Threat Level: green Handler on Duty: Rick Wanner

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
CF-RAY
X-XSS-Protection
Accept-Ranges
Expect-CT
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
P3P
X-Served-By
X-Xss-Protection
X-Request-Id
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
X-FRAME-OPTIONS
Access-Control-Allow-Credentials
X-AspNet-Version
Content-Security-Policy-Report-Only
X-Runtime
Accept-CH
X-DNS-Prefetch-Control
P3p
X-Cache-Status
Accept-CH-Lifetime
X-Drupal-Cache
X-Check
X-Ua-Compatible
X-Generator
Server-Timing
X-Cacheable
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-Iinfo
X-Drupal-Dynamic-Cache
Access-Control-Expose-Headers
X-Content-Security-Policy
Feature-Policy
Content-Encoding
X-CDN
Status
X-AspNetMvc-Version
Upgrade
X-Request-ID
Access-Control-Max-Age
X-Via
X-Amz-Request-Id
X-Amz-Id-2
CF-Ray
Host-Header
Cf-Edge-Cache
X-Backend
Allow
Request-Context
Keep-Alive
X-UA-Device
X-Robots-Tag
X-Server
X-Cache-Group
X-Hacker
X-AH-Environment
X-Turbo-Charged-By
X-Ws-Request-Id
X-Proxy-Cache
X-Age
Xkey
X-Rq
EagleId
X-Vhost
X-Dispatcher
X-Server-Powered-By
X-Amz-Version-Id
X-Varnish-Cache
Grace
Cf-Apo-Via
X-Page-Speed
X-Swift-SaveTime
X-Swift-CacheTime
X-Pingback
Cf-Railgun
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
Ali-Swift-Global-Savetime
X-Device
X-WebKit-CSP
EagleEye-TraceId
X-Dns-Prefetch-Control
X-Aws-Lambda-Call-Status
X-CST
X-OneAgent-JS-Injection
X-LiteSpeed-Cache
Permissions-Policy
X-Backend-Server
X-Server-Id
X-Litespeed-Cache
X-Readtime
X-Response-Time
X-Host
X-Akam-SW-Version
Request-Id
Surrogate-Control
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-HW
X-Nginx-Upstream-Cache-Status
X-Cache-Lookup
X-Cloud-Trace-Context
X-Node
X-Nginx-Cache-Status
X-Application-Context
X-Country-Code
Content-Location
X-Trace
X-Country
Service-Worker-Allowed
X-Ruxit-JS-Agent
X-Url
X-Content-Type
X-Clacks-Overhead
X-Oneagent-Js-Injection
X-Origin-Cache-Key
Accept-Ch-Lifetime
X-Edge
X-Rack-Cache
Cross-Origin-Opener-Policy
Cache-Tag
X-Amz-Server-Side-Encryption
X-FTR-Request-ID
X-Midtier
X-Mcache
X-Mod-Pagespeed
X-MS-InvokeApp
X-Vname
X-TtlSet
Nginx-Cache
X-PC
X-ECACHE
X-ESI
X-Upstream
X-Powered-By-Plesk
Rating
Edge-Control
X-Server-Name
X-Browser-Type
X-D2id
X-Cnection
X-Element-Page-Cache
Verso
X-Times
X-Cdn-Fetch
X-GoogleNews-Bot
X-Kinja-Revision
X-Kinja-Build
X-Exp-Variant
X-Exp-Id
X-Kinja-Server
X-Kinja
SPRequestDuration
SPIisLatency
X-Ruxit-Js-Agent
X-Ac
AR-PoweredBy
AR-SID
AR-Request-ID
AR-ATIME
X-B3-TraceId
X-NWS-LOG-UUID
X-SharePointHealthScore
SPRequestGuid
X-Ser
X-Navigation-Version
X-Abt-Application-Version
X-NF-Request-ID
X-GitHub-Request-Id
X-Vcap-Request-Id
X-Dw-Request-Base-Id
X-RateLimit-Remaining
AR-CACHE
Pinterest-Version
X-Ttl
Pinterest-Generated-By
X-Pinterest-Rid
X-Mg-S
X-VARITI-CCR
S
X-Client-IP
X-Sol
X-Middleton-Display
Display
Pagespeed
Edge-Cache-Tag
X-Cache-Key
RTSS
Fastly-Restarts
X-Amzn-Trace-Id
X-Amz-Rid
X-Cache-TTL
X-Powered-CMS
Cache-Status
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Kraken-Loop-Name
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kinsta-Cache
X-Edge-Location-Klb
X-Version
X-Goog-Hash
Access-Control-Request-Method
X-Server-ID
X-Recruiting
X-Erf-Stays-Pdp-Viaduct-Migration-Web-V2
X-Varnish-TTL
X-ARC
Response
X-Middleton-Response
X-Content-Digest
X-TraceId
X-Forwarded-For
Arr-Disable-Session-Affinity
X-T
Origin-Trial
X-Daa-Tunnel
X-MSEdge-Ref
Content-MD5
X-SRCache-Store-Status
MicrosoftSharePointTeamServices
X-SRCache-Fetch-Status
TP-Cache
X-Accel-Expires
Front-End-Https
X-Shield-Request-Id
Cross-Origin-Resource-Policy
X-Content-Security-Policy-Report-Only
X-Cached
X-Hits
MS-Author-Via
Public-Key-Pins
X-Id
X-FTR-Backend-Server
X-FTR-Backend
X-Country-Code-Real
X-FTR-Balancer
X-FTR-Cache-Status
X-Fastcgi-Cache
X-HS-Hub-Id
X-HS-Cache-Config
Server-Node
X-Ua-Browser
X-HS-Combine-CSS
X-HS-Content-Id
X-FTR-Expires
X-Forwarded-Proto
X-Request-Processing-Time
X-DIS-Request-ID
X-Request-Received
Payment
X-Frontend
X-Webkit-Csp
X-LLID
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
Realpath
X-Protected-By
TP-L2-Cache
X-GUploader-UploadID
X-ORACLE-DMS-RID
X-Distributor
X-FastCGI-Cache
X-LB-Cache
Cache-Tags
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Ratelimit-Limit
X-Origin-Server
X-Microsite
X-Request-Handler-Origin-Region
X-Kong-Upstream-Latency
X-RateLimit-Limit
X-Kong-Proxy-Latency
Referer-Policy
X-B3-TraceId-Primal
Mrf-Cache-Status
X-Hostname
X-Page-Id
MRF-Tech
X-Az
Count-Hit
X-AppVersion
X-Activity-Id
X-Debug-Info
X-NGENIX-Cache
X-Www-Served-By
Host
X-Cluster-Name
Fastcgi-Cache
X-Varnish-Server
X-Varnish-Backend
X-Correlation-Id
Accept-Charset
X-Envoy-Decorator-Operation
X-F-Cache
X-App-Server
X-Geo-Country
X-ORACLE-DMS-ECID
X-Ua-Device
X-XRDS-LOCATION
X-FB-Debug
X-PressLabs-Stats
X-Goog-Metageneration
Retry-After
X-Ezoic-Cdn
Access-Control-Allow-Method
X-Upgrade-Enabled
X-CSRF-Token
X-Git-Hash
X-Load-Cache
X-Fastly-Request-Id
X-TEC-API-ROOT
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-Seen-By
X-Content-Options
X-Varnish-Ttl
X-TTL
X-RateLimit-Reset
Server-Name
X-Px
Section-Io-Cache
X-Contextid
TCN
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-Request-Guid
X-Datadog-Trace-Id
X-Revision
X-Type
X-Oracle-Dms-Ecid
X-Tt-Trace-Tag
X-Trace-Id
X-Amz-Meta-S3cmd-Attrs
X-Tt-Trace-Host
X-Cache-Control
X-Grace
Charset
X-B
Cleartype
Paypal-Debug-Id
Healthy
X-B3-Sampled
X-TT
X-Whom
DC
X-Signature
X-Fb-Rlafr
X-B-Cache
X-Wix-Request-Id
X-App-Environment
X-Newrelic-App-Data
X-Node-Name
X-Origin-Cache
X-Proxy
Frame-Options
X-Mobile
Accept-Ch
X-Magnolia-Registration
X-Amz-Replication-Status
X-Azure-Ref
X-Rid
X-Oracle-Dms-Rid
X-Air-Pt
X-Ratelimit-Remaining
X-Goog-Stored-Content-Length
X-Goog-Generation
X-Fastly-Request-ID
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-N
X-WebKit-CSP-Report-Only
X-EdgeConnect-Cache-Status
Filterid
X-WP-CF-Super-Cache-Cache-Control
X-Logged-In
X-WP-CF-Super-Cache
X-Language
X-Flags
X-Aspnet-Duration-Ms
X-Providence-Cookie
X-Route-Name
X-Is-Crawler
X-Kinja-CCPA
Content-Disposition
Akamai-GRN
Backend
NGB
X-Time
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
X-Original-Request-Id
X-Response-Served-From
X-Template
X-Rendered-As
X-Is-Bot
X-Yottaa-Metrics
X-ProcessESI
X-Cache-Age
X-Unique-Id
X-Datadog-Sampled
Upgrade-Insecure-Requests
X-Varnish-Grace
X-Tumblr-User
X-Yottaa-Optimizations
X-Debug-IsConnected
SD-X-WS
X-RTag
Liferay-Portal
MS-CV
X-Debug-IsPreview
Viewport
X-Tumblr-Pixel-1
X-RemovedCookies
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Servername
Ms-Operation-Id
X-Adobe-Loc
X-Adobe-Content
X-FW-Version
X-UUID
Refresh
X-IPS-LoggedIn
X-Instance
X-Amzn-Remapped-Content-Length
X-Proxy-Cache-Info
X-FW-Type
X-Debug
X-FW-Hash
X-FW-Dynamic
X-FW-Serve
X-FW-Server
X-NYM-Debug-Backend
X-FW-Static
X-App-Version
Fastly-SIE
X-Environment-Context
X-Hcs-Proxy-Type
Fastly-SWR
X-L-Path
X-Cacheable-TTL
X-Cache-Grace
X-G
X-Hl-Ver
X-Region
X-Backend-Name
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Via-JSL
X-User-Agent
X-Device-Type
From-Origin
X-Status
Country
X-Cache-Hit
ServerID
X-Rule
X-B3-SpanId
Url
X-VC-Cache
X-Jobs
X-INCAP-ABP
X-Webkit-CSP
Countrycode
WPO-Cache-Status
Alternate-Protocol
Version
WPO-Cache-Message
X-Cache-Status-Check
X-HTML-Minification-Powered-By
X-Source
X-Origin-TTL
X-Air-Hostname
X-Air-Source
X-Air-Trace-Id
X-Origin-CC
X-NODE
X-Page-View
GEO-INFO
Surrogate-Key
X-Akamai-Request-ID2
X-Nginx-Cache
X-Hosted-By
CDN-RequestId
X-Content-Powered-By
X-Storage
X-B3-Traceid
Amp-Access-Control-Allow-Source-Origin
X-WP-CF-Super-Cache-Active
X-Rocket-Nginx-Serving-Static
Protected
SRV
X-Tec-Api-Version
X-Tec-Api-Root
X-Tec-Api-Origin
X-Accel-Version
OT-Force-Account-Verify
X-Akamai-Edgescape
X-Real-IP
Access-Control-Request-Headers
X-VC
X-CDN-Forward
X-Edge-Location
X-Framework
AMP-Access-Control-Allow-Source-Origin
CF-IPCountry
X-ServerID
X-Cache-Time
X-Use-Mantle
X-Cache-Rule
X-Mode
Front
X-UPSTREAM-Address
X-Upstream-Ct
X-Xfnlog-Site
X-Rn-Rsrv
X-Upstream-Ht
Webserver
Accept-Language
Meta-Geo
X-Cache-Operation
X-Rewrite-Enabled
Filters
X-Http-Reason
X-Proxy-Build
X-Tumblr-Pixel-3
X-Varnish-Cache-Hits
X-LJ-Flow-ID
Cross-Origin-Embedder-Policy
X-Tumblr-Pixel-2
X-Timing-Wait
X-Origin
X-Soup
X-Served-From
Xet-Cookie
X-SaId
Selected-Fe
X-VWS-Id
ServedBy
X-Handled-By
X-Director
X-Cache-Debug
X-Detected-As
Mn-Server-Ip
X-AWS-Id
X-JoinUs
Section-Io-Id
X-Redis-Cache
X-Proxied
X-Extlb
X-ProxyCache-Key
X-ProxyCache-Status
X-PHP-Host
X-Logging-Id
Property-Id
X-Format
Node
Apigw-Requestid
X-Labrador-Cache-Channel
X-Lambda-Id
X-No-Session
TWC-Connection-Speed
X-Cluster
X-Origin-Hint
X-Say-Cacheable
X-Web-Node
X-Adobe-Source
X-Restarts
X-Endurance-Cache-Level
X-Worker
X-Zipkin-Id
X-Httpd
X-Cms-Context
X-BYPASS-REASON
Xserver
Webcakes-Region
X-Vcache
Webcakes-App-Version
X-SayCDN-TTL
TWC-GeoIP-Country
X-Routing-Service
TWC-Device-Class
TWC-GeoIP-LatLong
X-Say-TTL
TWC-Locale-Group
Web-Mar-Node
Webcakes-App-Name
TWC-Privacy
X-GeoCountry
DB-Nickname
X-GeoCode
X-Forwarded-Host
X-Browser-Name
X-AB
X-Geo-Region
X-Locale
X-Tncms
X-Varnish-Age
X-Tcp-Rtt
X-Skip-Cache
X-S
X-Site-Version
X-Varnish-Beresp-Grace
X-VCT
X-Platform-Processor
X-Platform-Router
X-Platform-Cluster
X-Drupal-Cache-Tags
X-TT-LOGID
X-RCS-CacheZone
X-RM-Cache-TTL
Azure-SiteName
Azure-RegionName
X-Is-Desktop
Azure-SlotName
Azure-Version
X-IPLB-Instance
X-IPLB-Request-ID
X-Is-Mobile
Azure-InstanceId
X-Is-Tablet
X-Loop
X-Is-Supported-Browser
X-Webstats-RespID
X-Git-Commit
X-Container-Uri
X-Reqid
X-Server-W
X-Fetched-On
X-R9-Blue-Green-Version
X-Generation-Time
X-Vercel-Id
X-Tb
X-Drupal-Cache-Contexts
X-Vercel-Cache
X-Cache-Host
X-Cache-Server
X-Ms-Version
X-Frame-Option
X-Provided-By
X-Ms-Request-Id
X-Shopify-Stage
X-Alternate-Cache-Key
X-MP-GENERATED-AT
X-Uri
CDN-Cache
X-Storefront-Renderer-Rendered
CDN-RequestPullCode
CDN-CachedAt
CDN-RequestCountryCode
CDN-RequestPullSuccess
CDN-PullZone
CDN-Uid
CDN-EdgeStorageId
X-Origin-Date
X-Sucuri-Cache
X-DynaTrace
WP-Super-Cache
X-XRDS-Location
X-ShardId
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-ShopId
Fastcgi-Useragent
X-Sucuri-ID
Cache-Tv-Group
Source
X-Vcl-Version
X-Cdn-Origin
Cross-Origin-Embedder-Policy-Report-Only
X-FB-TRIP-ID
Content-Secure-Policy
X-Xrds-Location
X-Sql-Count
X-Sql-Duration-Ms
X-Generated-By
Priority
Atl-Traceid
X-Pass-Why
Onion-Location
X-Urbn-Context-Path
X-Urbn-Site-Id
X-SRV
Locale
X-Buckets
X-Content-Age
Sid
X-DataDome
X-Shield-Cache-Expires
X-Thinkindot-L3
X-Scope-Id
X-CMSURLCustom
Thinkindot-CacheControl
TDXMobile
Thinkindot-CacheControl-Type
Thinkindot-Control
Cache
Cross-Origin-Window-Policy
HostName
X-Cluster-Node
X-Newrelic-Synthetics
WZWS-RAY
X-LSADC-Cache
X-Proxy-Cache-Status
X-Varnish-Beresp-Ttl
S-Rt
X-WP-CF-Super-Cache-Cookies-Bypass
X-Cache-Action
X-Via-CDN
X-Via-Edge
X-GEO
X-Optimistic-Header
Edge-Copy-Time
X-Cache-Expired-At
X-TA-CDN-Provider
X-Via-SSL
User-Cache-Control
X-Connection-Hash
Expiry
X-SB
MD5-Digest
Meta-Geo-Continent
Fastly-Drupal-HTML
X-Scheme
X-Correlation-ID
Vix-Hermes-Req-Id
X-ScT
X-A-Dcw
Ngx-Var-Key
Gannett-Cam-Experience-Id
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
Apple-News-Services-Host
Apple-News-Services-Handled
X-Dispatcher-Server
X-Ec-Custom-Error
X-Ec-Fail
CDCHOST
Candidate-Md5Url
X-External-Request-Id
X-Ec-GeoHdr
A
X-Developer
L
X-Cache-NE
Lang
Magicmarker
X-Instance-Name
X-Conf
X-Destination
DCR-Decision-By
DCR-Processing-Time-Ms
X-D
X-Cache-Bucket
X-Rojux
X-B-Cookie
X-Platform
Server-Ext
X-Vdms-Version
X-Vdms-Path
X-A-Ccd
X-Viewer-Country
X-Ua
Redirect-Candidate
X-Vtex-Remote-Cache
Rendered-Blocks
Server-Host
X-SRCache-Key
X-TIM-N
Surrogated-Key
T-Server
X-Aed
Sslversion
Sever-Int
X-Access
X-Varnish-Hostname
Server-Hostname
X-Application
X-Bc-Bl
Req-ID
X-A
X-Bl-Debug
X-Op-Id-All
Origin
X-Request-Start
X-A-Dam
X-Section
X-A-Dgt
Ngx.Var.Host
X-S-Cookie
X-Epic-Correlation-Id
Origin-Agent-Cluster
X-PAYTM-SRV-ID
X-A-Wwc
X-BCube-Filmed-By
X-Dc
X-TimeS
Content-Script-Type
Release
V-Age
Content-Style-Type
X-Cache-TTL-Remaining
X-Amz-Meta-Cb-Modifiedtime
Cluster
X-AK-Request-ID
X-Cache-Info
Cdncip
Cdnsip
X-BBC-Edge-Cache-Status
NM-Fastcgi-Cache
Ssr
X-Acquia-Purge-Cdn-Unconfigured
Wxu-Next-Commit
X-Branch-Name
Type
X-Block-Status
Environment
X-Debug-Cache-Fetch
Wxu-Next-Region
Fastly-GeoIP-CountryCode
X-Core-Value
Req-Svc-Chain
X-B3-Trace-ID
X-Clientip
X-Debug-Cache-Store
Fastly-SSL
Pramga
DSUID
X-Bip
X-Auto-Login
X-Cache-Id
Host-ID
X-Moov-T
X-We-Are-Hiring
X-Zen-Fury
X-Origin-Time
Wxu-Next-Hostname
X-WA-Info
X-Pool
X-VServer
Yak-Timeinfo
X-Esi-Check
X-NCache
X-Moov-Xdn-Version
X-Nginx-Cache-Key
X-NMSegId
X-Nyt-Route
X-Node-Id
X-Proxied-Request
X-VG-WebCache
X-SD-PageType
X-Sigma
X-Sigma-Backend
X-Rocket-Build-Number
X-Request-URI
X-Req
X-Request-Time
X-TH-Server
X-Thanos
X-Varnishpool
X-VG-TLSProxy
X-Varnish-Director
X-Varnish-Beresp-Status
X-Pubstack
X-UA-Device-Type
X-Mly-Id
X-ND-Cache
X-Hnp-Log
X-Azure-Ref-OriginShield
X-Gzip
X-Gdpr
X-GeoIP-Region-Code
X-Forwarded-Site
X-GeoIP-Country-Code
X-Human
X-Generated-On
Cache-Provider
X-Gen-Mode
X-Loc
X-Fastly-Cache
C-Via
X-Level-Front-Cache
X-Origin-Response-Time
X-Service
X-RateLimit-Limit-Second
X-Var-Ttl
X-Aicache-OS
X-V-Cache
X-From
X-SVT-ORM-VERSION
X-DPWN-IS-SECURE
X-RateLimit-Remaining-Second
X-Region-Sid
X-Request-Host
X-Eu-Site
X-Server-IP
X-FC-Vary-Parameters
X-Ad-Load-Variation
X-Varnish-Authentication
X-SVT-ORM-RULES
X-Fmm-Version
X-Device-Os
X-GeoIP
X-CGP
X-HS-Content-Campaign-Id
X-Old-Content-Length
X-HN
X-Cache-Aspx
X-Cdn-Srv
X-Men
X-Cache-Date
X-Mvc-Supplant-Cachable
X-Mvc-Supplant-OutputCached
X-VarnishDD-TTL
X-Org
X-Policy
X-GeoIP-City
X-Micro-Cache
X-Geo-Header
X-PERF
X-Csrf-Jwt
X-Amz-Storage-Class
PFcat
X-Contensis-Viewer-Groups
X-GoCache-CacheStatus
X-ApacheServer
On-Server
Adler-Geo
Mail-Subject
Machine
X-Mg-Request-UUID
X-ECache
Web-Mar-Region
Producers
Esi-Enabled
Locid
L5d-Success-Class
Ha-Gx-Prefs
Gh-Request-Id
Country-Code
HA-Ipaddr
Click-Count-Error
Canary
Is-Eu
Click-Count-Action-Start
RNT-Machine
Platform
Tube-Got-Eval
Uber-Trace-Id
Tube-Get-Contents
True-Client-Country-4JS
Tube-Got-Results
Tube-Return
RNT-Time
We-Hiring
W
X-VCache
X-Datadome
Cdn-Request-Time
X-Backend-Instance
X-Wikidot-Static-Cache
X-Edge-Server
Cf-Device-Type
X-Wikidot-Backend
Cdn-Host
Cache-Key
X-Ratelimit-Reset
X-Test
X-DC
X-Slack-Backend
X-Up
X-Proto
X-Sn-Servicetimems
AKAMAI
X-Hash
X-Fastly-Backend
X-Slack-Shared-Secret-Outcome
Proxy-Firewall
X-App-Name
X-Tx-Id
X-Ah-Environment
X-Parent-Response-Time
XM
X-CacheTTL
X-LB-ID
Fastly-Backend-Name
X-Date
Pics-Label
X-Accel-Expires-Debug
X-Irp-Debug
LB
X-Lagoon
X-Cache-Backend
X-Servedbyhost
X-Owner
X-COUNTRY
X-API-Version
X-Origin-Expires
NGX
X-Varnish-Hits
X-UA
X-DynaTrace-JS-Agent
X-HA-Backend
X-SIPLIST1
X-CACHE-GROUP
X-Tb-Optimization-Total-Bytes-Saved
X-Via-Poph
X-Core-Mission
X-ZONE
Cdn
IsBot
X-Via-Popn
X-Via-Popv
X-RID
X-LB-NoCache
X-Refresh
X-VHOST
Datacenter
X-Qloud-Router
SID
NtCoent-Length
RATING
X-Use-Magma
Cdn-Requestid
X-NGINX-Cache
X-Wa
X-CDN-Cache-Status
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-Nc
X-Srv
Server-ID
Expect-Staple
GeoIp-Country-Code
N-Cache
X-Zone
X-Orig-Expires
X-Nananana
CloudFront-Viewer-Country
X-Cache-Type
X-Shop-Environment
Xc-Version
X-Via-Fastly
X-Forwarded-Path
X-Tenant
Cache-Hits
X-Presslabs-Stats
Cross-Origin-Opener-Policy-Report-Only
Cmsid
X-Gamma-Serve
GeoIP-Latitude
Cmstype
X-Fpc
X-Ig-Origin-Region
X-B3-Parentspanid
X-Location
CPC-Cache
DataCenter
CPC-Age
X-Hit
X-Akamai-Transformed
X-TX-ID
Fusion-Template-Id
Fusion-Source
X-Cdn-Diag
X-Nf-Request-Id
Fusion-Deployment-Id
X-Vmg-Version
Resin-Trace
User-Agent
X-Cloudmap
Fusion-Component-Id
Uri
XkeyRZ
X-Proxy-CacheRZ
Fusion-Content-Source
Fusion-Content-Id
X-Client-Ip
Powered-By
X-URL
X-CS
X-DataCenter
Origin-EX
X-CUA
X-TIME
X-Jungle-Id
True-Client-Ip
Origin-CC
X-Info
X-Amz-Meta-Opti
X-Tt-Logid
Tcn
X-NWS-UUID-VERIFY
X-User
X-Variation
X-IAuth-Set-Uid
Mime-Version
X-Fastly-Country-Code
MIME-Version
CacheControlHeader
X-NewRelic-App-Data
X-LAGOON
X-HostName
X-CACHE-AGE
X-Segment-20210421
True-Client-IP
X-Cached-By
X-Datacenter
Fastly-Drupal-Html
X-Geo
Srv
X-Dynatrace-Js-Agent
Cf-Ipcountry
Load-Balancing
X-Render-Time
X-Webkit-Csp-Report-Only
CDN
X-B3-Spanid
X-Cdn-Forward
X-VTEX-Cache-Server
VNS-Cache
X-LiteSpeed-Tag
X-VTEX-Cache-Time
X-HOST
X-Powered-By-VTEX-Cache
Debug
X-Vc
VNS-Age
X-Wormhole-Sdk
X-Varnish-Beresp-TTL
X-LiteSpeed-Cache-Control
X-Api-Version
X-AIR-PT
Ohc-File-Size
X-Auth-Group-Type
Lb
Edge-Cache
X-CSRF-TOKEN
Cl-Cache
Hostname
X-Dispatch
Ohc-Cache-HIT
X-FPC
X-Ig-Push-State
GeoIP-Country-Code
X-Dispatcher-Number
X-MCACHE
Odigeo-Trace-Id
X-Esi
X-Cdn-Cache-Status
X-NC
Cache-Name
X-NodeID
Server-Id
X-WA
X-Oracle-DMS-ECID
X-Vgn-Hpd-Reason
X-Custom-Header
X-APP-VERSION
X-Cs
X-Lb-Nocache
X-Litespeed-Tag
X-Mid
X-PHP-Backend
X-Depends
X-Cache-Ttl
X-Pad
X-Varnish-Remaining-TTL
X-Ha-Backend
X-Varnish-CookieINHashed-On
CountryCode
X-Via-PopN
X-DefHash
X-Via-PopH
X-ServedByHost
X-DefElseHash
X-Varnish-CookieHashed-On
X-Fastly-Backend-Reqs
X-Via-PopV
Ms-Author-Via
X-Srcache-Store-Status
X-Srcache-Fetch-Status
X-Litespeed-Cache-Control
X-VCL-Version
BehaviorPad-Version
X-Cdn-Request-ID
X-VC-TTL
X-Web-Server
X-MSEdge-Features
Ngx
X-MiniProfiler-Ids
X-RequestId
X-Akamai-Pragma-Client-IP
Xkeylog
Xkey-La3
X-Proxy-Cache-La3
PICS-Label
X-Lb-Id
X-MSEdge-Flight
X-M-Reqid
X-M-Log
FSS-Cache
Memcached
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
Memory
X-Snapshot-Date
X-Cache-Enabled
Time
OriginIP
X-Acquia-Purge-Tags
X-Acquia-Site
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Sorting-Hat-Podid
X-Shopid
X-Cache-Version
X-Shardid
X-Sorting-Hat-Shopid
X-Wp-Cf-Super-Cache-Cookies-Bypass
X-Th-Server
Warning
X-Cache-FS-Status
X-PDP-UNCACHING-HASH
Epwk-X-Cache
CF-Cached-On
Geoip-Latitude
X-Sucuri-Id
Sm-Log-Id
Srvid
X-FL-QIT-DEBUG
Server-Info
X-FL-EDGE
Location
X-Mg-Cache
Akamai-Cache-Status
X-Service-Response-Time
YJS-ID
X-Lsadc-Cache
X-Dw-Trace-Id
X-Check-Cacheable
X-Serial
X-Udemy-Cache-App-Namespace