Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
X-XSS-Protection
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
P3P
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Request-Id
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-Runtime
X-AspNet-Version
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Cache-Status
X-Generator
X-Cacheable
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Content-Security-Policy
X-Ua-Compatible
X-Request-ID
X-Iinfo
Content-Encoding
X-CDN
Feature-Policy
Status
X-AspNetMvc-Version
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
Access-Control-Max-Age
X-Via
Keep-Alive
X-Ws-Request-Id
X-Age
X-Robots-Tag
X-AH-Environment
Request-Context
EagleId
X-Cache-Group
X-Turbo-Charged-By
X-Proxy-Cache
Server-Timing
X-Server
X-Backend
X-Hacker
X-Dns-Prefetch-Control
X-Server-Powered-By
Host-Header
Report-To
X-Amz-Request-Id
X-Nginx-Cache-Status
X-Amz-Id-2
Grace
X-UA-Device
X-Rq
X-Varnish-Cache
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
X-Page-Speed
X-OneAgent-JS-Injection
Cf-Railgun
X-Pingback
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
X-CST
X-Amz-Version-Id
X-Cache-Spec
Allow
NEL
X-Vhost
X-Host
X-Backend-Server
X-WebKit-CSP
X-ASPNET-VERSION
X-Dispatcher
EagleEye-TraceId
Surrogate-Control
X-Node
X-Server-Id
Xkey
Request-Id
X-Response-Time
Content-Location
X-Akam-SW-Version
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
Accept-CH
X-Ruxit-JS-Agent
P3p
X-Cache-Lookup
X-Application-Context
X-Country
X-Ac
Accept-CH-Lifetime
X-Mod-Pagespeed
X-Cloud-Trace-Context
X-Readtime
X-Template
X-Language
X-B3-TraceId
MS-Author-Via
X-HW
Rating
Accept-Ch-Lifetime
X-Url
X-Cnection
X-MS-InvokeApp
X-TtlSet
X-PC
X-Vname
X-Origin-Cache
Edge-Control
Accept-Ch
X-ESI
X-Clacks-Overhead
X-GitHub-Request-Id
X-Varnish-TTL
X-Trace
X-Content-Type
Response
Verso
Pagespeed
X-Middleton-Response
X-Middleton-Display
X-Sol
Display
Arr-Disable-Session-Affinity
X-Cdn-Fetch
X-Use-Magma
X-Kinja-Server
X-GoogleNews-Bot
X-Kinja
X-Kinja-Build
X-Exp-Variant
X-Kinja-Revision
X-Exp-Id
X-D2id
X-FastCGI-Cache
X-Powered-By-Plesk
X-Goog-Hash
X-Vcap-Request-Id
X-Country-Code
X-Rack-Cache
X-Webkit-CSP
X-TTL
X-ORACLE-DMS-RID
X-VARITI-CCR
X-Navigation-Version
X-Amz-Rid
X-ORACLE-DMS-ECID
X-Server-Name
X-Abt-Application-Version
Fastly-Restarts
Service-Worker-Allowed
X-Cached
X-Fastly-Request-ID
X-Client-IP
X-MSEdge-Ref
X-Buckets
Cache-Tag
X-Release
X-Element-Page-Cache
X-Dw-Request-Base-Id
X-NF-Request-ID
X-B3-TraceId-Primal
MRF-Tech
Mrf-Cache-Status
Access-Control-Request-Method
RTSS
X-Cache-TTL
Public-Key-Pins
SPRequestGuid
X-SharePointHealthScore
SPRequestDuration
SPIisLatency
X-Ezoic-Cdn
X-Edge
X-LLID
AR-ATIME
X-Powered-CMS
AR-CACHE
Ar-Sid
AR-PoweredBy
AR-Request-ID
X-Upstream
X-Version
X-SRCache-Fetch-Status
X-SRCache-Store-Status
Pinterest-Generated-By
X-Pinterest-Rid
Pinterest-Version
S
Content-MD5
X-HP-Webp
X-Jurisdiction
X-Kinsta-Cache
X-Recruiting
Charset
X-MCACHE
X-Mid
X-ECACHE
X-Mg-S
X-PressLabs-Stats
X-T
Cache-Tags
X-Accel-Expires
X-Origin-Upstream-Status
X-DynaTrace
X-Content-Digest
X-Forwarded-Proto
X-Server-ID
Fusion-Content-Id
X-Litespeed-Cache
Fastcgi-Cache
Fusion-Component-Id
Fusion-Content-Source
Fusion-Source
Fusion-Deployment-Id
Fusion-Template-Id
X-Content-Security-Policy-Report-Only
X-Px
X-Ttl
TP-L2-Cache
TP-Cache
X-Correlation-Id
X-Logged-In
Filters
Server-Node
Edge-Cache-Tag
TCN
Server-Name
X-Id
X-Amz-Server-Side-Encryption
X-Oneagent-Js-Injection
Front-End-Https
Nel
X-Forwarded-For
X-Request-Processing-Time
X-Request-Received
MicrosoftSharePointTeamServices
X-Grace
Nginx-Cache
X-XRDS-Location
X-Shield-Request-Id
X-Hits
Alternate-Protocol
X-Amzn-Trace-Id
X-B3-Sampled
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Request-Handler-Origin-Region
X-Microsite
X-NWS-LOG-UUID
X-AppVersion
X-Activity-Id
X-Az
X-Ruxit-Js-Agent
X-F-Cache
X-HS-Cache-Config
X-HS-Content-Id
X-HS-Hub-Id
X-HS-Combine-CSS
X-Amz-Replication-Status
X-Origin-Server
X-Varnish-Age
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Metageneration
X-Goog-Generation
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-RateLimit-Remaining
X-Frontend
X-Debug
X-Rid
Realpath
X-Daa-Tunnel
Section-Io-Cache
X-Cache-Age
Host
X-Yandex-Sdch-Disable
Accept-Charset
X-Geo-Country
X-Fastcgi-Cache
Surrogate-Key
X-DIS-Request-ID
X-Hostname
X-Git-Hash
X-Ser
X-VCache
X-Respond-Thread
Access-Control-Allow-Method
X-WebKit-CSP-Report-Only
X-Time
X-Mobile-URL
X-Contextid
X-Seen-By
MS-CV
Cleartype
X-Source
X-Type
Paypal-Debug-Id
X-DataDome
X-XRDS-LOCATION
X-AOL-HN
X-Providence-Cookie
X-Aspnet-Duration-Ms
X-Request-Guid
X-Route-Name
X-LB-Cache
X-Is-Crawler
X-Upgrade-Enabled
ServerID
X-Flags
X-Varnish-Backend
Payment
X-Content-Options
X-TT
X-Cache-Key
X-Cache-Action
X-IPLB-Instance
Healthy
X-Signature
X-Whom
X-Debug-Info
X-B-Cache
X-Load-Cache
X-N
X-Page-Id
X-App-Environment
X-FB-Debug
Fastcgi-Useragent
Node
X-Jobs
Cache
X-Webkit-Csp
X-Rule
X-Mobile
X-Cache-Expired-At
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-FireWall-Port
Refresh
Viewport
X-Original-Request-Id
X-Wix-Request-Id
X-Response-Served-From
X-Accel-Buffering
DC
Ms-Operation-Id
X-Cacheable-TTL
X-RTag
Access-Control-Request-Headers
X-Cache-Control
X-Cluster-Name
X-Instance
X-HTML-Minification-Powered-By
X-Page-View
X-Real-IP
Referer-Policy
X-Framework
X-Content-Powered-By
X-B
X-Zen-Fury
X-UUID
X-Drupal-Cache-Tags
VIX-Pulpo-Upstream-Status
X-IPS-LoggedIn
X-Tt-Trace-Host
VIX-Pulpo-Node
Version
X-Tt-Trace-Tag
X-Distributor
X-Cache-Time
Eomportal-Instance
X-Debug-IsConnected
X-Debug-IsPreview
X-RemovedCookies
X-ProcessESI
X-Region
Countrycode
X-Www-Served-By
X-Tec-Api-Origin
X-Proxy
X-Tec-Api-Version
X-Tec-Api-Root
X-FTR-Request-ID
X-Protected-By
X-Drupal-Cache-Contexts
X-Nginx-Cache
X-G
X-FW-Type
X-App-Server
X-FW-Static
X-FW-Hash
X-FW-Dynamic
X-FW-Serve
X-FW-Server
Xserver
X-Cached-By
X-Tumblr-User
X-Tumblr-Pixel
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Yottaa-Optimizations
X-Yottaa-Metrics
Liferay-Portal
CF-IPCountry
X-Cache-Rule
X-Varnish-Grace
X-Cache-Operation
GEO-INFO
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Io-Id
Section-Origin-Responded
X-Via-JSL
X-Cache-Hit
X-Pass-Why
X-L-Path
SRV
X-Device-Type
X-Environment-Context
X-Akamai-Edgescape
X-TA-CDN-Provider
Powered-By-ChinaCache
Server-Info
X-Varnish-Server
X-Adobe-Content
X-Adobe-Loc
Retry-After
Cache-Status
X-User-Agent
DynaTrace
X-TEC-API-ROOT
Frame-Options
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-Pinterest-Direct
Ec-Rule-Version
X-Endurance-Cache-Level
X-Handled-By
X-RN-RSRV
Meta-Geo
X-UPSTREAM-Address
X-ES-SERVER
From-Origin
X-Mode
Fastly-SSL
X-Tumblr-Pixel-2
Cache-Tv-Group
X-FB-TRIP-ID
X-Backend-Name
Webserver
X-Hl-Ver
X-Proxy-Cache-Status
TWC-Connection-Speed
X-Section
X-Storage
TWC-Device-Class
Decoy-Debug-Status
Apigw-Requestid
X-Format
Uber-Trace-Id
Decoy-Debug-Key
X-WA-Info
Property-Id
Decoy-Debug-TTL
X-Human
X-Uri
X-Soup
X-Request-Time
X-Access
TWC-Privacy
X-PCL
Webcakes-App-Version
X-Pubstack
Webcakes-Region
X-ProxyCache-Key
X-ProxyCache-Status
TWC-GeoIP-Country
X-Origin-Hint
X-BYPASS-REASON
TWC-GeoIP-LatLong
TWC-Locale-Group
X-MP-GENERATED-AT
X-NYM-Debug-Backend
Webcakes-App-Name
X-OCL
X-Be
X-Proto
X-AWS-Id
X-Web-Node
X-Loop
X-Origin-Date
Country
X-PHP-Host
Selected-Fe
X-Sql-Count
X-Sql-Duration-Ms
X-LAGOON
X-LJ-Flow-ID
X-Server-W
X-Labrador-Cache-Channel
X-SayCDN-TTL
X-Say-Cacheable
X-Timing-Wait
X-VWS-Id
X-Say-TTL
X-Proxy-Build
X-Varnishpool
X-R9-Blue-Green-Version
X-TNCMS
X-UA-Device-Type
Mn-Server-Ip
X-Cache-Server
Cache-Name
Protected
Azure-Version
Azure-SlotName
Azure-RegionName
Azure-SiteName
X-ApacheServer
X-Cache-TTL-Remaining
X-S-Maxage
X-Xfnlog-Site
X-No-Session
X-Info
X-GG-Cache-Date
Azure-InstanceId
X-PERF
X-Sorting-Hat-ShopId
X-Hyper-Cache
X-SRV
Amp-Access-Control-Allow-Source-Origin
X-Status
X-Storefront-Renderer-Rendered
X-Alternate-Cache-Key
X-Content-Age
X-ShardId
X-Hosted-By
X-Shopify-Stage
X-Sorting-Hat-PodId
X-ShopId
X-Via-Fastly
X-Zipkin-Id
X-Redis-Cache
X-Rendered-As
X-Routing-Service
X-Proxied
X-Is-Bot
X-Cache-Enabled
X-NWS-UUID-VERIFY
X-App-Version
X-Backend-Host
X-Locale
X-FW-Version
X-Azure-Ref
S-Cnection
X-Cluster
X-Site-Version
X-Cache-Grace
X-Microcachable
X-Ratelimit-Limit
X-Forwarded-Host
X-TT-LOGID
X-AIR-PT
X-Platform
Akamai-GRN
X-Qloud-Router
X-CSRF-Token
X-Trace-Id
X-RateLimit-Limit
X-Revision
ServedBy
X-ATG-Version
X-Cache-NGX
X-EdgeConnect-Cache-Status
X-Aspnetmvc-Version
AMP-Access-Control-Allow-Source-Origin
X-Cache-PHP
X-RCS-CacheZone
X-Via-CDN
X-Varnish-Hostname
Who
X-Debug-Cache
X-Detected-As
Filterid
Cache-Hits
Country-Code
X-TX-ID
DB-Nickname
X-CCM
X-Dc
X-Akamai-Transformed
X-CS
X-B3-SpanId
X-Cache-Host
X-Adobe-Source
X-Amzn-Remapped-Content-Length
X-Amz-Apigw-Id
X-Varnish-Beresp-Grace
X-Amzn-RequestId
SD-X-WS
X-CACHE-KEY
X-ID
X-Node-Name
X-GEO
X-Ms-Version
X-Ms-Request-Id
X-Varnish-Beresp-Ttl
X-Unique-Id
X-BCube-Filmed-By
X-Varnish-Beresp-Status
Backend
X-Varnish-Cache-Hits
X-Request-UUID
X-Oss-Server-Time
X-Oss-Request-Id
X-S
X-S-Cookie
X-Oss-Object-Type
X-Owner
X-Oss-Storage-Class
X-ScT
X-Varnish-Ttl
X-SRCache-Key
X-Rewrite-Enabled
X-Origin-TTL
X-B-Cookie
X-Session-Fingerprint
X-Origin-CC
X-Application
X-ARC
X-From
X-Oss-Hash-Crc64ecma
X-A-Dgt
X-Destination
DCR-Processing-Time-Ms
X-VG-WebCache
X-VG-WebServer
DCR-Decision-By
Odigeo-Trace-Id
X-A
X-PBS-Appsvrname
MD5-Digest
X-D
X-NAPM-TraceId
X-Generated-On
Mobile-Detection-Method
Meta-Geo-Continent
X-Vtex-Remote-Cache
X-External-Request-Id
X-Generation-Time
Fastly-Backend-Name
X-Processor
Expiry
Fastcgi-X-Cache-Version
X-Vdms-Version
X-Vdms-Path
X-Cache-Bucket
X-Level-Front-Cache
X-Vtex-Processado-Em
X-PAYTM-SRV-ID
X-Trv-Group
NGB
X-A-Wwc
X-Edge-Location-Klb
T-Server
BehaviorPad-Version
X-Rojux
X-A-Dam
X-A-Ccd
Machine
X-Connection-Hash
X-A-Dcw
Rendered-Blocks
X-Cache-NE
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-Aed
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Time-Microsecs
X-Kraken-Routeconfig-Destination
PB-PID
X-Location
Release
PB-RID
Path
Esi-Enabled
Wxu-Next-Commit
X-Magnolia-Registration
Content-Disposition
Server-Host
Pagetype
Cf-Device-Type
Host-ID
Thinkindot-Control
Thinkindot-CacheControl-Type
UCS
V-Age
X-OVcl
Thinkindot-CacheControl
Ssr
CacheControlHeader
X-OVcl-Cache
Cache-Host
Arc-Version
Gh-Request-Id
X-Irp-Debug
X-Tumblr-Pixel-3
X-Var-Ttl
X-TrackingId
X-Thinkindot-L3
X-Fetched-On
X-Thanos
X-Has-Esi
X-Policy
X-GeoIP-City
X-Core-Value
X-Cms-Context
X-Developers
X-Device-Os
X-IP
X-FC-Vary-Parameters
X-Backend-TTL
Wxu-Next-Region
X-Reqid
X-ServerID
X-Backend-State
X-B3-Traceid
Wxu-Next-Hostname
X-JWT-State
X-Bip
X-Generated-In
X-Is-Gdpr
User-Cache-Control
NGX
L
X-DefElseHash
X-DefHash
X-Dispatcher-Server
X-Developer
NM-Fastcgi-Cache
X-Epic-Correlation-Id
L5d-Success-Class
X-Geo-Header
Locid
Location
Magicmarker
X-Fastly-Cache
X-Envoy-Decorator-Operation
X-Micro-Cache
X-Eu-Site
X-Fastly-Backend
X-DPWN-IS-SECURE
X-Li-Pop
X-HS-Content-Campaign-Id
True-Client-Country-4JS
Sever-Int
X-Hnp-Log
X-Li-Fabric
X-Branch-Name
X-Block-Status
Web-Mar-Node
X-Azure-Ref-OriginShield
IsBot
Vix-Hermes-Req-Id
X-Cache-Debug
Server-Hostname
X-Clientip
Platform
X-GeoIP
X-Csrf-Jwt
X-CGP
X-GoCache-CacheStatus
X-Cache-Info
X-Cache-Tags
Server-Ext
X-LI-UUID
Origin
X-Platform-Server
AKAMAI
Apple-News-Services-Handled
Adler-Geo
X-Planisys-CDN-TTL
X-Varnish-Remaining-TTL
X-Old-Content-Length
X-Country-Code-Real
Apple-News-Services-Host
CDCHOST
X-VG-TLSProxy
C-Via
Apple-News-Services-Request-Url
Apple-News-Services-Parsed-Url
X-Origin
X-Varnish-CookieINHashed-On
X-SVT-ORM-VERSION
X-User
X-Rebelmouse-Surrogate-Control
X-SVT-ORM-RULES
X-Request-URI
X-Request-Host
X-Rebelmouse-Cache-Control
X-Variation
X-Origin-Response-Time
X-Origin-Expires
X-Varnish-CookieHashed-On
X-Gen-Mode
X-Ratelimit-Reset
CDN-Cache
Is-Eu
X-Wikidot-Backend
Fastly-SIE
X-Planisys-CDN-Rules
X-Nginx-Cache-Key
X-Node-Id
DSUID
Fastly-SWR
X-Wikidot-Static-Cache
X-Nc
X-Planisys-CDN-Cache
HA-Ipaddr
Ha-Gx-Prefs
X-Mvc-Supplant-Cachable
X-VServer
HostName
CDN-RequestCountryCode
CDN-RequestId
X-FTR-Backend
CDN-PullZone
CDN-CachedAt
CDN-EdgeStorageId
X-FTR-Backend-Server
X-FTR-Balancer
X-FTR-DC
X-FTR-Realm
X-NU-AKA-ACS-Version
X-FTR-Cache-Status
CDN-Uid
X-SIPLIST1
X-DynaTrace-JS-Agent
X-NewRelic-App-Data
X-Amz-Meta-S3cmd-Attrs
X-EC-Lua
X-Loc
PFcat
Rt-Fastcgi-Cache
X-LB-ID
X-Varnish-Hits
X-Clara-WADP
Cf-Bgj
X-Goog-Meta-Goog-Reserved-File-Mtime
Cmsid
X-Method
Req-Svc-Chain
X-Fmm-Version
X-Generated-By
Fastly-Drupal-HTML
X-WADP-Cache
Cmstype
On-Server
X-Esi-Check
X-Gzip
X-VarnishDD-TTL
X-Tb
X-Scheme
X-HN
X-Hash
X-Slack-Backend
X-Aicache-OS
X-Skip-Cache
X-Cache-Id
X-Unique-ID
X-Ratelimit-Remaining
X-Correlation-ID
Kp-EeAlive
X-Swa-Ws
X-Gamma-Serve
X-Vgn-Hpd-Reason
X-Varnish-Url
X-Served-From
Xc-Version
X-Servername
X-Sucuri-ID
X-APP-VERSION
A
X-Ah-Environment
X-Mvc-Supplant-OutputCached
X-Via-Popv
X-Via-Popn
Pics-Label
Svr
X-Via-Poph
X-Air-Hostname
X-FTR-Expires
Viewtype
X-PF-Uncompressing
Url
X-Refresh
X-DC
VivaBuild
M-TraceId
X-JoinUs
X-SaId
X-Cdn-Forward
SID
X-NGENIX-Cache
Instruction
SR-User-Adfree
X-Edge-Location
X-NC
Tracecode
Cross-Origin-Opener-Policy
X-PHP-Backend
Cache-Key
X-CDN-Forward
X-CUA
TDXMobile
Arc-Country
X-Cache-Var-Map
X-Cache-Var
MIME-Version
X-Matched-Rule
Lfy
X-Vc
NtCoent-Length
Content-Secure-Policy
X-NCache
CloudFront-Viewer-Country
X-Cache-Expires
X-Tb-Optimization-Total-Bytes-Saved
X-Cdn-Origin
X-Sn-Servicetimems
X-Extlb
Sid
X-TraceId
DataCenter
X-Cache-Backend
X-Service
Pramga
Server-ID
X-Internal-Host
X-CLOUD-TRACE-CONTEXT
X-Servedbyhost
X-Bc-Bl
X-Core-Mission
X-Cache-Date
X-Wa
Geo-Info
Tcn
X-Request-Start
Source
X-Forwarded-Site
X-B3-Spanid
X-Req
X-Proxy-Upstream
X-Webkit-CSP-Report-Only
Hostname
Surrogated-Key
Geoip-Latitude
FSS-Cache
X-LI-Proto
X-Srv
GeoIp-Country-Code
LB
X-HS-Status
X-VCL-Version
Memcached
X-FireWall-Protection
We-Hiring
X-Accel-Expires-Debug
Mail-Subject
X-Via-NSCOPI
X-Esi
X-Newrelic-Synthetics
X-Error
X-Date
CACHE
Upgrade-Insecure-Requests
X-VHOST
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
Env
X-Varnish-Cacheable
X-Sigma-Backend
X-Sigma
X-VC-Cache
X-Viewer-Country
X-Response-By
X-App
X-Rocket-Build-Number
X-HOST
X-Hcs-Proxy-Type
X-Cache-Ttl
X-CCDN-CacheTTL
X-CCDN-Origin-Time
Resin-Trace
GeoIP-Country-Code
GeoIP-Latitude
X-Li-Proto
X-Air-Source
X-Vcl-Version
X-MSEdge-Features
X-PJAX-URL
Request-ID
X-MSEdge-Flight
Server-Ttl
X-Men
X-Geo
X-LiteSpeed-Cache-Control
X-Zone
X-RPM
X-RSL
Memory
CF-Cached-On
X-Mg-Request-UUID
Xkeyi7
X-TIM-N
X-BBXSRF
X-Proxy-Cachei7
Time
X-DI
X-DB
X-DW
X-DSS
X-RPS
X-ZONE
VNS-Age
CPC-Cache
VNS-Cache
CPC-Age
X-Cs
N-Cache
S-Rt
HitType
X-RAMCache
X-APP
X-WA
XServer
X-Action
State
My-App
Fastcgi-Cache-TTL
X-ServedByHost
X-Air-Trace-Id
X-Cache-ASPX
X-Varnish-Authentication
X-Cache-2
X-Contensis-Viewer-Groups
ProcessTime
X-HostName
X-Cc-Via
X-Region-Sid
X-Cc-Req-Id
X-Minions-Version
D-Cc-Upstream
Server-Id
X-Oss-Cdn-Auth
X-FPC
X-UA
X-Svr
X-Swift-Error
X-Provided-By
X-Dynatrace-Js-Agent
X-Cache-Type
X-FORWARDED-FOR
X-Depends-On
W
Mime-Version
Cache-Provider
Srv
X-Cdn-Request-ID
X-URL
CDN
X-CSRF-TOKEN
X-API-Version
X-Dw-Trace-Id
X-UnsetCookies
X-TIME
X-Cache-Config
X-Server-IP
X-BACKEND-TTL
X-Gdpr
X-Origin-Time
X-Fpc
X-Nyt-Route
X-CF-Powered-By
X-Client-Ip
X-Xrds-Location
X-ServerName
Cteonnt-Length
Cdn
X-Hello
X-Flog
X-Parent-Response-Time
X-Fastly-Request-Id
X-Tenant
X-Shop-Environment
Proxy-Connection
X-Forwarded-Path
OT-Force-Account-Verify
X-Orig-Expires
X-ABtesting
X-ND-Cache
X-Cache-Remote
Cross-Origin-Window-Policy
Datacenter
Ohc-File-Size
X-Akamai-Pragma-Client-IP
X-Sucuri-Cache
WZWS-RAY
X-Pad
X-SD-PageType
X-Pf-Uncompressing
Media-Length
X-SN
X-NGINX-Cache
X-Check-Cacheable
X-Snapshot-Date
Dnion-Transfer-Encoding
X-Traceid
X-VC
X-Oracle-DMS-ECID
Vha6-Origin
X-Fastly-Backend-Reqs
X-Presslabs-Stats
X-NodeID
Ohc-Cache-HIT
X-Erf-Stays-Bingo-Pdp-Web
X-Pjax-Url
X-Ftr-Request-Id
X-Ftr-Cache-Host
X-Cluster-Node
Cf-Ipcountry
X-Via-PopN
X-Via-PopV
X-BBC-Edge-Cache-Status
X-SB
X-ElasticPress-Search
X-LiteSpeed-Tag
X-Webstats-RespID
X-Via-PopH
Epwk-X-Cache
PICS-Label
X-Air-Pt
X-Acquia-Application-UUID
X-Acquia-Site
X-Acquia-Application-Trace
X-Akamai-ERPolicy
X-IN-APIGATEWAYSSL
X-Akamai-ERRuleID
X-IN-APIGATEWAY
X-MiniProfiler-Ids
X-Conf
X-Cache-Tag
X-Yottaa-OS
Warning
X-Vcache
X-Acquia-Purge-Tags
X-Ms-Meta-Staticbatchstarttime
X-Lb-Id
X-Varnish-URL
Xet-Cookie
X-Ms-Meta-Originalurl
EpKe-Alive
X-Host-Name
CountryCode
X-Render-Time
X-Redis-Count
Inserted-Into-Cache-At
Phost
X-Redis-Duration-Ms
X-Request-URL
X-Ckpd-Fst-Backend
X-V-Cache
Count-Hit
X-Debug-Cache-Fetch
Ohc-Response-Time
URI
X-C
NnCoection
X-Varnish-Beresp-TTL
Content-Script-Type
Content-Style-Type
X-Debug-Cache-Store
X-Litespeed-Cache-Control
X-B3-Parentspanid
X-Amz-Meta-Cb-Modifiedtime
X-Tid
X-BBC-Origin-Response-Status
X-Cache-Status-Check
X-Mg-Request-Id
X-Apw-Hits
X-Apw-Access-Token
X-Apw-Access-Action
X-Apw-Access-Object
Environment