Threat Level: green Handler on Duty: Russ McRee

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
Accept-Ranges
Link
ETag
Pragma
Expect-CT
X-Powered-By
X-XSS-Protection
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
Alt-Svc
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Adblock-Key
X-Runtime
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Check
X-Request-ID
X-Cache-Status
X-Generator
X-Cacheable
Timing-Allow-Origin
X-DNS-Prefetch-Control
P3p
X-Content-Security-Policy
X-Iinfo
Status
X-Ua-Compatible
Feature-Policy
Content-Encoding
X-AspNetMvc-Version
X-CDN
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
Upgrade
Access-Control-Max-Age
X-Drupal-Dynamic-Cache
X-Dns-Prefetch-Control
X-Via
Keep-Alive
X-Ws-Request-Id
Request-Context
X-Robots-Tag
Server-Timing
X-AH-Environment
X-Hacker
X-Server
X-Age
X-Turbo-Charged-By
X-Proxy-Cache
X-Cache-Group
X-Server-Powered-By
X-Backend
X-Amz-Request-Id
Host-Header
EagleId
X-Amz-Id-2
X-Nginx-Cache-Status
Report-To
X-LiteSpeed-Cache
X-Rq
X-Varnish-Cache
X-UA-Device
Grace
X-Page-Speed
X-Pingback
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
EagleEye-TraceId
X-Device
X-Vhost
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
NEL
X-Amz-Version-Id
X-OneAgent-JS-Injection
X-Dispatcher
Cf-Railgun
X-Host
X-Server-Id
X-Cache-Spec
X-CST
X-Node
X-Backend-Server
X-WebKit-CSP
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
Allow
Request-Id
Surrogate-Control
X-Readtime
X-Akam-SW-Version
Accept-CH
Accept-Ch-Lifetime
X-Response-Time
Xkey
X-Webkit-CSP
X-HW
X-Language
X-Ruxit-JS-Agent
X-Application-Context
X-Country
X-Template
X-Ac
Content-Location
X-Cloud-Trace-Context
X-Cache-Lookup
MS-Author-Via
Rating
X-Url
X-B3-TraceId
Edge-Control
X-PC
X-Vname
X-TtlSet
X-Mod-Pagespeed
X-Clacks-Overhead
X-Varnish-TTL
X-Trace
Accept-Ch
X-Content-Type
Fastly-Restarts
X-MS-InvokeApp
X-Rack-Cache
X-Origin-Cache
X-ESI
X-GitHub-Request-Id
X-Buckets
X-Cnection
X-Country-Code
X-Goog-Hash
X-D2id
Verso
X-VARITI-CCR
X-FastCGI-Cache
X-Exp-Variant
X-Cdn-Fetch
X-Exp-Id
X-GoogleNews-Bot
X-Kinja-Server
X-Use-Magma
X-Kinja-Revision
X-Kinja-Build
X-Kinja
Arr-Disable-Session-Affinity
X-ORACLE-DMS-ECID
Cache-Tag
X-Vcap-Request-Id
X-Cached
Service-Worker-Allowed
X-Server-Name
X-Abt-Application-Version
X-Amz-Rid
X-Client-IP
X-Navigation-Version
X-Px
X-Server-ID
Accept-CH-Lifetime
RTSS
X-Powered-By-Plesk
X-Fastly-Request-ID
Public-Key-Pins
Access-Control-Request-Method
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Cache-TTL
X-MSEdge-Ref
X-Element-Page-Cache
X-Powered-CMS
X-Dw-Request-Base-Id
X-NF-Request-ID
X-Upstream
X-Version
Pagespeed
Display
Response
X-Sol
X-Middleton-Response
X-Middleton-Display
X-TTL
S
X-Kinsta-Cache
X-Edge-Location-Klb
X-Edge
X-LLID
X-Ttl
MRF-Tech
X-B3-TraceId-Primal
Mrf-Cache-Status
X-ECACHE
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Kraken-Routeconfig-Destination
X-Cache-Key
X-Accel-Expires
Realpath
X-HP-Webp
X-Jurisdiction
X-Shield-Request-Id
Pinterest-Generated-By
Pinterest-Version
X-Pinterest-Rid
X-T
X-XRDS-Location
SPRequestGuid
X-SharePointHealthScore
X-MCACHE
X-DynaTrace
X-Mid
SPRequestDuration
X-PressLabs-Stats
SPIisLatency
X-Correlation-Id
X-ORACLE-DMS-RID
X-Content-Security-Policy-Report-Only
Edge-Cache-Tag
X-Litespeed-Cache
Fastcgi-Cache
X-Forwarded-Proto
X-Mg-S
X-Amz-Server-Side-Encryption
X-Content-Digest
Nginx-Cache
X-Recruiting
TP-Cache
TP-L2-Cache
Charset
X-Request-Received
X-Request-Processing-Time
X-Id
Front-End-Https
TCN
Filters
Alternate-Protocol
Server-Node
X-Logged-In
X-Oneagent-Js-Injection
X-Ezoic-Cdn
X-Forwarded-For
X-Geo-Country
Content-MD5
Fusion-Component-Id
Fusion-Content-Id
Fusion-Deployment-Id
Fusion-Source
Cache-Tags
Fusion-Content-Source
Fusion-Template-Id
X-Protected-By
X-Hostname
X-ASPNET-VERSION
X-Amzn-Trace-Id
X-Grace
X-Origin-Upstream-Status
X-GUploader-UploadID
X-Goog-Storage-Class
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-NWS-LOG-UUID
X-F-Cache
Cleartype
X-Www-Served-By
X-Origin-Server
X-Debug-Info
X-Rid
X-Amz-Replication-Status
X-HS-Cache-Config
X-HS-Content-Id
X-HS-Hub-Id
Host
X-Ruxit-Js-Agent
X-LB-Cache
X-HS-Combine-CSS
X-Az
X-AppVersion
X-Activity-Id
X-Contextid
X-Release
X-RateLimit-Remaining
Section-Io-Cache
X-Daa-Tunnel
X-Git-Hash
Server-Name
X-Page-Id
X-Browser-Type
X-Frontend
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-VCache
X-Ser
X-Cache-Age
MicrosoftSharePointTeamServices
X-Content-Options
X-Respond-Thread
Accept-Charset
X-Aspnetmvc-Version
X-Upgrade-Enabled
X-Ab
Access-Control-Allow-Method
X-Hits
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Mobile-URL
ServerID
X-DIS-Request-ID
X-Flags
X-Signature
X-Is-Crawler
X-B-Cache
X-Request-Guid
X-Aspnet-Duration-Ms
X-Route-Name
X-Providence-Cookie
X-Varnish-Age
Viewport
X-Varnish-Backend
X-Source
X-FB-Debug
X-Whom
X-Cache-Action
Healthy
Payment
Paypal-Debug-Id
X-TT
X-Varnish-Grace
X-CACHE-GROUP
X-AOL-HN
Node
X-WebKit-CSP-Report-Only
X-App-Environment
X-B3-Sampled
Fastcgi-Useragent
DynaTrace
X-Yandex-Sdch-Disable
X-Load-Cache
X-Mobile
Version
X-Fastcgi-Cache
X-Seen-By
DC
X-Tt-Trace-Tag
X-Tt-Trace-Host
Filterid
X-N
X-Distributor
X-Type
X-HTML-Minification-Powered-By
SRV
Retry-After
Frame-Options
X-Cache-Control
X-User-Agent
X-Tec-Api-Origin
X-Tec-Api-Root
X-Tec-Api-Version
MS-CV
X-Jobs
X-Cache-Expired-At
X-Original-Request-Id
Refresh
X-Response-Served-From
Amp-Access-Control-Allow-Source-Origin
X-UUID
X-Proxy-Cache-Status
X-Page-View
X-Adobe-Loc
X-FW-Dynamic
X-FW-Serve
X-FW-Server
X-FW-Type
X-Adobe-Content
NGB
X-FW-Hash
X-FW-Static
X-Debug-IsPreview
X-Region
X-Debug-IsConnected
X-Instance
X-Varnish-Server
X-IPLB-Instance
X-Real-IP
X-Cluster-Name
X-B
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
X-Cacheable-TTL
X-ProcessESI
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Tumblr-User
X-Tumblr-Pixel
X-RemovedCookies
X-XRDS-LOCATION
X-Proxy
X-G
Access-Control-Request-Headers
X-CDN-Forward
X-Cache-Time
X-Vgn-Hpd-Reason
X-NGENIX-Cache
X-Device-Type
X-Content-Powered-By
X-RTag
X-Azure-Ref
X-Framework
Ms-Operation-Id
X-IPS-LoggedIn
X-Node-Name
Uber-Trace-Id
X-Zen-Fury
X-Cache-Hit
X-Cache-Rule
X-HP-Trace-Id
Cache-Status
AR-CACHE
AR-Request-ID
Ar-Sid
AR-PoweredBy
AR-ATIME
X-Wix-Request-Id
SD-X-WS
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Io-Id
Referer-Policy
X-Rendered-As
Section-Origin-Responded
Countrycode
X-Is-Bot
Liferay-Portal
X-Ms-Version
X-Ms-Request-Id
X-Time
X-Aws-Lambda-Call-Status
X-Mg-Request-UUID
X-Drupal-Cache-Tags
X-RateLimit-Limit
X-Microsite
X-Request-Handler-Origin-Region
X-Debug
X-Oracle-Dms-Rid
X-Nginx-Cache
X-Accel-Buffering
X-Parallel-Accel
X-EdgeConnect-Cache-Status
S-Cnection
Country
X-App-Server
X-L-Path
X-Environment-Context
X-App-Version
X-Revision
Cache
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Cache-Operation
X-TA-CDN-Provider
CF-IPCountry
Surrogate-Key
Count-Hit
X-Drupal-Cache-Contexts
X-GG-Cache-Date
X-UPSTREAM-Address
X-RN-RSRV
Meta-Geo
X-ES-SERVER
X-TNCMS
X-Loop
X-SaId
X-JoinUs
X-Endurance-Cache-Level
X-Xfnlog-Site
X-Say-TTL
From-Origin
Eomportal-Instance
X-Adobe-Source
GEO-INFO
Akamai-GRN
X-FireWall-Port
X-SayCDN-TTL
X-Cache-TTL-Remaining
X-Cache-Type
X-LAGOON
X-FW-Version
X-Say-Cacheable
X-Alternate-Cache-Key
X-Human
Azure-SlotName
X-Storefront-Renderer-Rendered
X-Shopify-Stage
X-ShopId
X-ShardId
X-Sorting-Hat-PodId
Azure-InstanceId
X-Sql-Duration-Ms
Azure-SiteName
Azure-RegionName
X-S-Maxage
X-NYM-Debug-Backend
Protected
X-Request-Time
X-Sorting-Hat-ShopId
X-Varnish-Beresp-Grace
Azure-Version
X-Sql-Count
Country-Code
X-AWS-Id
Cache-Tv-Group
Cache-Name
ServedBy
Fastly-SSL
Apigw-Requestid
X-LJ-Flow-ID
X-RCS-CacheZone
X-PCL
X-VWS-Id
X-No-Session
X-ProxyCache-Status
X-Be
X-OCL
X-Status
X-R9-Blue-Green-Version
X-ProxyCache-Key
X-Varnish-Hostname
X-Proto
X-BYPASS-REASON
X-Handled-By
X-Varnishpool
X-Pubstack
X-Origin-Date
Selected-Fe
X-PHP-Backend
TWC-Connection-Speed
X-Timing-Wait
X-UA-Device-Type
Property-Id
X-Via-Fastly
X-Tumblr-Pixel-2
X-Proxy-Build
X-PHP-Host
X-Web-Node
X-Server-W
X-Hyper-Cache
X-Labrador-Cache-Channel
X-Access
X-Akamai-Edgescape
X-Hosted-By
X-Cache-Server
X-Format
Webcakes-Region
Webcakes-App-Version
TWC-GeoIP-LatLong
Decoy-Debug-TTL
TWC-Device-Class
X-Section
TWC-Locale-Group
Webcakes-App-Name
TWC-Privacy
X-Origin-Hint
TWC-GeoIP-Country
Decoy-Debug-Key
Decoy-Debug-Status
X-PERF
X-Redis-Cache
X-Backend-Host
X-ApacheServer
X-Uri
Mn-Server-Ip
X-FB-TRIP-ID
X-Backend-Name
X-Cluster-Node
X-B3-SpanId
X-Hl-Ver
X-APP-VERSION
X-Time-Microsecs
Nel
X-Servername
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-ATG-Version
X-ServerID
OT-Force-Account-Verify
X-Ua-Device
Cross-Origin-Opener-Policy
X-Tumblr-Pixel-3
X-Detected-As
X-Cache-PHP
Xserver
X-Azure-Ref-OriginShield
X-TT-LOGID
Web-Mar-Node
X-Trace-Id
X-Varnish-Cache-Hits
X-Generation-Time
X-Content-Age
X-Cache-Host
Backend
X-CSRF-Token
X-Datadome
Cross-Origin-Window-Policy
X-WA-Info
X-Ua
X-MP-GENERATED-AT
X-Varnish-Hits
X-CS
Content-Secure-Policy
Ec-Rule-Version
X-Via-JSL
X-Soup
X-Akamai-Transformed
X-Edge-Location
X-Bc-Bl
X-SRV
Source
X-Cache-Enabled
X-Cdn
X-Amzn-Remapped-Content-Length
X-Mode
X-Origin-TTL
X-Cache-Grace
X-Rule
X-Amzn-RequestId
X-Amz-Apigw-Id
X-Origin-CC
X-Varnish-Beresp-Ttl
X-NWS-UUID-VERIFY
Upgrade-Insecure-Requests
X-Microcachable
X-Cached-By
X-Varnish-Beresp-Status
Url
X-Forwarded-Host
X-Info
X-Locale
X-GEO
SID
S-Rt
X-Air-Hostname
X-Air-Source
X-Air-Trace-Id
X-Site-Version
X-Debug-Cache
X-Storage
X-Magnolia-Registration
Content-Disposition
X-Tb
X-B3-Traceid
X-Orig-Expires
MD5-Digest
X-PAYTM-SRV-ID
X-CF-Lambda-Fn
X-PBS-Appsvrname
X-Forwarded-Path
DCR-Decision-By
User-Cache-Control
BehaviorPad-Version
DCR-Processing-Time-Ms
Apple-News-Services-Host
CDN-RequestId
CDN-RequestCountryCode
Mobile-Detection-Method
CDN-Uid
Path
CDN-PullZone
Odigeo-Trace-Id
CDN-CachedAt
CDN-Cache
CDCHOST
CDN-EdgeStorageId
X-Extlb
X-Cache-NE
Apple-News-Services-Request-Url
X-Epic-Correlation-Id
X-From
X-NAPM-TraceId
Apple-News-Services-Parsed-Url
Apple-News-Services-Handled
X-External-Request-Id
Meta-Geo-Continent
A
X-Ftr-Request-Id
X-NU-AKA-ACS-Version
X-Rewrite-Enabled
M-TraceId
X-A-Wwc
X-A-Dgt
X-D
State
Host-ID
X-Tenant
X-Destination
X-Aed
X-Aicache-OS
X-Platform-Server
Fastly-SIE
Fastly-SWR
Surrogated-Key
X-A-Dcw
X-Vtex-Processado-Em
X-A
X-Vtex-Remote-Cache
X-Connection-Hash
X-Zipkin-Id
X-Conf
X-A-Ccd
X-VG-WebServer
X-A-Dam
T-Server
X-Vdms-Version
X-Cache-NGX
X-VG-WebCache
X-AIR-PT
X-SRCache-Key
Req-Svc-Chain
X-CF-Lambda-Version
X-Rojux
X-Rebelmouse-Cache-Control
X-Routing-Service
Expiry
X-BCube-Filmed-By
X-Developer
Rendered-Blocks
X-Request-URI
Fastcgi-X-Cache-Version
X-Rebelmouse-Surrogate-Control
X-S
X-S-Cookie
X-Session-Fingerprint
X-Shop-Environment
X-Application
X-Ratelimit-Reset
X-Processor
X-B-Cookie
X-ARC
X-ScT
X-Proxied
X-Dc
X-Ratelimit-Limit
X-EC-Lua
L
X-Cms-Context
X-Core-Value
Fastly-Backend-Name
X-Date
X-Clientip
Fastly-Drupal-HTML
Cmsid
X-Envoy-Decorator-Operation
Cache-Host
X-DPWN-IS-SECURE
Is-Eu
Cmstype
X-Fastly-Backend
X-Proxy-Upstream
X-VServer
Platform
X-Variation
X-Origin-Expires
X-VG-TLSProxy
Pics-Label
X-Backend-State
X-Request-UUID
X-Accel-Expires-Debug
X-TrackingId
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Service
X-Unique-Id
UCS
X-Cache-Debug
X-Has-Esi
NGX
X-BBC-Edge-Cache-Status
Adler-Geo
Origin
X-Cache-Bucket
X-LI-UUID
X-Loc
X-Li-Pop
X-Li-Fabric
X-Is-Gdpr
X-JWT-State
X-Cache-Ttl
X-DataDome
X-DC
VNS-Age
Vix-Hermes-Req-Id
VNS-Cache
X-Cluster
X-Cache-Info
X-Block-Status
X-Bip
X-Cache-Tags
X-Clara-WADP
X-Nginx-Cache-Key
X-SIPLIST1
X-Slack-Backend
X-Thanos
X-Thinkindot-L3
X-Sigma-Backend
X-Sigma
X-Request-Host
X-Rocket-Build-Number
X-Scheme
X-Served-From
X-Var-Ttl
X-Varnish-CookieHashed-On
X-Viewer-Country
X-WADP-Cache
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Via-NSCOPI
X-VC-Cache
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
X-VarnishDD-TTL
X-Req
X-RateLimit-Remaining-Second
X-Gamma-Serve
X-Gen-Mode
X-Generated-By
X-Generated-On
X-Forwarded-Site
X-Fmm-Version
X-DefHash
X-Developers
X-Device-Os
X-Fastly-Cache
X-Geo-Header
X-GoCache-CacheStatus
X-Men
X-Old-Content-Length
X-Origin
X-RateLimit-Limit-Second
X-Location
X-Level-Front-Cache
X-Hash
X-HN
X-Hnp-Log
X-DefElseHash
X-Branch-Name
Server-Ext
Cf-Device-Type
Server-Host
Server-Hostname
Locid
CPC-Age
X-Unique-ID
Arc-Version
C-Via
Cache-Key
PB-PID
PB-RID
PFcat
Location
Sever-Int
Thinkindot-Control
Esi-Enabled
IsBot
X-Platform
True-Client-Country-4JS
Server-Info
Fastcgi-Cache-TTL
TDXMobile
DSUID
Thinkindot-CacheControl
CPC-Cache
Thinkindot-CacheControl-Type
AMP-Access-Control-Allow-Source-Origin
X-Ratelimit-Remaining
CacheControlHeader
X-Esi-Check
X-Eu-Site
X-Owner
AKAMAI
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Policy
X-Gzip
X-Planisys-CDN-TTL
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-GeoIP-City
X-GeoIP
Arc-Country
X-Fetched-On
X-Irp-Debug
X-Generated-In
Webserver
X-Tx-Id
X-FC-Vary-Parameters
L5d-Success-Class
X-Ua-Browser
X-Skip-Cache
X-Content
X-Micro-Cache
Gh-Request-Id
Release
X-Sucuri-ID
Svr
V-Age
X-Worker
We-Hiring
Wxu-Next-Commit
Wxu-Next-Region
Wxu-Next-Hostname
NM-Fastcgi-Cache
Pagetype
Mail-Subject
X-CGP
X-Cache-Id
X-Csrf-Jwt
Memcached
X-Ckpd-Fst-Backend
Ha-Gx-Prefs
HA-Ipaddr
X-Amz-Meta-S3cmd-Attrs
Kp-EeAlive
X-Mvc-Supplant-Cachable
X-HS-Content-Campaign-Id
NtCoent-Length
X-Vdms-Path
X-Qloud-Router
X-NCache
X-Auto-Login
X-M-Log
DataCenter
X-M-Reqid
X-V-Cache
X-Via-Popn
X-Via-Popv
MIME-Version
X-Servedbyhost
Cache-Hits
X-Via-Poph
X-Qnm-Cache
XServer
X-Srv
X-LSADC-Cache
X-Rocket-Nginx-Serving-Static
X-User
X-Mvc-Supplant-OutputCached
X-Platform-Router
Who
X-Render-Time
X-Platform-Cluster
X-Platform-Processor
X-Zone
X-NC
X-Traceid
X-PF-Uncompressing
X-SD-PageType
X-Cache-Remote
X-Wa
X-Varnish-Url
Environment
X-Minions-Version
X-Vc
X-Cache-Var-Map
X-Cache-Var
X-Webkit-CSP-Report-Only
X-ID
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-Datadog-Parent-Id
X-API-Version
Server-ID
X-BBC-Origin-Response-Status
X-Nyt-Route
X-Refresh
X-Origin-Time
X-App
X-Gdpr
X-LB-ID
X-PJAX-URL
X-NodeID
X-Varnish-Ttl
WebServer
Time
Powered-By-ChinaCache
Memory
My-App
Cluster
X-ZONE
X-VCL-Version
X-Pod-Name
Candidate-Md5Url
X-Webkit-Csp
X-Via-Ucdn
X-TIME
X-Pass-Why
X-Internal-Host
X-Cache-Config
X-Server-IP
X-CACHE-KEY
X-Newrelic-Synthetics
HostName
Datacenter
Resin-Trace
X-LI-Proto
X-NewRelic-App-Data
X-TX-ID
X-Esi
X-CLOUD-TRACE-CONTEXT
Web-Mar-Region
N-Cache
X-OVcl-Cache
X-OVcl
Geoip-Latitude
Hostname
Onion-Location
X-Edge-Pop
X-ElasticPress-Query
Geo-Info
GeoIp-Country-Code
X-Tb-Optimization-Total-Bytes-Saved
Cf-Bgj
X-VHOST
X-Correlation-ID
X-Backend-TTL
X-AB
X-Origin-Response-Time
Magicmarker
Servername
X-Akamai-Pragma-Client-IP
X-TraceId
Tcn
Ohc-File-Size
X-Varnish-Cacheable
X-CACHE-AGE
X-HITS
X-EIG-Tracking-Id
X-Dynatrace
WWW-Authenticate
X-Method
GeoIP-Country-Code
X-Dispatcher-Server
X-Geo
X-Fpc
DB-Nickname
Cdn
X-NODE
LB
X-Li-Proto
X-Varnish-Beresp-TTL
GeoIP-Latitude
CDN
X-MSEdge-Flight
Ssr
X-IP
Proxy-Connection
X-MSEdge-Features
X-Wix-Viewer-Type
Redirect-Candidate
X-Dynatrace-Js-Agent
X-Tid
X-TIM-N
X-Tt-Logid
Cf-Ipcountry
X-HostName
Tracecode
X-Up
X-Fastly-Backend-Reqs
CF-Cached-On
Is-Us
Pramga
Lb
X-Request-Start
X-Node-Id
X-Vcl-Version
X-Cache-Date
X-Cs
X-Cdn-Origin
Server-Id
X-HS-Status
X-Sn-Servicetimems
X-Amz-Meta-Cb-Modifiedtime
X-Trv-Group
Sid
X-COUNTRY
X-APP
X-ND-Cache
X-MG-S
X-DynaTrace-JS-Agent
X-Nc
X-Core-Mission
W
X-Provided-By
X-WA
WZWS-RAY
Env
Cteonnt-Length
X-CSRF-TOKEN
X-Webkit-Csp-Report-Only
X-NGINX-Cache
X-ServerName
X-Reqid
X-Via-CDN
X-Pjax-Url
X-UnsetCookies
X-FORWARDED-FOR
X-Check-Cacheable
X-VC
X-Cache-Expires
URI
X-Lb-Id
CloudFront-Viewer-Country
Ohc-Cache-HIT
X-SERVER-NAME
X-Fastly-Request-Id
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
X-Cache-Backend
X-Via-PopH
X-Via-PopN
WP-Super-Cache
X-Via-PopV
Rt-Fastcgi-Cache
Shield-Pop
X-Sucuri-Cache
X-SN
X-Region-Sid
Server-Ttl
X-Cache-Status-Check
X-Pf-Uncompressing
X-CCDN-Origin-Time
Mime-Version
Viewtype
X-CCDN-CacheTTL
CountryCode
X-ServedByHost
X-Hcs-Proxy-Type
VivaBuild
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Acquia-Purge-Tags
X-Acquia-Site
X-CUA
X-Cache-ASPX
X-Contensis-Viewer-Groups
X-Moov-T
X-Pad
CACHE
X-LiteSpeed-Cache-Control
X-Fastly-Cache-Hits
X-Varnish-Authentication
X-RAMCache
Xc-Version
X-Edge-POP
X-Moov-Xdn-Version
User-Agent
EpKe-Alive
X-Cdn-Request-ID
X-Ig-Push-State
Machine
Ohc-Response-Time
Xet-Cookie
Vha6-Origin
X-Action
X-Dw-Trace-Id
X-Webstats-RespID
X-Yottaa-OS
X-Swift-Error
X-SB
X-DI
X-DB
X-RSL
X-StackifyID
X-RPM
X-RPS
X-DSS
X-DW
X-Cdn-Forward
X-ElasticPress-Search
HIT
X-TH-Server
FSS-Cache
X-Amz-Meta-Opti
ServerName
Content-Script-Type
Content-Style-Type
Req-ID
X-CF-Powered-By
X-MiniProfiler-Ids