure-SiteName
Azure-Version
X-Worker
X-XRDS-Location
X-FB-TRIP-ID
Node
X-Buckets
Sid
X-Vercel-Id
Cache-Tv-Group
X-Auth-Group-Type
X-Vercel-Cache
CDN-EdgeStorageId
CDN-RequestPullCode
CDN-RequestPullSuccess
CDN-RequestCountryCode
CDN-PullZone
CDN-Cache
CDN-CachedAt
CDN-Uid
Cache-Hits
X-B3-Traceid
X-Server-W
Alternate-Protocol
AMP-Access-Control-Allow-Source-Origin
X-Tumblr-Pixel-3
X-TA-CDN-Provider
X-Pad
Cross-Origin-Embedder-Policy
X-Client-Ip
X-DC
X-A
Wxu-Next-Commit
Wxu-Next-Hostname
X-A-Wwc
T-Server
Surrogated-Key
Rendered-Blocks
Sslversion
Wxu-Next-Region
X-Aed
X-A-Dgt
PFcat
X-A-Dam
X-A-Ccd
X-Bc-Bl
X-BCube-Filmed-By
X-A-Dcw
Fastly-SSL
Cdn-Request-Time
Content-Secure-Policy
DB-Nickname
Cdn-Host
Candidate-Md5Url
X-LSADC-Cache
A
Cache-Provider
DCR-Decision-By
DCR-Processing-Time-Ms
Meta-Geo-Continent
Ngx.Var.Host
Odigeo-Trace-Id
MD5-Digest
Magicmarker
Gannett-Cam-Experience-Id
Lang
Origin-Agent-Cluster
X-Core-Value
X-Origin-Expires
X-Rojux
X-ScT
X-Org
X-NodeID
X-Ig-Push-State
X-Level-Front-Cache
X-ND-Cache
X-SRCache-Key
X-TIM-N
X-Vdms-Version
X-Viewer-Country
X-Vtex-Remote-Cache
X-VarnishDD-TTL
X-Varnish-Remaining-TTL
X-V-Cache
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Ig-Origin-Region
X-HN
X-D
X-DefElseHash
X-DefHash
X-Content-Age
X-Conf
X-Cache-Id
X-Cache-NE
X-Cache-TTL-Remaining
X-Developer
X-Ec-Fail
X-Generated-On
X-GeoIP-City
X-Gzip
X-Fastly-Backend
X-Esi-Check
X-Ec-GeoHdr
X-Edge-Server
X-Epic-Correlation-Id
X-Bl-Debug
X-Custom-Header
X-Tx-Id
X-Cache-Server
Mime-Version
User-Cache-Control
X-LiteSpeed-Cache-Control
X-HS-Content-Campaign-Id
X-CGP
X-Hnp-Log
X-CacheTTL
Platform
Powered-By
X-Cache-Bucket
Req-ID
X-Cache-FS-Status
Producers
X-Cache-Info
X-Clientip
X-UA-Device-Type
HA-Ipaddr
Is-Eu
Ha-Gx-Prefs
X-Debug-Cache-Fetch
X-Test
X-Debug-Cache-Store
X-App-Name
L5d-Success-Class
X-Csrf-Jwt
X-Micro-Cache
X-VTEX-Cache-Server
X-VTEX-Cache-Time
X-Thanos
NM-Fastcgi-Cache
RNT-Time
X-Backend-Instance
X-B3-Trace-ID
X-Region-Sid
X-Loc
X-Bip
X-Men
X-Access
X-Acquia-Purge-Cdn-Unconfigured
X-Varnish-Director
X-Req
X-AK-Request-ID
X-Aicache-OS
X-Jobs
W
Vix-Hermes-Req-Id
Ssr
X-VG-WebCache
X-Via-Fastly
X-Block-Status
Server-Host
X-GeoIP-Country-Code
True-Client-Country-4JS
X-VG-TLSProxy
Tube-Return
V-Age
Tube-Got-Results
Tube-Got-Eval
Tube-Get-Contents
RNT-Machine
L
Apple-News-Services-Request-Url
X-Origin-Time
X-Origin-Response-Time
Apple-News-Services-Parsed-Url
X-Forwarded-Site
Apple-News-Services-Host
X-Wikidot-Backend
X-SD-PageType
X-Sn-Servicetimems
X-Fmm-Version
CDCHOST
X-Proto
X-GoCache-CacheStatus
Apple-News-Services-Handled
X-Eu-Site
X-FC-Vary-Parameters
X-Node-Id
X-Policy
X-Nyt-Route
X-Op-Id-All
X-Platform
X-NMSegId
X-Fastly-Cache
X-Mvc-Supplant-Cachable
Adler-Geo
X-Powered-By-VTEX-Cache
X-Server-IP
X-Section
Cdncip
X-GeoIP-Region-Code
XM
X-Mly-Id
X-Request-Time
X-Pubstack
Country-Code
Cdnsip
X-SVT-ORM-VERSION
X-GeoIP
Fastly-Backend-Name
X-Tb-Optimization-Total-Bytes-Saved
Esi-Enabled
X-Wikidot-Static-Cache
Edge-Cache
Content-Style-Type
X-SVT-ORM-RULES
Content-Script-Type
X-Dispatcher-Server
X-Gdpr
Click-Count-Action-Start
Click-Count-Error
X-Service
X-Gen-Mode
X-DPWN-IS-SECURE
Server-Info
X-Dc
HostName
X-HITS
X-Varnish-Beresp-Ttl
X-Auto-Login
X-Geo-Header
X-Scheme
X-Request-Host
X-SB
X-Slack-Shared-Secret-Outcome
X-Contensis-Viewer-Groups
X-Hash
X-Cdn-Srv
X-CUA
X-Cs
X-Date
X-Depends
X-Request-Start
X-Ec-Custom-Error
X-Varnish-Authentication
X-Varnish-Beresp-Status
X-Cache-Aspx
X-Slack-Backend
X-Var-Ttl
X-Human
X-BBC-Edge-Cache-Status
Server-Hostname
Host-ID
Gh-Request-Id
X-We-Are-Hiring
Fastly-GeoIP-CountryCode
Machine
Mail-Subject
Origin-CC
Origin
On-Server
NGX
DSUID
X-RateLimit-Limit-Second
C-Via
AKAMAI
X-Pool
X-Nginx-Cache-Key
Cache-Key
BehaviorPad-Version
Yak-Timeinfo
X-Mvc-Supplant-OutputCached
X-Proxied-Request
Canary
Origin-EX
X-RateLimit-Remaining-Second
We-Hiring
X-PAYTM-SRV-ID
Server-Ext
Req-Svc-Chain
Web-Mar-Region
X-Location
X-Amz-Storage-Class
X-Varnish-Hostname
X-Accel-Expires-Debug
X-Varnishpool
Release
Sever-Int
Proxy-Firewall
Pramga
X-NGINX-Cache
X-AIR-PT
Debug
Cluster
X-Ad-Load-Variation
Fusion-Component-Id
Fusion-Source
Fusion-Template-Id
X-WA-Info
Fusion-Content-Id
Fusion-Content-Source
Fusion-Deployment-Id
X-APP
X-Device-Os
X-CLOUD-TRACE-CONTEXT
X-Newrelic-Synthetics
Redirect-Candidate
X-Ah-Environment
X-LB-ID
X-MP-GENERATED-AT
SID
X-Tec-Api-Version
X-Tec-Api-Origin
X-Tec-Api-Root
Fastly-Drupal-HTML
Pics-Label
X-Via-Poph
X-Varnish-Hits
X-Via-Popn
X-Via-Popv
X-Content-Length
X-HA-Backend
GeoIP-Latitude
X-Zone
X-RateLimit-Reset
X-NCache
X-VHOST
X-Up
X-Akamai-Transformed
CloudFront-Viewer-Country
X-From
X-CACHE-AGE
CDN-RequestId
X-Jungle-Id
X-Servedbyhost
X-Nananana
X-Cache-Backend
X-B3-Parentspanid
Vc-Max-Age
X-LiteSpeed-Tag
X-Litespeed-Tag
X-Refresh
X-Nc
X-Vdms-Path
X-LB-NoCache
X-Dispatcher-Number
X-Parent-Response-Time
Fastly-Drupal-Html
Product
X-CACHE-KEY
X-RequestId
X-ZONE
X-CDN-Cache-Status
X-Cached-By
WP-Super-Cache
X-Uri
X-Wa
Server-ID
X-DynaTrace-JS-Agent
X-Ckpd-Fst-Backend
Resin-Trace
X-Render-Time
X-ApacheServer
X-Datadome
X-PERF
X-VC-TTL
Datacenter
X-M-Reqid
X-M-Log
Cdn
X-B3-Spanid
X-Bug-Bounty
X-Amz-Meta-Cb-Modifiedtime
X-CS
GeoIp-Country-Code
X-Origin-Cache-Key
S-Rt
NtCoent-Length
X-IAuth-Set-Uid
Uri
ServerName
FSS-Cache
X-Fpc
X-Varnish-Beresp-TTL
X-HubSpot-Correlation-Id
Locid
X-Esi
True-Client-Ip
Serverhost
X-TX-ID
X-SERVER-NAME
X-HostName
X-Nf-Language
True-Client-IP
X-Nf-Ats-Version
X-Nf-Country
X-TT-LOGID
GeoIP-Country-Code
User-Agent
Tcn
X-VCache
X-Akamai-Device-Characteristics
Srv
X-Vmg-Version
X-Dynatrace-Js-Agent
X-Srv
X-TIME
X-Old-Content-Length
X-FPC
X-NewRelic-App-Data
X-Info
ServerHost
X-Gamma-Serve
X-Cdn-Cache-Status
X-Hit
X-Webkit-Csp-Report-Only
Request-ID
CDN
Xc-Version
X-WA
CacheControlHeader
Ngx-Var-Key
X-Vc
X-Response-Served-From
X-Original-Request-Id
X-Moov-Xdn-Version
Server-Id
Expect-Staple
X-Cdn-Forward
X-Vgn-Hpd-Reason
X-Moov-T
X-APP-VERSION
X-COUNTRY
Hostname
Srvid
X-NC
X-TH-Server
Cneonction
X-FL-QIT-DEBUG
X-Amz-Meta-Opti
X-Presslabs-Stats
Cf-Ipcountry
X-V
X-Lb-Nocache
X-Dispatch
X-Geo
X-Platform-Cluster
X-Platform-Processor
X-Platform-Router
N-Cache
X-Eligible
X-New
X-ServedByHost
WZWS-RAY
X-Rollout
X-Platform-Server
PICS-Label
Permission-Policy
Cf-Device-Type
Geoip-Latitude
Cloudfront-Viewer-Country
X-Oracle-DMS-ECID
X-VCL-Version
X-Limited
X-Application
X-S-Cookie
Cross-Origin-Embedder-Policy-Report-Only
Origin-Trial
X-B-Cookie
X-Proxy-CacheRZ
X-Destination
X-Via-PopH
X-Via-PopV
X-User
X-Ha-Backend
X-External-Request-Id
XkeyRZ
X-Via-PopN
Ohc-File-Size
X-Correlation-ID
X-Internal-TTL
X-Zen-Fury
X-Akamai-Pragma-Client-IP
X-ElasticPress-Query
X-Ua
X-Ftr-Request-Id
X-App
Rtss
X-Via-CDN
Edge-Copy-Time
X-Sqd-Stime
X-Via-SSL
X-VTEX-Cache-Backend-Header-Time
X-Lb-Id
X-Via-Edge
X-Path
X-EC-Lua
X-Sqd-Ctime
Cl-Cache
X-VTEX-Cache-Backend-Connect-Time
X-Instance-Name
X-Cache-Date
X-MSEdge-Flight
Ms-Author-Via
X-MSEdge-Features
X-Serial
X-Rocket-Build-Number
X-Sigma
X-Litespeed-Cache-Control
X-Check-Cacheable
Epwk-X-Cache
X-Sigma-Backend
X-MiniProfiler-Ids
X-Wp-Cf-Super-Cache
X-Wp-Cf-Super-Cache-Cache-Control
Lb
X-Acquia-Purge-Tags
Timeexpire
X-SIPLIST1
IsBot
X-Segment-20210421
X-Datacenter
X-Branch-Name
X-API-Version
X-VServer
X-Service-Response-Time
Cmstype
X-Web-Server
X-Acquia-Application-Trace
X-Acquia-Site
X-Acquia-Application-UUID
Sm-Log-Id
Cmsid
X-CSRF-TOKEN
X-CDN-Origin
Servername
CountryCode
X-LAGOON
X-RAMCache
X-IN-APIGATEWAY
X-IN-APIGATEWAYSSL
X-Shopid
X-Dw-Trace-Id
X-Traceid
X-Irp-Debug
X-DynaTrace
X-Sorting-Hat-Podid
X-Udemy-Cache-App-Namespace
Fl-Custom-Application
Warning
X-Fastly-Backend-Reqs
Ngx
Wpo-Cache-Status
X-Snapshot-Date
Wpo-Cache-Message
X-Th-Server
X-Origin-Upstream-Status
X-Amz-Meta-S3b-Last-Modified
X-Ramcache
Ohc-Cache-HIT
X-Shardid
X-Sorting-Hat-Shopid
X-Amz-Meta-Sha256