Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
CF-RAY
Cf-Request-Id
CF-Cache-Status
Accept-Ranges
Link
Pragma
ETag
X-XSS-Protection
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Xss-Protection
Access-Control-Allow-Credentials
X-Request-Id
X-AspNet-Version
X-Adblock-Key
X-Runtime
X-Request-ID
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Check
X-Cache-Status
X-Generator
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
P3p
X-FRAME-OPTIONS
X-Content-Security-Policy
X-Iinfo
Status
Content-Encoding
Feature-Policy
X-AspNetMvc-Version
X-CDN
X-Envoy-Upstream-Service-Time
Upgrade
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Access-Control-Max-Age
X-Via
Keep-Alive
Request-Context
X-Ws-Request-Id
Server-Timing
X-Robots-Tag
X-AH-Environment
X-Server
X-Ua-Compatible
X-Hacker
X-Age
X-Dns-Prefetch-Control
X-Turbo-Charged-By
X-Server-Powered-By
X-Proxy-Cache
X-Cache-Group
X-Backend
Host-Header
X-Amz-Request-Id
X-Nginx-Cache-Status
EagleId
X-Amz-Id-2
Report-To
X-LiteSpeed-Cache
X-Rq
X-UA-Device
X-Varnish-Cache
X-Page-Speed
Grace
X-Swift-CacheTime
X-Swift-SaveTime
X-Pingback
Ali-Swift-Global-Savetime
X-Device
EagleEye-TraceId
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Vhost
Cf-Railgun
NEL
X-Amz-Version-Id
X-OneAgent-JS-Injection
X-Dispatcher
X-Server-Id
X-Host
X-CST
X-Node
Allow
Surrogate-Control
X-Cache-Spec
Request-Id
X-Backend-Server
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Accept-CH
X-WebKit-CSP
X-Readtime
X-Response-Time
X-Akam-SW-Version
X-Webkit-CSP
Xkey
X-HW
X-Country
X-Ac
X-Application-Context
Content-Location
Accept-Ch-Lifetime
X-Language
X-Ruxit-JS-Agent
MS-Author-Via
X-Template
X-Cloud-Trace-Context
Rating
X-Cache-Lookup
X-Url
X-Mod-Pagespeed
X-B3-TraceId
Edge-Control
X-PC
X-Vname
X-TtlSet
X-Clacks-Overhead
X-ESI
X-MS-InvokeApp
X-Trace
Accept-CH-Lifetime
X-GitHub-Request-Id
X-Content-Type
Fastly-Restarts
X-ASPNET-VERSION
X-Cnection
X-Varnish-TTL
X-Origin-Cache
X-Rack-Cache
X-FastCGI-Cache
X-D2id
X-Kinja-Server
X-Kinja
X-Kinja-Revision
X-Use-Magma
X-GoogleNews-Bot
X-Exp-Variant
X-Cdn-Fetch
X-Exp-Id
X-Country-Code
X-Kinja-Build
X-VARITI-CCR
Verso
Arr-Disable-Session-Affinity
X-Goog-Hash
X-Server-Name
X-Vcap-Request-Id
X-Cached
X-Navigation-Version
Cache-Tag
X-Buckets
X-Client-IP
X-Amz-Rid
X-Powered-By-Plesk
X-Abt-Application-Version
Service-Worker-Allowed
Accept-Ch
X-ORACLE-DMS-ECID
X-Ttl
RTSS
X-Cache-TTL
X-Fastly-Request-ID
Display
X-Middleton-Display
Pagespeed
Response
X-Sol
X-Middleton-Response
Access-Control-Request-Method
X-MSEdge-Ref
X-Element-Page-Cache
X-Powered-CMS
X-NF-Request-ID
Public-Key-Pins
X-Dw-Request-Base-Id
X-Upstream
X-SRCache-Fetch-Status
X-Version
X-SRCache-Store-Status
X-Px
X-Edge
S
X-Kinsta-Cache
X-Edge-Location-Klb
X-LLID
X-B3-TraceId-Primal
Mrf-Cache-Status
Realpath
MRF-Tech
X-Oneagent-Js-Injection
X-Accel-Expires
X-Server-ID
SPRequestDuration
SPIisLatency
SPRequestGuid
X-SharePointHealthScore
X-HP-Webp
X-Jurisdiction
X-T
X-Mid
X-MCACHE
X-PressLabs-Stats
X-ECACHE
X-TTL
X-Forwarded-Proto
X-Content-Security-Policy-Report-Only
X-Kraken-Loop-Name
X-Kraken-Routeconfig-Destination
X-Instrumentation
X-Server-Lifecycle-Phase
X-Shield-Request-Id
X-DynaTrace
X-Ruxit-Js-Agent
Pinterest-Generated-By
Pinterest-Version
X-Recruiting
Charset
Edge-Cache-Tag
X-Pinterest-Rid
Fastcgi-Cache
X-Cache-Key
TP-Cache
X-Correlation-Id
TP-L2-Cache
X-Amz-Server-Side-Encryption
X-Mg-S
X-Content-Digest
X-Ezoic-Cdn
X-Release
Nginx-Cache
X-Request-Processing-Time
Filters
X-Id
X-Request-Received
X-ORACLE-DMS-RID
TCN
Front-End-Https
X-Logged-In
Server-Node
Alternate-Protocol
Cache-Tags
X-Forwarded-For
Content-MD5
X-Litespeed-Cache
X-XRDS-Location
X-Origin-Upstream-Status
Fusion-Component-Id
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Content-Id
Fusion-Content-Source
Fusion-Source
X-Amzn-Trace-Id
Server-Name
X-Geo-Country
X-Origin-Server
X-Grace
X-Hostname
X-Protected-By
Cleartype
X-Contextid
X-Amz-Replication-Status
X-F-Cache
X-Www-Served-By
X-Rid
X-Az
Host
X-AppVersion
X-Activity-Id
X-WebKit-CSP-Report-Only
X-Goog-Metageneration
X-GUploader-UploadID
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Generation
X-HS-Content-Id
X-HS-Cache-Config
X-HS-Hub-Id
X-HS-Combine-CSS
X-RateLimit-Remaining
X-Debug-Info
X-Frontend
Section-Io-Cache
X-LB-Cache
MicrosoftSharePointTeamServices
X-Browser-Type
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-NWS-LOG-UUID
X-Ser
X-Git-Hash
X-Aspnetmvc-Version
X-Page-Id
X-Cache-Age
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-XRDS-LOCATION
X-Respond-Thread
X-Source
X-Upgrade-Enabled
AR-ATIME
AR-PoweredBy
X-VCache
Ar-Sid
Accept-Charset
AR-CACHE
AR-Request-ID
X-Content-Options
X-Varnish-Age
X-DIS-Request-ID
X-Hits
Paypal-Debug-Id
X-Mobile-URL
X-Daa-Tunnel
X-Varnish-Backend
ServerID
Access-Control-Allow-Method
X-CACHE-GROUP
X-Varnish-Grace
X-Signature
X-B-Cache
X-Kong-Upstream-Latency
Viewport
X-Kong-Proxy-Latency
X-Cache-Action
X-Flags
X-Route-Name
X-Aspnet-Duration-Ms
X-Is-Crawler
X-FB-Debug
Payment
X-Providence-Cookie
X-Request-Guid
Healthy
X-Whom
X-TT
X-B3-Sampled
Node
X-AOL-HN
X-App-Environment
X-N
Version
X-Seen-By
X-Request-Handler-Origin-Region
X-Microsite
X-Type
DynaTrace
X-Load-Cache
Fastcgi-Useragent
X-Mobile
DC
X-Fastcgi-Cache
MS-CV
X-Yandex-Sdch-Disable
X-HTML-Minification-Powered-By
X-Ab
X-Cache-Expired-At
X-Distributor
Retry-After
SRV
Filterid
X-Cache-Control
X-Tt-Trace-Host
X-Tt-Trace-Tag
X-IPLB-Instance
Frame-Options
X-User-Agent
X-Response-Served-From
X-Original-Request-Id
X-UUID
X-Instance
X-Real-IP
X-Tumblr-Pixel
X-RemovedCookies
X-IPS-LoggedIn
X-Jobs
X-Varnish-Server
X-ProcessESI
X-Tumblr-User
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Cluster-Name
X-Proxy
X-RTag
X-Proxy-Cache-Status
X-Region
X-Device-Type
X-Debug-IsPreview
X-Adobe-Content
X-Adobe-Loc
X-Content-Powered-By
X-Debug-IsConnected
Ms-Operation-Id
Access-Control-Request-Headers
X-B
VIX-Pulpo-Node
Refresh
X-Page-View
Uber-Trace-Id
X-Cacheable-TTL
X-Cache-Time
NGB
VIX-Pulpo-Upstream-Status
X-Framework
X-G
X-FireWall-Port
X-Debug
X-Accel-Buffering
Cache
X-FW-Serve
X-FW-Hash
X-Zen-Fury
X-Vgn-Hpd-Reason
X-FW-Dynamic
X-FW-Server
X-FW-Type
X-FW-Static
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Io-Id
X-Wix-Request-Id
Countrycode
Section-Origin-Responded
X-Mg-Request-UUID
X-Oracle-Dms-Rid
X-RateLimit-Limit
X-NGENIX-Cache
X-Nginx-Cache
X-Azure-Ref
Cache-Status
X-Time
X-App-Version
Surrogate-Key
X-Rendered-As
X-CDN-Forward
X-Is-Bot
Country
X-Cache-Hit
X-Ms-Request-Id
X-Ms-Version
X-Drupal-Cache-Tags
X-Cache-Rule
S-Cnection
X-Node-Name
X-EdgeConnect-Cache-Status
X-App-Server
SD-X-WS
Eomportal-Instance
Referer-Policy
Amp-Access-Control-Allow-Source-Origin
Liferay-Portal
X-TA-CDN-Provider
X-L-Path
X-Environment-Context
X-Cache-Operation
X-Drupal-Cache-Contexts
Selected-Fe
X-Yottaa-Optimizations
From-Origin
Meta-Geo
X-Yottaa-Metrics
X-ES-SERVER
X-Tumblr-Pixel-2
X-Varnishpool
X-UPSTREAM-Address
X-SaId
X-RN-RSRV
X-JoinUs
X-Proxy-Build
X-Timing-Wait
X-Request-Time
X-Pubstack
X-R9-Blue-Green-Version
X-ShopId
X-Storefront-Renderer-Rendered
X-TNCMS
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-PHP-Backend
X-Shopify-Stage
X-S-Maxage
X-Xfnlog-Site
X-Endurance-Cache-Level
X-GG-Cache-Date
X-Cache-Server
X-Backend-Host
Protected
X-Alternate-Cache-Key
X-Handled-By
X-Cache-TTL-Remaining
ServedBy
X-Loop
X-Via-Fastly
X-Varnish-Beresp-Grace
X-Varnish-Hostname
X-No-Session
X-ShardId
CF-IPCountry
Webcakes-App-Name
TWC-Privacy
TWC-GeoIP-LatLong
Webcakes-App-Version
TWC-Locale-Group
X-Adobe-Source
X-Human
X-Be
X-AWS-Id
Azure-InstanceId
Webcakes-Region
Azure-RegionName
TWC-Device-Class
Fastly-SSL
TWC-Connection-Speed
Property-Id
TWC-GeoIP-Country
Cache-Tv-Group
Azure-SiteName
Azure-SlotName
Azure-Version
Cache-Name
X-LAGOON
X-BYPASS-REASON
X-Proto
X-PCL
X-ProxyCache-Key
X-LJ-Flow-ID
X-VWS-Id
X-Server-W
X-Origin-Hint
X-ProxyCache-Status
X-NYM-Debug-Backend
X-OCL
X-Section
X-SayCDN-TTL
X-Say-TTL
X-Origin-Date
Nel
Country-Code
Decoy-Debug-Status
Decoy-Debug-Key
X-RCS-CacheZone
Decoy-Debug-TTL
X-Say-Cacheable
X-Access
X-Backend-Name
Apigw-Requestid
X-Format
X-Hl-Ver
Akamai-GRN
X-Akamai-Edgescape
X-UA-Device-Type
X-ApacheServer
X-Labrador-Cache-Channel
X-PERF
Mn-Server-Ip
X-PHP-Host
X-Sql-Count
X-Sql-Duration-Ms
X-Status
X-FB-TRIP-ID
X-Revision
X-Uri
X-Cache-PHP
Xserver
X-Hosted-By
X-Hyper-Cache
X-Redis-Cache
X-Rule
X-Cache-Type
X-Web-Node
X-Ua-Device
X-Trace-Id
X-Aws-Lambda-Call-Status
X-ATG-Version
X-WA-Info
X-MP-GENERATED-AT
X-FW-Version
AMP-Access-Control-Allow-Source-Origin
X-B3-SpanId
X-Content-Age
X-Time-Microsecs
X-ServerID
X-CSRF-Token
X-Tumblr-Pixel-3
X-Dc
X-Parallel-Accel
X-Soup
X-Cached-By
X-Akamai-Transformed
Backend
X-Cache-Enabled
Count-Hit
X-Varnish-Ttl
GEO-INFO
X-Edge-Location
X-Detected-As
X-Cluster-Node
X-Datadome
X-TT-LOGID
OT-Force-Account-Verify
X-Mode
X-Varnish-Cache-Hits
X-Azure-Ref-OriginShield
X-APP-VERSION
X-Info
X-Cache-Host
X-Microcachable
X-Bc-Bl
X-Varnish-Beresp-Status
X-CS
X-Generation-Time
Web-Mar-Node
X-Varnish-Hits
Cross-Origin-Opener-Policy
X-Servername
X-Cache-NGX
X-Amzn-RequestId
X-Debug-Cache
X-Amzn-Remapped-Content-Length
X-Amz-Apigw-Id
DataCenter
X-Zipkin-Id
X-Platform
X-Proxied
X-Storage
X-Routing-Service
X-SRV
X-HP-Trace-Id
Who
X-Unique-ID
X-Extlb
X-B3-Traceid
SID
X-DataDome
X-Varnish-Beresp-Ttl
X-Origin-CC
X-Origin-TTL
CDN-EdgeStorageId
X-Generated-On
BehaviorPad-Version
X-Request-URI
X-Rewrite-Enabled
X-Geo-Header
Apple-News-Services-Parsed-Url
Cache-Host
CDN-CachedAt
Apple-News-Services-Request-Url
CDCHOST
A
Apple-News-Services-Host
X-Processor
X-Ratelimit-Reset
CDN-Cache
Apple-News-Services-Handled
X-Core-Value
X-ARC
Odigeo-Trace-Id
X-Application
X-Location
X-Aicache-OS
Mobile-Detection-Method
Meta-Geo-Continent
M-TraceId
X-BCube-Filmed-By
X-NAPM-TraceId
X-B-Cookie
MD5-Digest
X-Locale
X-Aed
Req-Svc-Chain
X-A
State
Surrogated-Key
T-Server
X-A-Ccd
X-A-Dam
Rendered-Blocks
X-A-Wwc
X-A-Dgt
X-A-Dcw
Host-ID
X-Bip
Content-Disposition
X-Developer
X-PBS-Appsvrname
X-PAYTM-SRV-ID
DCR-Decision-By
X-Epic-Correlation-Id
X-External-Request-Id
CDN-PullZone
CDN-RequestCountryCode
CDN-RequestId
CDN-Uid
X-Destination
X-D
Fastcgi-X-Cache-Version
X-CF-Lambda-Fn
X-Cache-NE
Fastly-Backend-Name
X-Cache-Bucket
X-CF-Lambda-Version
Expiry
X-Level-Front-Cache
DCR-Processing-Time-Ms
X-Connection-Hash
X-Cms-Context
X-From
X-Magnolia-Registration
X-ScT
X-Vtex-Remote-Cache
X-Vdms-Path
X-VG-WebCache
X-VG-WebServer
X-Vdms-Version
X-Session-Fingerprint
X-Service
X-Thanos
X-SRCache-Key
X-S
X-S-Cookie
X-Air-Trace-Id
Server-Info
X-Air-Source
X-Air-Hostname
X-Rojux
X-Vtex-Processado-Em
Upgrade-Insecure-Requests
X-Ua
S-Rt
Fastly-SWR
X-Origin
X-Cache-Debug
X-Branch-Name
X-Clientip
Gh-Request-Id
X-EC-Lua
Fastcgi-Cache-TTL
Esi-Enabled
X-NWS-UUID-VERIFY
X-Hash
X-Has-Esi
Fastly-Drupal-HTML
X-Gamma-Serve
Fastly-SIE
X-HN
Pagetype
Origin
X-Var-Ttl
PFcat
X-Is-Gdpr
Server-Host
UCS
X-JWT-State
X-Rocket-Build-Number
X-TrackingId
X-NU-AKA-ACS-Version
X-Backend-State
L
Location
Cmsid
Memcached
X-Sucuri-ID
Kp-EeAlive
Cmstype
X-VG-TLSProxy
X-Envoy-Decorator-Operation
X-Rebelmouse-Cache-Control
X-Platform-Server
X-GoCache-CacheStatus
X-Served-From
X-Proxy-Upstream
X-Sigma-Backend
AKAMAI
X-VHOST
X-Cache-Grace
X-Developers
CacheControlHeader
Source
X-VarnishDD-TTL
X-Request-UUID
X-Sigma
Path
X-Scheme
X-Rebelmouse-Surrogate-Control
X-Via-JSL
Cross-Origin-Window-Policy
X-AIR-PT
X-Tb
User-Cache-Control
Url
Wxu-Next-Commit
Vix-Hermes-Req-Id
X-Generated-In
X-Csrf-Jwt
X-Date
Wxu-Next-Region
Wxu-Next-Hostname
X-VC-Cache
X-Generated-By
Svr
X-Varnish-Url
X-Li-Fabric
True-Client-Country-4JS
X-Clara-WADP
NtCoent-Length
X-CGP
X-DPWN-IS-SECURE
X-Cache-Tags
X-Cache-Info
Content-Secure-Policy
X-Shop-Environment
X-Fastly-Cache
X-Cluster
X-Eu-Site
X-Fastly-Backend
X-Thinkindot-L3
X-Accel-Expires-Debug
X-Variation
X-Forwarded-Site
X-Orig-Expires
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Fmm-Version
X-Forwarded-Path
X-Men
C-Via
Is-Eu
Thinkindot-CacheControl
HA-Ipaddr
X-Ratelimit-Limit
L5d-Success-Class
Adler-Geo
Arc-Country
Arc-Version
X-Site-Version
Ha-Gx-Prefs
X-WADP-Cache
Cf-Device-Type
DSUID
NGX
TDXMobile
Ec-Rule-Version
X-Li-Pop
X-Origin-Expires
X-Owner
Thinkindot-Control
Thinkindot-CacheControl-Type
X-Policy
PB-PID
X-Loc
X-Amz-Meta-S3cmd-Attrs
PB-RID
X-Req
Platform
Pics-Label
X-Device-Os
X-Tenant
NM-Fastcgi-Cache
X-LI-UUID
X-Minions-Version
X-Micro-Cache
X-Forwarded-Host
X-Request-Host
X-Slack-Backend
X-DefHash
X-Gen-Mode
X-DefElseHash
X-Goog-Meta-Goog-Reserved-File-Mtime
X-RateLimit-Limit-Second
X-Esi-Check
X-Gzip
X-SIPLIST1
X-Wikidot-Static-Cache
Cache-Key
X-Qloud-Router
X-FC-Vary-Parameters
X-RateLimit-Remaining-Second
X-Old-Content-Length
X-Fetched-On
We-Hiring
X-Skip-Cache
X-Varnish-CookieHashed-On
Mail-Subject
X-Hnp-Log
X-Irp-Debug
X-Viewer-Country
X-GeoIP-City
X-Nginx-Cache-Key
X-GeoIP
V-Age
X-Mvc-Supplant-Cachable
Locid
Server-Hostname
Sever-Int
Server-Ext
Release
X-PF-Uncompressing
X-Cache-Id
X-Block-Status
X-Varnish-Remaining-TTL
X-Varnish-CookieINHashed-On
X-User
X-VServer
IsBot
X-Wikidot-Backend
Webserver
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-TEC-API-VERSION
CPC-Cache
X-CACHE-KEY
X-Via-NSCOPI
VNS-Age
X-Unique-Id
X-Srv
My-App
Powered-By-ChinaCache
X-HS-Content-Campaign-Id
X-TX-ID
CPC-Age
X-Planisys-CDN-Rules
VNS-Cache
Cache-Hits
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
X-Ftr-Request-Id
X-Zone
X-Via-Popn
X-Via-Poph
X-Via-Popv
X-Ratelimit-Remaining
X-Vc
X-Refresh
X-Conf
X-Mvc-Supplant-OutputCached
X-GEO
X-Pass-Why
MIME-Version
X-Cache-Ttl
X-BBC-Edge-Cache-Status
X-PJAX-URL
XServer
X-Worker
X-NC
X-Ckpd-Fst-Backend
X-TIME
X-Internal-Host
Geo-Info
X-ID
X-OVcl-Cache
X-LB-ID
X-Servedbyhost
X-Auto-Login
X-OVcl
Time
Memory
WebServer
X-TraceId
X-NCache
X-LSADC-Cache
Cf-Bgj
X-V-Cache
X-Backend-TTL
X-Render-Time
X-Rocket-Nginx-Serving-Static
X-Webkit-Csp
X-DC
X-Correlation-ID
Server-ID
Magicmarker
DB-Nickname
X-ZONE
X-NewRelic-App-Data
X-Traceid
X-Qnm-Cache
X-Platform-Processor
X-M-Reqid
X-Platform-Router
GeoIp-Country-Code
X-M-Log
HostName
X-Cache-Remote
Geoip-Latitude
X-Platform-Cluster
X-Newrelic-Synthetics
X-Geo
X-SD-PageType
X-Dispatcher-Server
X-Wa
X-App
X-Method
X-Tx-Id
Hostname
X-Datadog-Sampling-Priority
X-CLOUD-TRACE-CONTEXT
X-Datadog-Parent-Id
Environment
X-Datadog-Trace-Id
X-BBC-Origin-Response-Status
Resin-Trace
Ssr
X-IP
X-Tb-Optimization-Total-Bytes-Saved
X-Cache-Config
X-Nyt-Route
X-Origin-Time
X-API-Version
X-Gdpr
X-NodeID
X-Via-Ucdn
Cluster
X-Pod-Name
X-Edge-Pop
X-Server-IP
X-VCL-Version
X-Li-Proto
Ohc-File-Size
Tcn
X-MSEdge-Features
X-Dynatrace
X-MSEdge-Flight
X-Origin-Response-Time
X-CACHE-AGE
X-Webkit-CSP-Report-Only
LB
Candidate-Md5Url
X-HITS
X-Cache-Var-Map
X-Varnish-Beresp-TTL
X-HOST
X-DynaTrace-JS-Agent
X-Cache-Var
X-ElasticPress-Query
X-LI-Proto
X-Trv-Group
X-Vcl-Version
X-Nc
Cf-Ipcountry
X-Node-Id
X-Via-CDN
N-Cache
Web-Mar-Region
X-Akamai-Pragma-Client-IP
Datacenter
X-APP
Env
X-ND-Cache
X-Wix-Viewer-Type
X-ServerName
X-HostName
X-Fastly-Request-Id
X-Reqid
X-WA
Proxy-Connection
X-Cs
CDN
GeoIP-Latitude
GeoIP-Country-Code
Server-Id
X-HS-Status
Onion-Location
X-Content
CF-Cached-On
X-Ua-Browser
X-Cdn-Forward
X-Dynatrace-Js-Agent
X-Varnish-Cacheable
WWW-Authenticate
Servername
Cdn
X-EIG-Tracking-Id
Sid
X-Fastly-Backend-Reqs
Viewtype
VivaBuild
X-AB
Rt-Fastcgi-Cache
X-MG-S
X-NGINX-Cache
X-FTR-Request-ID
WZWS-RAY
Machine
X-Lb-Id
X-ServedByHost
X-Check-Cacheable
X-URL
X-Xrds-Location
X-Esi
Ohc-Cache-HIT
X-CSRF-TOKEN
On-Server
X-Via-PopV
Cteonnt-Length
X-Via-PopN
FSS-Cache
X-Fpc
X-IN-APIGATEWAY
X-IN-APIGATEWAYSSL
Server-Ttl
X-Pjax-Url
X-TIM-N
X-Tid
X-VC
X-Request-Start
Redirect-Candidate
X-Cache-Backend
X-Via-PopH
Mime-Version
X-ECache
Lb
Shield-Pop
X-Up
URI
X-SN
CountryCode
X-Swa-Ws
X-Tt-Logid
Xc-Version
X-Contensis-Viewer-Groups
X-FTR-Realm
X-Varnish-Authentication
X-FTR-Balancer
CACHE
X-FTR-Backend-Server
X-Pad
X-Country-Code-Real
X-FORWARDED-FOR
X-Oss-Object-Type
X-FTR-Backend
X-Cache-ASPX
Tracecode
X-Oss-Server-Time
X-Oss-Request-Id
X-FTR-DC
X-Cache-Date
Is-Us
X-Air-Pt
X-Amz-Meta-Cb-Modifiedtime
Pramga
X-Oss-Storage-Class
X-Oss-Hash-Crc64ecma
X-Swift-Error
X-FTR-Cache-Status
X-StackifyID
X-RSL
X-DSS
X-RPS
X-DI
X-DW
X-DB
X-RPM
X-Action
WP-Super-Cache
X-Sn-Servicetimems
X-Acquia-Application-Trace
X-Cdn-Origin
X-Pf-Uncompressing
X-Acquia-Application-UUID
X-Yottaa-OS
X-Acquia-Site
X-Acquia-Purge-Tags
X-LiteSpeed-Cache-Control
X-SB
X-Fastly-Cache-Hits
Ohc-Response-Time
ServerName
Warning
Xet-Cookie
X-Webstats-RespID
X-Dw-Trace-Id
X-ElasticPress-Search
Vha6-Origin
X-B3-Spanid
X-CCM
Content-Style-Type
PICS-Label
Content-Script-Type
X-Core-Mission
X-FPC
X-RAMCache
CloudFront-Viewer-Country
X-FTR-Expires
X-CCDN-CacheTTL
X-Hcs-Proxy-Type
X-Mg-Request-Id
X-Snapshot-Date
X-C
X-TH-Server
X-CUA
X-CCDN-Origin-Time
X-MiniProfiler-Ids