Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-XSS-Protection
CF-RAY
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Request-Id
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
X-FRAME-OPTIONS
Access-Control-Allow-Credentials
Content-Security-Policy-Report-Only
Accept-CH
X-DNS-Prefetch-Control
X-Runtime
Accept-CH-Lifetime
X-AspNet-Version
X-Drupal-Cache
X-Check
CF-Ray
X-Generator
X-Cache-Status
Server-Timing
X-Request-ID
X-Cacheable
X-Ua-Compatible
Timing-Allow-Origin
X-Envoy-Upstream-Service-Time
X-Iinfo
X-Drupal-Dynamic-Cache
X-Content-Security-Policy
Feature-Policy
Access-Control-Expose-Headers
Content-Encoding
X-CDN
Status
Upgrade
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Amz-Id-2
Cf-Edge-Cache
X-Via
Host-Header
EagleId
Permissions-Policy
Keep-Alive
Request-Context
X-Cache-Group
X-Backend
X-Robots-Tag
X-UA-Device
X-AH-Environment
X-Hacker
X-Server
X-Proxy-Cache
X-Turbo-Charged-By
Xkey
X-Rq
X-Age
X-Ws-Request-Id
X-Vhost
X-Amz-Version-Id
Cf-Apo-Via
X-Dispatcher
X-LiteSpeed-Cache
X-Swift-SaveTime
X-Swift-CacheTime
X-Server-Powered-By
Grace
Allow
Ali-Swift-Global-Savetime
X-Varnish-Cache
P3p
X-OneAgent-JS-Injection
X-Pingback
X-Page-Speed
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Dns-Prefetch-Control
X-Cache-Lookup
X-Device
X-WebKit-CSP
EagleEye-TraceId
X-Host
Cf-Railgun
X-Backend-Server
X-Server-Id
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Response-Time
X-Readtime
Surrogate-Control
X-Akam-SW-Version
X-Ruxit-JS-Agent
X-HW
X-Cloud-Trace-Context
Request-Id
X-Node
Content-Location
X-Country
X-Nginx-Cache-Status
X-Application-Context
X-Nginx-Upstream-Cache-Status
Accept-Ch-Lifetime
X-NWS-LOG-UUID
X-Country-Code
X-ASPNET-VERSION
Service-Worker-Allowed
X-Content-Type
X-Trace
X-Url
Cache-Tag
X-Clacks-Overhead
Rating
X-Amz-Server-Side-Encryption
X-Rack-Cache
X-Times
X-TtlSet
X-Vname
X-PC
X-FTR-Request-ID
Cross-Origin-Opener-Policy
X-Litespeed-Cache
X-Edge
X-Daa-Tunnel
X-Mcache
X-Midtier
X-Browser-Type
X-Server-Name
Nginx-Cache
X-CST
Accept-Ch
X-Powered-By-Plesk
AR-PoweredBy
AR-ATIME
AR-Request-ID
AR-SID
X-Cnection
X-Cache-TTL
X-Ac
X-ESI
X-D2id
X-GitHub-Request-Id
Edge-Control
X-Element-Page-Cache
X-Kinja
X-Cdn-Fetch
X-Kinja-Server
X-Exp-Variant
X-Exp-Id
X-Kinja-Build
X-GoogleNews-Bot
X-Kinja-Revision
Verso
X-MS-InvokeApp
X-ECACHE
AR-CACHE
X-Ser
X-Vcap-Request-Id
X-Abt-Application-Version
X-Upstream
X-Navigation-Version
X-Oneagent-Js-Injection
X-Dw-Request-Base-Id
X-Webkit-Csp
Fastly-Restarts
SPRequestDuration
X-FastCGI-Cache
SPIisLatency
X-B3-TraceId
X-Mod-Pagespeed
X-Amz-Rid
X-SharePointHealthScore
SPRequestGuid
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-Erf-Bev-Bev
X-Instrumentation
X-Erf-Bev-Bev-Is-Generated
X-Client-IP
X-PDP-UNCACHING-HASH
X-Goog-Hash
X-Kinsta-Cache
X-Edge-Location-Klb
X-ARC
X-Ratelimit-Limit
X-Mg-S
X-Powered-CMS
Pagespeed
Edge-Cache-Tag
Display
X-Middleton-Display
X-Sol
S
X-NF-Request-ID
X-Amzn-Trace-Id
Cache-Status
X-Version
Access-Control-Request-Method
X-VARITI-CCR
X-Middleton-Response
Response
X-Ratelimit-Remaining
X-TTL
X-Fastly-Request-ID
RTSS
X-TraceId
Realpath
X-Ruxit-Js-Agent
X-Forwarded-For
X-Content-Digest
X-Cache-Key
Cross-Origin-Resource-Policy
X-T
X-Correlation-Id
X-Recruiting
Fastcgi-Cache
X-Cached
X-ORACLE-DMS-RID
X-Varnish-TTL
X-MSEdge-Ref
Front-End-Https
X-Shield-Request-Id
MicrosoftSharePointTeamServices
Content-MD5
X-HS-Content-Id
X-HS-Cache-Config
X-HS-Hub-Id
X-FTR-Backend-Server
MS-Author-Via
X-Forwarded-Proto
X-FTR-Balancer
X-Country-Code-Real
X-FTR-Backend
X-Protected-By
X-FTR-Cache-Status
X-Ua-Browser
X-Frontend
X-LLID
TP-Cache
Server-Node
Payment
Arr-Disable-Session-Affinity
X-Request-Processing-Time
Public-Key-Pins
X-PressLabs-Stats
X-Request-Received
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-RateLimit-Remaining
Count-Hit
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-Server-ID
X-HS-Combine-CSS
X-FTR-Expires
X-Accel-Expires
X-GUploader-UploadID
X-Distributor
X-LB-Cache
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-NODE
X-Origin-Server
X-Jurisdiction
X-HP-Webp
X-HP-Trace-Id
X-Ezoic-Cdn
X-Newrelic-App-Data
X-Request-Handler-Origin-Region
X-Microsite
X-Activity-Id
X-AppVersion
X-Az
X-Www-Served-By
MRF-Tech
Mrf-Cache-Status
Host
Accept-Charset
X-B3-TraceId-Primal
X-Varnish-Server
Cache-Tags
X-Cluster-Name
X-Ua-Device
X-Content-Security-Policy-Report-Only
Cleartype
X-Varnish-Backend
X-App-Server
Retry-After
X-ORACLE-DMS-ECID
X-Amz-Meta-S3cmd-Attrs
X-Goog-Metageneration
Server-Name
X-Unique-Id
Filterid
X-Hits
Surrogate-Key
X-Git-Hash
Access-Control-Allow-Method
X-Debug
X-Envoy-Decorator-Operation
X-Azure-Ref
X-CSRF-Token
X-Logged-In
X-NGENIX-Cache
X-Load-Cache
X-Id
X-Upgrade-Enabled
X-Ttl
X-Geo-Country
X-Hostname
X-FB-Debug
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Proxy
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
TCN
X-Time
TP-L2-Cache
X-B
Section-Io-Cache
X-B3-Sampled
X-TT
X-Seen-By
X-Hcs-Proxy-Type
X-Cache-Control
X-Revision
X-Grace
X-CCDN-Origin-Time
X-CCDN-CacheTTL
X-Request-Guid
X-Trace-Id
Healthy
DC
X-Contextid
X-Fb-Rlafr
Viewport
X-F-Cache
Referer-Policy
X-Type
X-Mobile
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Storage-Class
X-N
Fastly-SWR
Fastly-SIE
Paypal-Debug-Id
X-DIS-Request-ID
Content-Disposition
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-XRDS-LOCATION
X-Varnish-Ttl
X-Page-Id
X-Debug-Info
X-Varnish-Grace
X-Origin-Cache
X-Webkit-CSP
X-Px
X-Via-JSL
X-Magnolia-Registration
X-Aws-Lambda-Call-Status
Version
X-Whom
X-Amz-Replication-Status
X-Oracle-Dms-Ecid
X-Datadog-Trace-Id
X-Ratelimit-Reset
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-Template
X-Content-Options
X-UUID
X-RemovedCookies
X-G
X-ProcessESI
X-Debug-IsPreview
X-App-Environment
X-Debug-IsConnected
X-Adobe-Loc
X-Rule
X-Node-Name
X-Rid
X-RTag
X-Adobe-Content
Ms-Operation-Id
MS-CV
X-Tumblr-Pixel
X-Source
VIX-Pulpo-Upstream-Status
X-Storage
X-Tumblr-Pixel-1
X-Hl-Ver
NGB
X-Tumblr-User
X-Yottaa-Metrics
X-Yottaa-Optimizations
Charset
SD-X-WS
X-Tumblr-Pixel-0
X-Wix-Request-Id
VIX-Pulpo-Node
X-Datadog-Sampled
X-Wormhole-Sdk
X-User-Agent
X-Rendered-As
X-Cacheable-TTL
X-L-Path
X-Is-Bot
X-Proxy-Cache-Info
X-Device-Type
X-Region
X-Environment-Context
X-FW-Serve
X-FW-Type
X-Instance
X-FW-Dynamic
X-Cache-Grace
GEO-INFO
X-NWS-UUID-VERIFY
Cross-Origin-Window-Policy
X-FW-Static
X-Signature
X-ServerID
X-FW-Server
X-FW-Version
X-NYM-Debug-Backend
X-FW-Hash
X-Backend-Name
X-B-Cache
X-Cache-Age
Country
X-Status
Countrycode
ServerID
X-Real-IP
X-IPS-LoggedIn
Amp-Access-Control-Allow-Source-Origin
X-EdgeConnect-Cache-Status
SRV
X-Cache-Hit
X-RM-Cache-TTL
Akamai-GRN
X-Amzn-Remapped-Content-Length
Liferay-Portal
Front
X-WP-CF-Super-Cache-Active
X-Language
X-Framework
X-Xrds-Location
X-B3-SpanId
X-Oracle-Dms-Rid
X-AB
X-Sucuri-ID
X-Ismobilevalue
X-Sucuri-Cache
OT-Force-Account-Verify
X-Nf-Request-Id
X-Servername
X-Air-Pt
X-Content-Powered-By
X-Akamai-Request-ID2
X-UA
X-WebKit-CSP-Report-Only
From-Origin
X-VC-Cache
X-Mode
X-VC
X-Air-Source
X-Air-Trace-Id
X-Air-Hostname
Backend
X-URL
Xet-Cookie
Refresh
Upgrade-Insecure-Requests
X-DataDome
X-Api-Version
X-Cache-Time
Accept-Language
X-Nginx-Cache
X-Handled-By
X-Tt-Logid
X-HTML-Minification-Powered-By
Webserver
Access-Control-Request-Headers
LB
X-Cache-Status-Check
Filters
X-SRV
X-SaId
X-Xfnlog-Site
X-UPSTREAM-Address
X-JoinUs
X-RCS-CacheZone
X-Rewrite-Enabled
Meta-Geo
X-Rn-Rsrv
Cache
X-S
X-Lambda-Id
X-AWS-Id
ServedBy
X-No-Session
X-R9-Blue-Green-Version
X-Endurance-Cache-Level
X-Proxied
X-Labrador-Cache-Channel
X-Cache-Rule
X-Hosted-By
X-PHP-Host
X-Adobe-Source
X-Git-Commit
X-VWS-Id
X-Generated-By
X-Webstats-RespID
X-Routing-Service
X-Container-Uri
X-Extlb
X-Cache-Operation
X-RateLimit-Limit
X-LJ-Flow-ID
X-Cms-Context
X-Cloudmap
X-Origin-Date
X-Zipkin-Id
X-Cluster
X-Reqid
X-Redis-Cache
X-Ms-Version
X-Ms-Request-Id
X-Edge-Location
X-ProxyCache-Status
X-Loop
Atl-Traceid
Apigw-Requestid
X-ProxyCache-Key
X-Logging-Id
X-Origin-Hint
X-Provided-By
Property-Id
X-Tumblr-Pixel-2
X-Cache-Debug
X-Fetched-On
X-Httpd
X-Tncms
X-Tcp-Rtt
X-Is-Tablet
Webcakes-App-Version
X-Forwarded-Host
X-Geo-Region
X-Is-Desktop
X-Accel-Version
X-Varnish-Age
X-Akamai-Edgescape
Webcakes-Region
X-BYPASS-REASON
X-Browser-Name
X-Web-Node
X-Tb
Webcakes-App-Name
TWC-Connection-Speed
TWC-Device-Class
X-Site-Version
Web-Mar-Node
Section-Io-Id
X-Served-From
X-Is-Supported-Browser
Mn-Server-Ip
X-Scope-Id
TWC-GeoIP-Country
X-Skip-Cache
TWC-Locale-Group
Url
TWC-GeoIP-LatLong
X-Is-Mobile
TWC-Privacy
X-Alternate-Cache-Key
X-Locale
X-IPLB-Instance
X-Optimistic-Header
X-Origin
X-Director
X-Detected-As
Selected-Fe
X-Cache-Host
X-IPLB-Request-ID
X-Varnish-Beresp-Grace
X-Soup
X-Storefront-Renderer-Rendered
X-Timing-Wait
X-Say-Cacheable
X-Say-TTL
X-Shopify-Stage
X-Proxy-Build
X-SayCDN-TTL
X-Upstream-Ct
X-Upstream-Ht
X-Request-URI
X-VCT
X-Restarts
X-Frame-Option
X-GeoCode
X-GeoCountry
X-RID
X-Format
X-INCAP-ABP
X-Varnish-Cache-Hits
Xserver
X-ShopId
X-ShardId
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-Mg-Request-UUID
Frame-Options
X-Azure-Ref-OriginShield
X-Lagoon
Expiry
Onion-Location
X-Connection-Hash
Cdn-Requestid
X-Drupal-Cache-Tags
WPO-Cache-Message
WPO-Cache-Status
X-CDN-Forward
X-CMSURLCustom
Protected
X-Vcache
X-Thinkindot-L3
Thinkindot-CacheControl
TDXMobile
Source
Thinkindot-Control
Thinkindot-CacheControl-Type
X-Shield-Cache-Expires
X-WP-CF-Super-Cache-Cookies-Bypass
X-Drupal-Cache-Contexts
X-Cache-Expired-At
X-Fastly-Request-Id
X-Origin-CC
X-Cdn-Origin
X-Origin-TTL
X-Generation-Time
X-B3-Traceid
Fastcgi-Useragent
X-Fastcgi-Cache
Environment
X-ECache
X-Pass-Why
Cache-Hits
X-Vcl-Version
X-PHP-Backend
X-Cache-Action
X-Proxy-Cache-Status
X-Worker
Priority
X-App-Version
X-TA-CDN-Provider
X-Rocket-Nginx-Serving-Static
Uber-Trace-Id
X-GEO
X-ID
X-Buckets
X-Vercel-Cache
X-Vercel-Id
Node
Sid
X-Cluster-Node
Azure-RegionName
Azure-SiteName
Azure-SlotName
X-Aspnetmvc-Version
Azure-Version
Azure-InstanceId
X-Urbn-Context-Path
X-Urbn-Site-Id
Locale
CDN-PullZone
CDN-CachedAt
CDN-Cache
X-XRDS-Location
CDN-RequestCountryCode
CDN-EdgeStorageId
CDN-RequestPullCode
CDN-Uid
Cross-Origin-Embedder-Policy
CDN-RequestPullSuccess
CF-IPCountry
X-RateLimit-Reset
Cache-Tv-Group
X-FB-TRIP-ID
AMP-Access-Control-Allow-Source-Origin
X-Tumblr-Pixel-3
X-Auth-Group-Type
X-Server-W
DB-Nickname
X-Pad
X-Tx-Id
X-Origin-Cache-Key
X-Cache-Server
User-Cache-Control
X-Client-Ip
X-DC
X-A
Alternate-Protocol
Origin-Agent-Cluster
X-DefElseHash
HostName
Origin
X-D
X-Developer
X-Level-Front-Cache
X-Dispatcher-Server
Odigeo-Trace-Id
Rendered-Blocks
X-DefHash
X-ND-Cache
X-Vtex-Remote-Cache
Sslversion
Surrogated-Key
T-Server
X-Origin-Expires
X-Org
Ngx.Var.Host
X-Custom-Header
X-Gen-Mode
X-Op-Id-All
X-Service
X-Ig-Push-State
X-Vdms-Version
X-Fastly-Backend
Candidate-Md5Url
X-GeoIP-City
Gannett-Cam-Experience-Id
X-Generated-On
DCR-Decision-By
DCR-Processing-Time-Ms
Content-Secure-Policy
Edge-Cache
X-Esi-Check
X-Epic-Correlation-Id
X-Ec-Fail
MD5-Digest
Meta-Geo-Continent
X-Ig-Origin-Region
X-Hnp-Log
A
X-Gzip
Lang
X-Ec-GeoHdr
Magicmarker
X-Content-Age
X-Core-Value
X-A-Dcw
X-Conf
X-A-Dgt
X-A-Wwc
X-Cache-Id
X-A-Dam
X-Via-Fastly
X-Rojux
X-SB
X-Viewer-Country
X-A-Ccd
X-SRCache-Key
X-Aed
X-Bl-Debug
X-Varnish-Remaining-TTL
X-BCube-Filmed-By
X-Bc-Bl
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
X-TIM-N
X-UA-Device-Type
X-V-Cache
X-Block-Status
Wxu-Next-Region
X-ScT
X-Req
Wxu-Next-Hostname
Wxu-Next-Commit
X-Cache-NE
X-Cache-TTL-Remaining
Mime-Version
X-Fastly-Cache
Sever-Int
Tube-Got-Results
Tube-Return
Is-Eu
V-Age
Host-ID
X-Clientip
X-Amz-Storage-Class
X-FC-Vary-Parameters
Fastly-SSL
Tube-Got-Eval
Tube-Get-Contents
X-Backend-Instance
X-Bip
Esi-Enabled
X-Edge-Server
X-Fmm-Version
X-Forwarded-Site
Ssr
X-Aicache-OS
Producers
X-Debug-Cache-Fetch
Req-ID
NM-Fastcgi-Cache
Origin-CC
Origin-EX
Powered-By
X-Debug-Cache-Store
PFcat
X-DPWN-IS-SECURE
Server-Ext
X-CacheTTL
Platform
X-AK-Request-ID
X-Cache-Bucket
X-Ad-Load-Variation
Server-Hostname
X-Cache-Info
Server-Host
X-Acquia-Purge-Cdn-Unconfigured
Vix-Hermes-Req-Id
Cdn-Host
X-VTEX-Cache-Time
X-Origin-Response-Time
X-NodeID
X-PAYTM-SRV-ID
X-Platform
X-Proto
X-Powered-By-VTEX-Cache
X-Policy
X-Node-Id
X-NMSegId
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Micro-Cache
X-WA-Info
X-Mly-Id
Country-Code
X-Mvc-Supplant-Cachable
X-Pubstack
X-RateLimit-Limit-Second
X-Tb-Optimization-Total-Bytes-Saved
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Thanos
X-Varnish-Director
X-VG-TLSProxy
X-VarnishDD-TTL
X-Varnish-Hostname
X-Sn-Servicetimems
X-Server-IP
X-VTEX-Cache-Server
X-Region-Sid
X-RateLimit-Remaining-Second
X-Request-Time
X-Scheme
X-SD-PageType
X-VG-WebCache
X-Men
X-Nginx-Cache-Key
Click-Count-Action-Start
X-B3-Trace-ID
X-Jobs
CDCHOST
X-GeoIP-Region-Code
Click-Count-Error
X-GeoIP
Cdnsip
X-HN
X-LSADC-Cache
Cdncip
Adler-Geo
X-HS-Content-Campaign-Id
Fusion-Template-Id
C-Via
Fusion-Content-Id
X-GeoIP-Country-Code
Cache-Provider
Fusion-Component-Id
XM
X-Loc
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Source
Cdn-Request-Time
Content-Script-Type
Content-Style-Type
X-HITS
X-Varnish-Beresp-Ttl
X-Slack-Backend
X-Section
X-Test
X-BBC-Edge-Cache-Status
X-Varnishpool
X-Gdpr
X-Geo-Header
X-Var-Ttl
X-Varnish-Beresp-Status
X-Slack-Shared-Secret-Outcome
X-Cdn-Srv
X-Csrf-Jwt
Yak-Timeinfo
X-Nyt-Route
X-CUA
X-Device-Os
X-We-Are-Hiring
X-Date
X-Mvc-Supplant-OutputCached
X-Cache-FS-Status
X-Origin-Time
X-GoCache-CacheStatus
X-Request-Host
X-Request-Start
X-Hash
X-Proxied-Request
X-Ec-Custom-Error
X-Human
X-Pool
X-Eu-Site
X-CGP
Mail-Subject
NGX
Machine
L5d-Success-Class
L
On-Server
Pramga
RNT-Machine
Req-Svc-Chain
Release
Proxy-Firewall
HA-Ipaddr
Ha-Gx-Prefs
Apple-News-Services-Handled
Apple-News-Services-Host
AKAMAI
X-Dc
X-LiteSpeed-Cache-Control
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
Fastly-GeoIP-CountryCode
DSUID
Canary
Cache-Key
RNT-Time
Fastly-Backend-Name
X-App-Name
W
X-Access
X-Accel-Expires-Debug
X-Auto-Login
True-Client-Country-4JS
Web-Mar-Region
We-Hiring
X-AIR-PT
X-NGINX-Cache
Gh-Request-Id
X-Cache-Aspx
X-Contensis-Viewer-Groups
X-Location
X-Varnish-Authentication
X-Depends
Cluster
X-Cs
X-Up
X-NCache
X-Varnish-Hits
Server-Info
X-Akamai-Transformed
X-From
BehaviorPad-Version
X-Zone
X-MP-GENERATED-AT
Debug
X-LB-ID
X-Jungle-Id
Redirect-Candidate
X-Tec-Api-Origin
WP-Super-Cache
X-Tec-Api-Version
X-Tec-Api-Root
X-Via-Popv
X-HA-Backend
Fastly-Drupal-HTML
X-Via-Poph
Pics-Label
X-Via-Popn
X-Vdms-Path
CloudFront-Viewer-Country
X-Cache-Backend
X-Refresh
CDN-RequestId
X-Servedbyhost
X-VHOST
X-APP
SID
X-Parent-Response-Time
X-CACHE-AGE
X-B3-Parentspanid
X-Datadome
GeoIP-Latitude
X-Content-Length
X-Uri
X-Nananana
X-Render-Time
X-Newrelic-Synthetics
X-ApacheServer
X-VC-TTL
X-M-Reqid
X-PERF
X-Nc
X-LB-NoCache
X-M-Log
Datacenter
Resin-Trace
Fastly-Drupal-Html
X-CACHE-KEY
X-Litespeed-Tag
X-DynaTrace-JS-Agent
X-Wa
Server-ID
X-CDN-Cache-Status
X-Cached-By
X-CS
Vc-Max-Age
X-ZONE
Locid
X-LiteSpeed-Tag
NtCoent-Length
Cdn
X-Dispatcher-Number
X-RequestId
X-B3-Spanid
Product
GeoIp-Country-Code
X-Response-Served-From
X-Original-Request-Id
X-Amz-Meta-Cb-Modifiedtime
X-VCache
X-Fpc
FSS-Cache
X-IAuth-Set-Uid
X-Varnish-Beresp-TTL
X-TT-LOGID
X-NewRelic-App-Data
Serverhost
X-Ckpd-Fst-Backend
True-Client-Ip
X-Old-Content-Length
X-Esi
X-TX-ID
X-SERVER-NAME
Cf-Ipcountry
X-HostName
ServerName
Uri
Ngx-Var-Key
X-Nf-Language
X-Srv
X-Bug-Bounty
X-Nf-Country
X-Nf-Ats-Version
True-Client-IP
X-HubSpot-Correlation-Id
GeoIP-Country-Code
CDN
X-Vgn-Hpd-Reason
Tcn
S-Rt
Srv
X-Cdn-Cache-Status
X-Oracle-DMS-ECID
X-TIME
X-Cdn-Forward
X-Moov-Xdn-Version
X-Platform-Router
X-TH-Server
X-Dynatrace-Js-Agent
X-FPC
X-Platform-Processor
X-Platform-Cluster
X-Moov-T
Request-ID
X-Dispatch
X-WA
CacheControlHeader
X-Vc
Cf-Device-Type
Server-Id
X-Akamai-Device-Characteristics
X-Vmg-Version
X-APP-VERSION
Hostname
X-COUNTRY
Srvid
X-Destination
Geoip-Latitude
ServerHost
X-External-Request-Id
X-User
X-S-Cookie
X-FL-QIT-DEBUG
User-Agent
X-Gamma-Serve
X-Info
X-B-Cookie
X-NC
Cross-Origin-Embedder-Policy-Report-Only
X-Application
X-Webkit-Csp-Report-Only
X-VCL-Version
X-Presslabs-Stats
X-Geo
Xc-Version
X-Lb-Nocache
X-Zen-Fury
Cneonction
Expect-Staple
X-Cache-Date
X-ServedByHost
Ohc-File-Size
X-Ha-Backend
X-Via-PopH
X-Via-PopN
X-Via-PopV
X-Hit
X-Instance-Name
X-Rocket-Build-Number
Origin-Trial
X-Sigma
X-Sigma-Backend
X-Amz-Meta-Opti
X-App
X-API-Version
X-VServer
X-Segment-20210421
Epwk-X-Cache
Cloudfront-Viewer-Country
PICS-Label
X-V
X-Correlation-ID
X-Limited
X-Branch-Name
X-Ua
X-Akamai-Pragma-Client-IP
Rtss
X-Srcache-Fetch-Status
X-Srcache-Store-Status
X-Check-Cacheable
N-Cache
X-Sqd-Ctime
X-Lb-Id
X-Sqd-Stime
X-Erf-Stays-Pdp-Viaduct-Migration-Web-V2
X-Serial
X-New
X-Platform-Server
X-Eligible
WZWS-RAY
X-Rollout
Permission-Policy
X-MiniProfiler-Ids
X-Wp-Cf-Super-Cache-Cache-Control
Lb
X-Wp-Cf-Super-Cache
X-VTEX-Cache-Backend-Connect-Time
X-VTEX-Cache-Backend-Header-Time
XkeyRZ
X-Proxy-CacheRZ
X-Acquia-Purge-Tags
Timeexpire
Cmstype
Cmsid
X-Acquia-Site
Sm-Log-Id
Ohc-Cache-HIT
X-MSEdge-Flight
X-Service-Response-Time
X-Acquia-Application-Trace
X-DataCenter
X-MSEdge-Features
X-Datacenter
X-Web-Server
X-Acquia-Application-UUID
X-CSRF-TOKEN
X-LAGOON
CountryCode
Servername
DataCenter
Load-Balancing
X-Litespeed-Cache-Control
Fl-Custom-Application
Wpo-Cache-Status
X-ElasticPress-Query
X-Snapshot-Date
Wpo-Cache-Message
Type
X-Th-Server
X-Ramcache
Ngx
X-Fastly-Backend-Reqs
X-Shardid
X-Udemy-Cache-App-Namespace
X-Amz-Meta-Sha256
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
X-RAMCache
X-Dw-Trace-Id
X-Amz-Meta-S3b-Last-Modified
X-DynaTrace
X-Sorting-Hat-Shopid
Warning
X-Sorting-Hat-Podid
X-Shopid
X-Origin-Upstream-Status
X-Requestid