Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Cf-Request-Id
CF-RAY
CF-Cache-Status
Last-Modified
X-XSS-Protection
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-Runtime
X-AspNet-Version
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Cache-Status
X-Generator
X-Request-ID
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Content-Security-Policy
Content-Encoding
X-CDN
X-Envoy-Upstream-Service-Time
Status
Feature-Policy
X-Ua-Compatible
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
X-AspNetMvc-Version
Access-Control-Max-Age
X-Via
Upgrade
Keep-Alive
X-Ws-Request-Id
X-Age
X-Turbo-Charged-By
X-AH-Environment
X-Robots-Tag
Request-Context
X-Proxy-Cache
EagleId
X-Cache-Group
Server-Timing
X-Backend
X-Hacker
X-Amz-Request-Id
Report-To
X-Server
Host-Header
X-Amz-Id-2
X-Server-Powered-By
Grace
X-Nginx-Cache-Status
X-UA-Device
X-LiteSpeed-Cache
X-Dns-Prefetch-Control
X-Varnish-Cache
X-Rq
Ali-Swift-Global-Savetime
X-Swift-CacheTime
X-Swift-SaveTime
X-Page-Speed
Cf-Railgun
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Amz-Version-Id
NEL
X-OneAgent-JS-Injection
Xkey
X-WebKit-CSP
X-Cache-Spec
Allow
X-Backend-Server
X-CST
X-Vhost
X-Device
X-Host
EagleEye-TraceId
X-Server-Id
X-ASPNET-VERSION
Surrogate-Control
Request-Id
X-Dispatcher
Accept-CH
X-Node
Content-Location
X-Response-Time
Accept-CH-Lifetime
X-Akam-SW-Version
X-Ruxit-JS-Agent
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Ac
X-Template
X-Application-Context
X-Language
X-Kinja-Server-Push
X-Country
X-Cache-Lookup
X-Readtime
X-Mod-Pagespeed
X-Cloud-Trace-Context
MS-Author-Via
X-B3-TraceId
X-Origin-Cache
Rating
X-Cnection
X-MS-InvokeApp
X-Url
X-HW
X-TtlSet
X-Vname
X-PC
X-ORACLE-DMS-ECID
Accept-Ch
X-Clacks-Overhead
X-ESI
X-GitHub-Request-Id
Edge-Control
X-FastCGI-Cache
Accept-Ch-Lifetime
X-Trace
X-Sol
Pagespeed
Response
X-Middleton-Display
X-Middleton-Response
Display
X-Content-Type
X-D2id
X-Exp-Variant
X-GoogleNews-Bot
X-Kinja
X-Exp-Id
X-Cdn-Fetch
Verso
Arr-Disable-Session-Affinity
X-Vcap-Request-Id
X-Kinja-Build
X-Use-Magma
X-Kinja-Revision
X-Kinja-Server
X-Buckets
X-Goog-Hash
X-Rack-Cache
X-Server-Name
X-Country-Code
Service-Worker-Allowed
X-Navigation-Version
X-Abt-Application-Version
X-VARITI-CCR
X-Amz-Rid
X-Oneagent-Js-Injection
X-Powered-By-Plesk
X-ORACLE-DMS-RID
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
X-Cache-TTL
X-Varnish-TTL
X-Client-IP
SPRequestGuid
X-SharePointHealthScore
X-Fastly-Request-ID
X-Release
SPRequestDuration
X-MSEdge-Ref
SPIisLatency
X-Dw-Request-Base-Id
X-Element-Page-Cache
Fastly-Restarts
X-TTL
X-NF-Request-ID
X-Cached
Public-Key-Pins
X-B3-TraceId-Primal
MRF-Tech
Mrf-Cache-Status
RTSS
X-Origin-Upstream-Status
X-Edge
AR-ATIME
AR-PoweredBy
Ar-Sid
AR-Request-ID
AR-CACHE
X-SRCache-Store-Status
Access-Control-Request-Method
X-SRCache-Fetch-Status
X-Webkit-CSP
X-Px
X-LLID
X-Powered-CMS
Fusion-Component-Id
Fusion-Content-Id
Fusion-Source
Fusion-Template-Id
Fusion-Content-Source
Fusion-Deployment-Id
X-Ezoic-Cdn
X-Ttl
Content-MD5
X-Upstream
X-Jurisdiction
X-HP-Webp
X-Mid
X-ECACHE
X-MCACHE
X-Amz-Server-Side-Encryption
Charset
Cache-Tag
X-Recruiting
X-Mg-S
S
X-Content-Digest
X-Pinterest-Direct
X-PressLabs-Stats
X-Version
X-Aspnetmvc-Version
TCN
MicrosoftSharePointTeamServices
Fastcgi-Cache
X-Debug
Front-End-Https
X-T
X-Content-Security-Policy-Report-Only
X-Id
X-Grace
Filters
X-Kinsta-Cache
Cache-Tags
Edge-Cache-Tag
Server-Node
X-Forwarded-Proto
X-Accel-Expires
X-Logged-In
X-Amzn-Trace-Id
X-Forwarded-For
X-Yandex-Sdch-Disable
Server-Name
Nginx-Cache
X-XRDS-Location
Surrogate-Key
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Varnish-Age
X-Cache-Key
X-Correlation-Id
TP-Cache
TP-L2-Cache
X-B3-Sampled
X-Request-Processing-Time
X-Request-Received
X-Microsite
X-Request-Handler-Origin-Region
X-DynaTrace
X-Hits
X-Ser
Powered-By-ChinaCache
X-DIS-Request-ID
X-Shield-Request-Id
X-Activity-Id
X-AppVersion
X-Az
X-Amz-Replication-Status
X-Server-ID
X-HS-Combine-CSS
X-HS-Content-Id
X-HS-Cache-Config
X-HS-Hub-Id
X-F-Cache
X-Goog-Storage-Class
X-Goog-Metageneration
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-Origin-Server
Accept-Charset
X-FTR-Request-ID
X-Git-Hash
X-Hostname
X-Respond-Thread
X-Geo-Country
X-LB-Cache
X-DataDome
X-Upgrade-Enabled
Section-Io-Cache
Nel
X-Rid
X-XRDS-LOCATION
X-Frontend
Access-Control-Allow-Method
X-Cache-Age
Alternate-Protocol
Cache
Host
X-Mobile-URL
Cleartype
MS-CV
Paypal-Debug-Id
X-Content-Options
X-Type
Healthy
X-IPLB-Instance
ServerID
X-Ruxit-Js-Agent
X-AOL-HN
X-WebKit-CSP-Report-Only
X-App-Environment
X-Whom
Payment
X-Varnish-Backend
X-Seen-By
X-B-Cache
X-Flags
X-Debug-Info
X-Cache-Action
X-Aspnet-Duration-Ms
X-Route-Name
X-Signature
X-Is-Crawler
X-Request-Guid
X-TT
X-Providence-Cookie
X-VCache
Fastcgi-Useragent
X-Page-Id
X-Jobs
X-NWS-LOG-UUID
X-N
X-Source
X-Time
X-Mobile
X-Load-Cache
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-TEC-API-VERSION
X-Via-JSL
X-Cached-By
X-Daa-Tunnel
X-FB-Debug
X-Akamai-Edgescape
Version
X-RateLimit-Remaining
X-Cache-Rule
X-Cache-Operation
X-Litespeed-Cache
Viewport
Refresh
DynaTrace
X-Accel-Buffering
X-Original-Request-Id
X-Rule
X-Response-Served-From
X-Zen-Fury
DC
X-Framework
X-Drupal-Cache-Tags
X-Proxy
X-Cacheable-TTL
X-RTag
X-ProcessESI
Realpath
X-RemovedCookies
Ms-Operation-Id
X-Instance
GEO-INFO
X-Real-IP
X-Contextid
X-Tt-Trace-Host
X-Tt-Trace-Tag
Access-Control-Request-Headers
X-Fastcgi-Cache
X-Cache-Time
X-UUID
X-HTML-Minification-Powered-By
X-Region
X-Wix-Request-Id
X-Page-View
X-Drupal-Cache-Contexts
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Distributor
Referer-Policy
X-FW-Hash
X-FW-Serve
X-FW-Type
Node
Eomportal-Instance
X-FW-Static
X-FW-Server
X-Cache-Expired-At
X-Varnish-Ttl
VIX-Pulpo-Upstream-Status
Countrycode
X-FW-Dynamic
VIX-Pulpo-Node
X-Environment-Context
X-B
X-L-Path
X-Cluster-Name
Liferay-Portal
X-Node-Name
X-G
X-Cache-Control
X-Tumblr-Pixel-1
X-Tumblr-User
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Content-Powered-By
X-IPS-LoggedIn
X-Cache-Hit
X-User-Agent
X-Ratelimit-Limit
Server-Info
X-Tumblr-Pixel-2
Webserver
X-Pass-Why
X-Amz-Meta-S3cmd-Attrs
Section-Io-Origin-Time-Seconds
Section-Io-Id
From-Origin
X-App-Server
Section-Origin-Responded
Section-Io-Origin-Status
Protected
Ec-Rule-Version
X-Protected-By
X-FireWall-Port
X-Revision
SRV
X-Backend-Name
X-Cache-Server
X-Oracle-Dms-Rid
Frame-Options
Cache-Status
CF-IPCountry
X-Hl-Ver
X-Handled-By
X-Mode
X-Hyper-Cache
X-Www-Served-By
X-Endurance-Cache-Level
X-RN-RSRV
Meta-Geo
X-UPSTREAM-Address
X-ES-SERVER
X-Soup
X-Ratelimit-Remaining
X-Storage
X-Site-Version
Retry-After
X-Forwarded-Host
X-FB-TRIP-ID
X-Locale
X-NYM-Debug-Backend
Decoy-Debug-Status
X-Pubstack
Cache-Tv-Group
Decoy-Debug-Key
Country
Fastly-SSL
X-Varnishpool
X-Adobe-Content
X-Human
X-Web-Node
X-Be
X-Cache-Grace
X-Adobe-Loc
Decoy-Debug-TTL
Webcakes-App-Name
Azure-Version
Cache-Name
TWC-Privacy
X-OCL
X-Section
Azure-RegionName
Webcakes-Region
X-Access
X-SayCDN-TTL
X-Format
Azure-InstanceId
Azure-SlotName
Azure-SiteName
X-Origin-Date
X-Labrador-Cache-Channel
TWC-Locale-Group
X-TT-LOGID
X-Proto
X-Timing-Wait
X-BYPASS-REASON
X-UA-Device-Type
X-Proxy-Build
X-Uri
X-ProxyCache-Key
X-Redis-Cache
Property-Id
Selected-Fe
TWC-GeoIP-Country
X-PCL
TWC-GeoIP-LatLong
X-ProxyCache-Status
X-PHP-Host
TWC-Device-Class
TWC-Connection-Speed
X-Say-Cacheable
X-Say-TTL
X-Origin-Hint
Webcakes-App-Version
X-Tec-Api-Version
X-Tec-Api-Root
X-Tec-Api-Origin
X-ApacheServer
X-AIR-PT
X-FW-Version
X-PERF
X-No-Session
X-S-Maxage
X-Server-W
X-Via-Fastly
X-WA-Info
X-LAGOON
X-Sql-Duration-Ms
X-Sql-Count
X-Via-CDN
X-AWS-Id
X-TNCMS
Xserver
X-Hosted-By
X-R9-Blue-Green-Version
X-Loop
X-Request-Time
X-LJ-Flow-ID
X-VWS-Id
X-FTR-Balancer
X-FTR-Cache-Status
Mn-Server-Ip
X-FTR-DC
X-FTR-Backend
X-Country-Code-Real
X-Cluster
X-Qloud-Router
X-Status
S-Cnection
X-FTR-Realm
X-FTR-Backend-Server
X-MP-GENERATED-AT
X-Routing-Service
X-Sorting-Hat-ShopId
X-Zipkin-Id
X-Alternate-Cache-Key
X-Storefront-Renderer-Rendered
X-Proxied
X-Cache-TTL-Remaining
X-Shopify-Stage
X-ShopId
X-ShardId
X-CCM
X-Sorting-Hat-PodId
Cache-Hits
X-Xfnlog-Site
X-FTR-Expires
X-Rendered-As
X-Is-Bot
X-Dynatrace
X-Dc
X-Unique-Id
X-Device-Type
X-Cache-Var-Map
X-Cache-Var
X-SRV
X-Air-Hostname
AMP-Access-Control-Allow-Source-Origin
X-Info
X-Detected-As
Apigw-Requestid
X-EdgeConnect-Cache-Status
X-Nginx-Cache
X-Webkit-Csp
X-Cache-Host
X-Amzn-Remapped-Content-Length
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Cdn
X-Debug-IsPreview
X-Microcachable
X-Debug-IsConnected
X-Cache-Enabled
X-APP-VERSION
X-Varnish-Grace
X-GEO
X-Content-Age
SD-X-WS
X-Varnish-Server
X-Platform
X-Correlation-ID
Amp-Access-Control-Allow-Source-Origin
X-Time-Microsecs
Tracecode
X-Backend-TTL
X-Azure-Ref
X-Backend-Host
X-DynaTrace-JS-Agent
X-ServerID
X-Cache-Backend
X-GG-Cache-Date
Uber-Trace-Id
X-Erf-Stays-Bingo-Pdp-Web
X-Proxy-Cache-Status
DSUID
X-Oss-Server-Time
Akamai-GRN
X-Oss-Storage-Class
X-Tb
X-NewRelic-App-Data
X-Oss-Hash-Crc64ecma
X-BCube-Filmed-By
X-Oss-Object-Type
X-Oss-Request-Id
X-CSRF-Token
X-ATG-Version
X-Trace-Id
X-Sucuri-ID
PB-RID
Arc-Version
PB-PID
Backend
X-Akamai-Transformed
X-Magnolia-Registration
ServedBy
X-Cache-PHP
X-Device-Os
X-CF-Lambda-Version
X-Cache-NGX
X-ScT
X-Destination
X-Connection-Hash
X-Vdms-Version
X-CF-Lambda-Fn
X-D
X-Varnish-Cache-Hits
X-PAYTM-SRV-ID
X-B-Cookie
Fastcgi-X-Cache-Version
SR-User-Adfree
Instruction
Expiry
X-Vtex-Processado-Em
DCR-Decision-By
DCR-Processing-Time-Ms
X-Vtex-Remote-Cache
Rendered-Blocks
Release
Meta-Geo-Continent
Mobile-Detection-Method
Path
MD5-Digest
Pramga
Lfy
Machine
T-Server
Thinkindot-CacheControl
X-VG-WebCache
X-Aed
X-VG-WebServer
X-Application
X-ARC
X-Varnish-Hostname
X-RCS-CacheZone
Xc-Version
BehaviorPad-Version
X-A-Wwc
X-A
Thinkindot-Control
Thinkindot-CacheControl-Type
X-A-Ccd
X-A-Dam
X-A-Dgt
X-A-Dcw
X-Cache-NE
X-Session-Fingerprint
X-GeoIP-City
X-From
Odigeo-Trace-Id
X-Processor
X-Rewrite-Enabled
X-Request-UUID
X-Vdms-Path
X-Level-Front-Cache
X-Generation-Time
X-Location
X-Origin-Response-Time
X-Generated-On
X-Matched-Rule
X-Rojux
X-Fetched-On
X-Trv-Group
X-Thinkindot-L3
X-Origin-TTL
X-S-Cookie
X-S
X-Origin-CC
X-PBS-Appsvrname
X-External-Request-Id
X-SRCache-Key
X-Ms-Version
X-Ms-Request-Id
C-Via
X-Irp-Debug
CacheControlHeader
Cache-Host
UCS
X-SVT-ORM-VERSION
X-Thanos
X-Swa-Ws
X-Is-Gdpr
Cf-Device-Type
X-JWT-State
X-Sn-Servicetimems
X-SVT-ORM-RULES
X-VServer
X-NWS-UUID-VERIFY
L5d-Success-Class
X-OVcl
X-OVcl-Cache
Pagetype
X-Owner
Host-ID
HA-Ipaddr
Fastly-Backend-Name
X-Adobe-Source
X-Mvc-Supplant-Cachable
Ssr
X-Node-Id
Ha-Gx-Prefs
Gh-Request-Id
X-Micro-Cache
X-HS-Content-Campaign-Id
X-Debug-Cache
X-Geo-Header
X-Cdn-Origin
X-GeoIP
X-Generated-In
X-CGP
X-FC-Vary-Parameters
X-Csrf-Jwt
X-Reqid
X-Skip-Cache
X-Cache-Date
X-Cache-Info
X-Backend-State
X-Bip
X-Azure-Ref-OriginShield
X-Tumblr-Pixel-3
X-Eu-Site
AKAMAI
X-User
X-Has-Esi
X-Cache-Bucket
DB-Nickname
X-Policy
X-CUA
X-Fastly-Cache
Server-Ext
PFcat
X-Fastly-Backend
X-Scheme
X-Envoy-Decorator-Operation
X-Core-Value
X-Developer
On-Server
X-Developers
X-Origin-Expires
X-VarnishDD-TTL
X-Clientip
V-Age
X-Var-Ttl
X-Cache-Tags
Wxu-Next-Commit
Wxu-Next-Hostname
X-HN
Wxu-Next-Region
X-Generated-By
X-IP
Server-Hostname
Server-Host
X-Cms-Context
Sever-Int
X-Request-Host
X-Nginx-Cache-Key
X-Varnish-Hits
X-Request-URI
CloudFront-Viewer-Country
Locid
X-Wikidot-Static-Cache
L
X-B3-Traceid
X-Wikidot-Backend
User-Cache-Control
Magicmarker
X-Cache-Remote
NGX
Content-Disposition
X-TrackingId
X-Li-Pop
X-TA-CDN-Provider
X-Block-Status
X-Li-Fabric
Apple-News-Services-Handled
X-Loc
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
Apple-News-Services-Host
X-LI-UUID
Adler-Geo
X-Branch-Name
X-VG-TLSProxy
Location
X-Esi-Check
HostName
X-DPWN-IS-SECURE
X-Dispatcher-Server
X-Clara-WADP
X-DefHash
X-Fmm-Version
NM-Fastcgi-Cache
X-Method
X-Gzip
X-GoCache-CacheStatus
X-Cache-Expires
X-Gen-Mode
X-Cache-Id
X-Hnp-Log
X-NU-AKA-ACS-Version
Fastly-SWR
X-Variation
X-TX-ID
Fastly-SIE
CDCHOST
X-SIPLIST1
X-Varnish-Beresp-Grace
Is-Eu
X-Varnish-Remaining-TTL
Origin
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
IsBot
Platform
X-WADP-Cache
X-Servername
True-Client-Country-4JS
X-Rebelmouse-Cache-Control
X-Ratelimit-Reset
X-DefElseHash
X-Origin
X-Platform-Server
X-Old-Content-Length
Web-Mar-Node
X-Request-Start
Vix-Hermes-Req-Id
X-Rebelmouse-Surrogate-Control
Cf-Bgj
X-ID
X-NC
X-NAPM-TraceId
X-Varnish-Beresp-Status
X-HOST
X-Varnish-Beresp-Ttl
X-B3-Spanid
X-Gamma-Serve
CDN-Cache
CDN-EdgeStorageId
X-Cache-Debug
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Hash
CDN-PullZone
CDN-RequestCountryCode
Rt-Fastcgi-Cache
Fastly-Drupal-HTML
CDN-Uid
CDN-RequestId
X-Slack-Backend
CDN-CachedAt
X-Cdn-Forward
X-Core-Mission
X-EC-Lua
Url
X-PF-Uncompressing
CACHE
X-Varnish-Url
X-NCache
X-Host-Name
X-Aicache-OS
X-Varnish-Cacheable
S-Rt
X-Response-By
X-Mvc-Supplant-OutputCached
X-B3-SpanId
Sid
X-App-Version
Xkeyi7
X-Proxy-Cachei7
X-LB-ID
X-Refresh
X-CS
X-CACHE-GROUP
X-BBXSRF
N-Cache
Cross-Origin-Window-Policy
Pics-Label
Esi-Enabled
Content-Secure-Policy
X-Via-Poph
X-Via-Popv
Ohc-File-Size
X-FireWall-Protection
X-Sucuri-Cache
X-Cache-2
X-Via-Popn
D-Cc-Upstream
X-Epic-Correlation-Id
X-Cs
X-Varnish-Authentication
X-Contensis-Viewer-Groups
Cteonnt-Length
X-Cache-ASPX
X-CDN-Forward
X-Cc-Req-Id
X-Cc-Via
X-Svr
X-Tb-Optimization-Total-Bytes-Saved
X-TraceId
X-Nc
X-Error
Source
Who
X-Srv
X-Server-IP
X-Servedbyhost
Country-Code
X-Unique-ID
GeoIp-Country-Code
X-Wa
Geoip-Latitude
MIME-Version
Req-Svc-Chain
X-Webkit-CSP-Report-Only
X-FPC
X-HS-Status
X-Cache-Config
HitType
X-Gdpr
X-API-Version
X-Nyt-Route
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-DC
X-Origin-Time
X-RateLimit-Limit
X-VC
X-LiteSpeed-Cache-Control
X-SN
Server-Ttl
X-TIME
Hostname
X-NGINX-Cache
X-Fastly-Request-Id
X-URL
Ohc-Cache-HIT
Cmsid
X-LI-Proto
Cmstype
X-Webstats-RespID
X-NodeID
Svr
X-SB
Kp-EeAlive
XServer
Geo-Info
X-CACHE-KEY
X-VCL-Version
Server-ID
X-Esi
X-SD-PageType
Viewtype
X-Served-From
X-Check-Cacheable
VivaBuild
X-Ua
X-Viewer-Country
Cache-Key
X-Vgn-Hpd-Reason
X-Render-Time
A
X-Vcl-Version
NtCoent-Length
Server-Id
M-TraceId
X-Li-Proto
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-BBC-Edge-Cache-Status
Request-ID
EpKe-Alive
SID
X-UA
X-Air-Source
X-DB
X-CF-Powered-By
Cache-Provider
Resin-Trace
X-DI
X-DSS
Arc-Country
X-TIM-N
Cross-Origin-Opener-Policy
TDXMobile
Srv
X-RSL
X-DW
X-RPM
X-RPS
X-Worker
X-RAMCache
X-Auto-Login
Filterid
X-Ftr-Cache-Host
Upgrade-Insecure-Requests
X-App
ProcessTime
GeoIP-Country-Code
X-Internal-Host
GeoIP-Latitude
X-Dynatrace-Js-Agent
X-CSRF-TOKEN
X-Action
X-Vc
X-WA
CDN
X-ServedByHost
Mime-Version
Processtime
X-Cluster-Node
X-Newrelic-Synthetics
X-FTR-Cache-Host
X-Fpc
X-Oss-Cdn-Auth
Proxy-Connection
NGB
X-Service
Tcn
X-CLOUD-TRACE-CONTEXT
CF-Cached-On
X-BBC-Origin-Response-Status
X-Geo
Datacenter
X-FORWARDED-FOR
DataCenter
X-HITS
X-HostName
OT-Force-Account-Verify
X-Akamai-Pragma-Client-IP
X-MSEdge-Flight
X-MSEdge-Features
X-ND-Cache
X-Via-PopH
X-Via-PopN
X-Via-PopV
Cdn
FSS-Cache
WZWS-RAY
X-Via-NSCOPI
X-Forwarded-Site
X-NGENIX-Cache
PICS-Label
X-Fastly-Backend-Reqs
X-BACKEND-TTL
X-Dw-Trace-Id
X-JoinUs
X-PHP-Backend
X-SaId
X-Extlb
X-Client-Ip
X-Edge-Location
X-Cdn-Request-ID
X-CACHE-AGE
X-IN-APIGATEWAY
X-ABtesting
X-Parent-Response-Time
X-Lb-Id
X-Hello
X-Flog
X-IN-APIGATEWAYSSL
W
X-Cache-Tag
Dnion-Transfer-Encoding
X-Provided-By
X-PJAX-URL
X-Oracle-DMS-ECID
X-Swift-Error
Memcached
Vha6-Origin
X-Pad
X-Depends-On
LB
Mail-Subject
Epwk-X-Cache
X-Pf-Uncompressing
Media-Length
X-Date
Surrogated-Key
We-Hiring
X-Proxy-Upstream
X-VC-Cache
X-RateLimit-Limit-Second
X-Req
X-Region-Sid
X-Presslabs-Stats
X-Bc-Bl
X-UnsetCookies
X-Accel-Expires-Debug
X-RateLimit-Remaining-Second
Time
Xet-Cookie
X-ZONE
URI
X-Sigma
X-Sigma-Backend
X-LiteSpeed-Tag
Memory
X-Rocket-Build-Number
X-MiniProfiler-Ids
Env
Cf-Ipcountry
X-Zone
X-ElasticPress-Query
X-Request-Url
X-APP
X-Acquia-Application-Trace
X-Acquia-Application-UUID
X-B3-Parentspanid
X-Varnish-URL
X-Akamai-Request-ID
X-Men
X-Amz-Meta-Cb-Modifiedtime
X-Air-Trace-Id
X-Ms-Meta-Staticbatchstarttime
X-Acquia-Purge-Tags
X-Akamai-ERPolicy
X-Csrf-Token
X-ElasticPress-Search
X-Ms-Meta-Originalurl
X-Akamai-ERRuleID
X-Vcache
X-Request-URL
X-Acquia-Site
X-Varnish-Beresp-TTL
CountryCode
Inserted-Into-Cache-At
X-Tid
Environment
Content-Style-Type
Content-Script-Type
X-Litespeed-Cache-Control
X-C
Edge-Copy-Time
X-Via-SSL
X-Acc-Rdl
X-Acc-Debug-Context
X-Via-Edge
X-ServerName
X-Storefront-Renderer-Verified
Phost
Ohc-Response-Time
X-Debug-Cache-Fetch
NnCoection
X-Traceid
X-Redis-Count
X-Redis-Duration-Ms
X-Snapshot-Date
X-Debug-Cache-Store