Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-UA-Compatible
X-Xss-Protection
CF-Ray
X-Served-By
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-Envoy-Upstream-Service-Time
X-FRAME-OPTIONS
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-Dns-Prefetch-Control
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Server-Timing
Content-Encoding
Access-Control-Expose-Headers
X-XSS-PROTECTION
Status
X-CDN
Upgrade
X-Request-ID
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Amz-Id-2
Request-Context
X-Via
X-Turbo-Charged-By
X-Backend
X-Cache-Group
X-AH-Environment
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-Hacker
X-UA-Device
X-Proxy-Cache
X-Vhost
X-Server
X-Rq
X-Server-Powered-By
Allow
X-Ws-Request-Id
X-Age
X-Varnish-Cache
X-Dispatcher
EagleId
X-Amz-Version-Id
X-LiteSpeed-Cache
P3p
Nel
Grace
Cf-Apo-Via
X-Page-Speed
Cf-Railgun
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Device
EagleEye-TraceId
X-Aws-Lambda-Call-Status
X-Swift-SaveTime
X-Swift-CacheTime
X-OneAgent-JS-Injection
Ali-Swift-Global-Savetime
X-Pingback
X-Host
X-Node
Accept-CH
X-CST
X-WebKit-CSP
X-Cache-Lookup
X-Backend-Server
Surrogate-Control
X-Server-Id
X-Readtime
Permissions-Policy
X-Nginx-Cache-Status
X-Nginx-Upstream-Cache-Status
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Akam-SW-Version
Request-Id
X-Application-Context
Accept-CH-Lifetime
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
X-Response-Time
X-Ua-Compatible
X-HW
X-Trace
Xkey
X-Edge
Content-Location
X-Clacks-Overhead
X-Ruxit-JS-Agent
X-Mod-Pagespeed
Rating
X-ESI
X-Midtier
X-Amz-Server-Side-Encryption
X-ECACHE
X-Url
X-Mcache
Accept-Ch-Lifetime
X-Country
Cache-Tag
X-Upstream
X-MS-InvokeApp
X-Vcap-Request-Id
X-Rack-Cache
X-D2id
X-Powered-By-Plesk
Verso
X-Kinja-Build
X-Kinja-Revision
X-Kinja-Server
X-Exp-Variant
X-Kinja
X-Exp-Id
X-GoogleNews-Bot
X-Cdn-Fetch
X-Use-Magma
X-Element-Page-Cache
Accept-Ch
Edge-Control
X-Vname
X-PC
X-TtlSet
RTSS
X-Oneagent-Js-Injection
X-Ruxit-Js-Agent
Service-Worker-Allowed
X-Ac
X-Webkit-CSP
X-Country-Code
Origin-Trial
X-VARITI-CCR
Fastly-Restarts
X-Goog-Hash
X-Navigation-Version
X-Abt-Application-Version
X-Cache-TTL
X-WebKit-CSP-Report-Only
X-GitHub-Request-Id
X-Varnish-TTL
X-Cached
X-Browser-Type
X-Amz-Rid
X-Litespeed-Cache
X-Aspnetmvc-Version
Pagespeed
Cross-Origin-Opener-Policy
X-Middleton-Display
X-Sol
Display
X-Kinja-CCPA
X-Dw-Request-Base-Id
X-Server-Name
X-SharePointHealthScore
SPRequestGuid
X-Amzn-Trace-Id
X-NWS-LOG-UUID
X-Content-Type
X-ORACLE-DMS-RID
X-ORACLE-DMS-ECID
X-Powered-CMS
SPIisLatency
SPRequestDuration
X-Mg-S
X-Server-Lifecycle-Phase
AR-PoweredBy
AR-ATIME
X-Instrumentation
AR-SID
AR-Request-ID
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Kraken-Loop-Name
X-Cache-Key
X-Ttl
X-Times
Arr-Disable-Session-Affinity
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
X-Middleton-Response
Response
X-Fastly-Request-ID
X-Client-IP
X-Version
X-B3-TraceId
X-Cnection
X-Jurisdiction
X-B3-Traceid
X-HP-Trace-Id
X-HP-Webp
AR-CACHE
X-FastCGI-Cache
X-Accel-Expires
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-T
Cache-Tags
Nginx-Cache
X-Ser
X-Server-ID
Cache-Status
Edge-Cache-Tag
Front-End-Https
X-MSEdge-Ref
X-Hits
X-Px
X-NF-Request-ID
Public-Key-Pins
X-Recruiting
Payment
X-LLID
X-Request-Processing-Time
X-Frontend
MRF-Tech
X-B3-TraceId-Primal
Mrf-Cache-Status
X-RateLimit-Remaining
X-Request-Received
Server-Node
X-Ua-Browser
S
X-Shield-Request-Id
X-GUploader-UploadID
X-TTL
X-Goog-Metageneration
Content-MD5
X-DIS-Request-ID
X-RateLimit-Limit
X-PressLabs-Stats
MicrosoftSharePointTeamServices
Access-Control-Request-Method
TP-Cache
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Content-Digest
X-Ratelimit-Remaining
X-Daa-Tunnel
X-Protected-By
X-HS-Hub-Id
X-HS-Combine-CSS
X-HS-Cache-Config
Realpath
X-HS-Content-Id
X-Request-Handler-Origin-Region
X-Microsite
X-Distributor
X-Fastcgi-Cache
Fastcgi-Cache
X-LB-Cache
X-FB-Debug
Access-Control-Allow-Method
X-Forwarded-For
X-Page-Id
Accept-Charset
X-Rid
X-Cluster-Name
X-Erf-Stays-Pdp-Viaduct-Migration-Web
TP-L2-Cache
X-Hostname
X-Geo-Country
X-B3-Sampled
X-Ratelimit-Limit
X-Webkit-CSP-Report-Only
X-Ezoic-Cdn
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Seen-By
X-Aspnet-Version
X-Ua-Device
Cross-Origin-Resource-Policy
Count-Hit
Cleartype
X-Newrelic-App-Data
TCN
Referer-Policy
X-Mobile
DC
X-App-Server
X-Correlation-Id
X-Content-Options
X-Varnish-Backend
X-Logged-In
X-Edge-Location-Klb
X-Kinsta-Cache
X-Origin-Cache
X-Hosted-By
X-Git-Hash
X-Contextid
X-Debug-Info
X-Aspnet-Duration-Ms
X-Is-Crawler
X-Fb-Rlafr
X-Envoy-Decorator-Operation
X-Flags
X-Amz-Replication-Status
X-Route-Name
X-Request-Guid
X-Providence-Cookie
X-Revision
X-IPS-LoggedIn
X-Grace
Surrogate-Key
X-TT
X-App-Environment
X-Varnish-Grace
Frame-Options
X-Id
X-Amz-Meta-S3cmd-Attrs
X-Xrds-Location
X-Forwarded-Proto
Retry-After
X-Azure-Ref
X-F-Cache
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
Section-Io-Cache
X-Wix-Request-Id
X-Origin-Server
X-Magnolia-Registration
X-Whom
Healthy
Alternate-Protocol
Charset
X-Akamai-Edgescape
MS-Author-Via
Viewport
X-Proxy-Cache-Info
X-App-Version
X-RateLimit-Reset
X-Nf-Request-Id
X-Backend-Name
X-COUNTRY
X-Www-Served-By
WPO-Cache-Message
WPO-Cache-Status
X-Language
Paypal-Debug-Id
X-B
X-Az
X-Activity-Id
X-AppVersion
X-Webkit-Csp
SRV
X-Varnish-Server
X-DataDome
X-Cache-Rule
VIX-Pulpo-Upstream-Status
X-Response-Served-From
X-Http-Reason
Host
VIX-Pulpo-Node
Filterid
SD-X-WS
X-Original-Request-Id
X-Cache-Grace
Akamai-GRN
Server-Name
X-UUID
X-Datadog-Trace-Id
X-Datadog-Parent-Id
Country
X-Instance
X-User-Agent
X-Akamai-Request-ID2
X-Datadog-Sampling-Priority
Front
X-Rule
X-Edge-Location
ServerID
X-L-Path
X-Status
Protected
X-Jobs
Amp-Access-Control-Allow-Source-Origin
X-N
X-Cacheable-TTL
X-Unique-Id
X-Time
X-Environment-Context
X-EdgeConnect-Cache-Status
X-ARC
From-Origin
X-Page-View
X-Varnish-Age
X-Region
X-FW-Version
X-Load-Cache
X-Is-Bot
X-FW-Type
X-Rendered-As
X-Adobe-Loc
X-Adobe-Content
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Tumblr-User
X-Tumblr-Pixel-1
X-Rocket-Nginx-Serving-Static
Fastly-SWR
X-FW-Hash
X-FW-Serve
X-FW-Dynamic
X-FW-Static
Fastly-SIE
X-Framework
X-FW-Server
X-Cache-Time
X-Kong-Upstream-Latency
X-G
X-Tec-Api-Origin
X-Tec-Api-Root
X-RemovedCookies
X-Tec-Api-Version
X-Trace-Id
X-Type
X-ProcessESI
X-Vcache
X-Kong-Proxy-Latency
Access-Control-Request-Headers
X-Client-Ip
X-Proxy
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Datadog-Sampled
X-Mg-Request-UUID
Content-Disposition
X-Debug-IsPreview
X-Debug-IsConnected
X-B-Cache
X-Cache-Age
X-Cache-Control
X-Signature
X-Amzn-Remapped-Content-Length
X-CDN-Forward
X-XRDS-Location
X-ECache
X-URL
Backend
Refresh
Countrycode
X-Drupal-Cache-Tags
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Accept-Language
X-DynaTrace
Xet-Cookie
X-Source
X-Nginx-Cache
X-Erf-Web-Scheduler
CF-IPCountry
X-Servername
X-Httpd
X-HTML-Minification-Powered-By
Webserver
Url
X-Tt-Trace-Tag
X-Generated-By
X-DynaTrace-JS-Agent
X-Tt-Trace-Host
X-Mode
Version
X-Device-Type
X-NYM-Debug-Backend
Xserver
X-Template
X-Storage
X-Content-Powered-By
X-Content-Age
GEO-INFO
X-UPSTREAM-Address
X-GeoCountry
Locale
S-Rt
Meta-Geo
X-JoinUs
Onion-Location
Load-Balancing
OT-Force-Account-Verify
X-Director
X-Cache-Operation
X-Urbn-Site-Id
X-LAGOON
Filters
X-Urbn-Context-Path
X-Cache-Action
X-GeoCode
X-ServerID
X-Rn-Rsrv
X-SaId
X-Rewrite-Enabled
X-Varnish-Hostname
X-Forwarded-Host
X-Varnish-Cache-Hits
X-Say-Cacheable
X-Cluster-Node
X-Soup
X-Say-TTL
X-SayCDN-TTL
X-Container-Uri
X-Generation-Time
X-Git-Commit
X-Tt-Logid
Azure-InstanceId
X-RM-Cache-TTL
X-Sql-Count
X-Labrador-Cache-Channel
X-Cache-Server
Azure-RegionName
Azure-SiteName
X-Ms-Version
X-Ms-Request-Id
X-PHP-Host
X-Proto
Azure-SlotName
Azure-Version
X-Detected-As
X-Adobe-Source
X-Sql-Duration-Ms
X-VCT
X-Tb
X-Served-From
X-VC-Cache
X-Lambda-Id
X-Format
X-RCS-CacheZone
X-CCDN-CacheTTL
X-Proxied
DB-Nickname
X-Logging-Id
Mn-Server-Ip
X-Skip-Cache
X-Zipkin-Id
Web-Mar-Node
X-R9-Blue-Green-Version
X-XRDS-LOCATION
X-Extlb
X-FB-TRIP-ID
X-Routing-Service
X-Loop
Node
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-Tumblr-Pixel-2
X-Tumblr-Pixel-3
X-Tncms
X-Debug
X-Origin-Hint
Webcakes-Region
Uber-Trace-Id
X-Uri
Webcakes-App-Name
Property-Id
X-Timing-Wait
Selected-Fe
TWC-Privacy
Webcakes-App-Version
X-Fetched-On
TWC-GeoIP-Country
TWC-Device-Class
X-Proxy-Build
TWC-Connection-Speed
TWC-GeoIP-LatLong
TWC-Locale-Group
Fastcgi-Useragent
X-MCACHE
X-Cache-Hit
Cross-Origin-Window-Policy
X-LSADC-Cache
X-Zen-Fury
Source
X-Endurance-Cache-Level
X-Srv
X-Ua
X-Ratelimit-Reset
X-Sucuri-ID
X-Sucuri-Cache
X-B3-SpanId
X-Redis-Cache
X-Drupal-Cache-Contexts
X-Upgrade-Enabled
CDN-RequestId
Section-Io-Origin-Time-Seconds
Section-Io-Id
Section-Origin-Responded
Section-Io-Origin-Status
X-Oracle-Dms-Rid
X-Oracle-Dms-Ecid
X-MP-GENERATED-AT
X-Origin-Date
X-Newrelic-Synthetics
X-NGENIX-Cache
X-Varnish-Hits
Liferay-Portal
X-S
Fastly-Drupal-HTML
X-Cache-Expired-At
X-TimeS
X-Pass-Why
Upgrade-Insecure-Requests
X-Origin-TTL
X-Origin-CC
X-Akamai-Transformed
X-ID
X-Real-IP
NGB
X-Handled-By
X-CACHE-AGE
X-Cache-TTL-Remaining
X-GEO
X-FTR-Request-ID
X-UA-Device-Type
X-Node-Name
X-Via-JSL
X-Pubstack
X-Hl-Ver
X-Reqid
X-Xfnlog-Site
X-Optimistic-Header
X-Cms-Context
Apigw-Requestid
X-Cache-Type
X-Correlation-ID
CDN-EdgeStorageId
CDN-RequestPullSuccess
CDN-Uid
ServedBy
X-Restarts
CDN-RequestPullCode
CDN-RequestCountryCode
Ms-Operation-Id
CDN-Cache
CDN-CachedAt
MS-CV
CDN-PullZone
X-RTag
X-CSRF-Token
X-No-Session
X-ProxyCache-Key
X-Cache-Host
X-ProxyCache-Status
X-BYPASS-REASON
X-Server-W
X-Varnish-Ttl
X-Parent-Response-Time
WP-Super-Cache
Content-Secure-Policy
X-Nyt-Route
X-S-Cookie
Surrogated-Key
X-ScT
X-SD-PageType
X-Rojux
X-Eu-Site
X-External-Request-Id
X-Cluster
Gannett-Cam-Experience-Id
X-AWS-Id
Sslversion
T-Server
Fastly-SSL
W
X-Ec-GeoHdr
X-A
X-A-Ccd
X-A-Dam
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
DCR-Decision-By
True-Client-Country-4JS
X-Epic-Correlation-Id
DCR-Processing-Time-Ms
X-Shop-Environment
X-Fastly-Backend
X-IPLB-Instance
Canary
Ngx.Var.Host
Odigeo-Trace-Id
Origin-Agent-Cluster
X-Orig-Expires
N-Cache
Meta-Geo-Continent
Lang
L5d-Success-Class
Magicmarker
BehaviorPad-Version
MD5-Digest
Candidate-Md5Url
Redirect-Candidate
Server-Host
Ha-Gx-Prefs
X-Origin-Time
X-LJ-Flow-ID
X-IPLB-Request-ID
X-A-Dcw
HA-Ipaddr
Rendered-Blocks
X-Gdpr
X-VWS-Id
X-FC-Vary-Parameters
L
Vix-Hermes-Req-Id
X-Developer
X-B-Cookie
X-We-Are-Hiring
X-Bl-Debug
X-CF-Lambda-Fn
X-Dispatcher-Number
X-Debug-Cache-Fetch
X-Destination
X-Forwarded-Path
X-App
X-Application
X-Debug-Cache-Store
X-CGP
X-A-Dgt
X-Cache-NE
X-Vtex-Remote-Cache
X-CF-Lambda-Version
X-Aed
X-Ec-Custom-Error
X-Vdms-Version
X-Viewer-Country
X-BCube-Filmed-By
X-Csrf-Jwt
X-Ec-Fail
Xc-Version
X-Worker
X-A-Wwc
X-Tenant
X-CacheTTL
X-Bc-Bl
X-Vdms-Path
X-Conf
X-SRCache-Key
X-D
X-Tx-Id
X-Cdn-Diag
X-Org
Platform
Origin
X-Mvc-Supplant-Cachable
X-Cdn-Origin
X-Irp-Debug
X-CMSURLCustom
X-Owner
X-Generated-On
Fastly-GeoIP-CountryCode
X-Core-Mission
Expect-Staple
Fastly-Backend-Name
Gh-Request-Id
X-Core-Value
X-GeoIP-Country-Code
X-Clientip
Is-Eu
Host-ID
X-Geo-Header
Mail-Subject
X-Date
X-NodeID
X-Accel-Expires-Debug
X-Node-Id
Thinkindot-Control
Thinkindot-CacheControl-Type
TDXMobile
Thinkindot-CacheControl
X-DPWN-IS-SECURE
X-Accel-Buffering
We-Hiring
Web-Mar-Region
VNS-Cache
VNS-Age
X-Nitro-Cache
X-Mly-Id
X-DefHash
X-DefElseHash
X-Cache-Debug
Req-Svc-Chain
X-GeoIP-Region-Code
X-Cache-Info
X-Mid
Release
X-Level-Front-Cache
X-Nananana
Environment
X-Alternate-Cache-Key
X-BBC-Edge-Cache-Status
X-Bip
X-Hash
X-Loc
Producers
Adler-Geo
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-Refresh
X-Request-Host
X-Proxy-Cache-Status
X-Qloud-Router
X-Pool
X-Sn-Servicetimems
X-Storefront-Renderer-Rendered
X-Sorting-Hat-PodId
X-Policy
X-Varnish-CookieHashed-On
X-Wikidot-Backend
X-Variation
X-App-Name
X-ShardId
X-Wix-Viewer-Type
X-ShopId
X-Shopify-Stage
X-Varnishpool
X-Server-IP
X-Request-Time
X-Up
X-Var-Ttl
X-S-Maxage
X-Wikidot-Static-Cache
AKAMAI
X-Sorting-Hat-ShopId
X-Platform
X-Test
CPC-Age
CPC-Cache
Cmstype
Cache-Provider
Cf-Device-Type
X-VG-WebCache
Cmsid
X-SVT-ORM-VERSION
X-VG-TLSProxy
X-SVT-ORM-RULES
X-Vmg-Version
X-Thanos
X-Varnish-CookieINHashed-On
X-VServer
X-Varnish-Remaining-TTL
Datacenter
X-Thinkindot-L3
X-PAYTM-SRV-ID
X-TIME
X-Vcl-Version
X-Cache-Status-Check
Cache-Name
X-Dispatcher-Server
X-Device-Os
X-WADP-Cache
X-ApacheServer
Esi-Enabled
X-Akamai-Device-Characteristics
X-AB
X-Cache-Bucket
X-Auto-Login
X-Cache-Id
X-Nginx-Cache-Key
X-WA-Info
X-AIR-PT
AMP-Access-Control-Allow-Source-Origin
Sever-Int
X-Gzip
Machine
Apple-News-Services-Request-Url
Apple-News-Services-Parsed-Url
Apple-News-Services-Handled
Apple-News-Services-Host
X-Origin-Response-Time
X-INCAP-ABP
Country-Code
DSUID
CloudFront-Viewer-Country
X-PERF
CDCHOST
X-Clara-WADP
X-Micro-Cache
NM-Fastcgi-Cache
X-Old-Content-Length
X-Forwarded-Site
X-Fmm-Version
X-Mvc-Supplant-OutputCached
X-Esi-Check
Server-Ext
Server-Hostname
X-Cdn-Srv
X-From
X-Human
X-Origin
X-GeoIP
User-Cache-Control
X-Fastly-Request-Id
X-Cache-Enabled
X-Datadome
X-Block-Status
X-LB-NoCache
X-Gen-Mode
Pics-Label
Server-Info
NGX
X-Instance-Name
X-Hnp-Log
C-Via
X-Op-Id-All
Ssr
X-Access
X-Amz-Meta-Cb-Modifiedtime
X-NCache
Wxu-Next-Region
Wxu-Next-Hostname
X-Section
Wxu-Next-Commit
X-B3-Spanid
X-Dc
X-Geo-Region
X-API-Version
X-Is-Gdpr
X-JWT-State
X-Has-Esi
Server-ID
Memcached
X-Via-Fastly
X-TraceId
X-ZONE
X-HA-Backend
X-Accel-Version
X-Vgn-Hpd-Reason
X-CACHE-GROUP
Hostname
Cache-Hits
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Grace
X-Scale
Time
Origin-EX
Memory
Origin-CC
Cdn-Requestid
X-Wp-Cf-Super-Cache-Active
X-Buckets
X-PHP-Backend
X-Browser-Name
X-Platform-Processor
X-Platform-Router
X-TIM-N
X-Is-Desktop
X-Is-Supported-Browser
X-SIPLIST1
IsBot
X-Platform-Cluster
X-Tcp-Rtt
Sid
X-Is-Tablet
X-Is-Mobile
Location
X-Air-Trace-Id
X-Air-Hostname
X-Air-Source
X-Presslabs-Stats
X-Tb-Optimization-Total-Bytes-Saved
X-Fpc
Resin-Trace
CF-Ctrl
YJS-ID
X-Internal-Host
X-Backend-Instance
X-B3-Parentspanid
X-Cached-By
X-Azure-Ref-OriginShield
X-WP-CF-Super-Cache-Active
X-Cs
X-Zone
GeoIP-Latitude
X-DC
X-Microcachable
Epwk-X-Cache
X-Frame-Option
X-TA-CDN-Provider
X-Hyper-Cache
Cache-Host
X-Origin-Expires
X-DataCenter
True-Client-Ip
Uri
X-Info
X-Web-Node
XM
X-Origin-Cache-Key
X-LiteSpeed-Cache-Control
PFcat
X-VarnishDD-TTL
X-Webstats-RespID
X-Nitro-Cache-From
X-Nitro-Rev
X-NGINX-Cache
X-Pod-Name
GeoIP-Country-Code
X-HN
X-Site-Version
X-VC
X-Locale
X-Service
Cdn
LB
X-Ad-Defer-Variation
User-Agent
GeoIp-Country-Code
X-FTR-Backend-Server
X-Country-Code-Real
X-VCache
X-FTR-Expires
X-FTR-Backend
X-FTR-Balancer
X-FTR-Cache-Status
X-CS
X-Via-CDN
XServer
X-Cache-Ttl
X-Via-SSL
Edge-Copy-Time
Locid
Srvid
X-Datacenter
X-FL-EDGE
X-Via-Edge
X-FL-QIT-DEBUG
A
X-NewRelic-App-Data
X-CSRF-TOKEN
NtCoent-Length
Cdn-Request-Time
X-Edge-Server
True-Client-IP
Cdn-Host
X-Geo
X-Moov-T
X-Moov-Xdn-Version
X-Contensis-Viewer-Groups
X-Webkit-Csp-Report-Only
X-TRACE-ID
Req-ID
X-FireWall-Port
X-NMSegId
X-Cache-ASPX
X-Varnish-Authentication
X-Vercel-Cache
X-ATG-Version
WZWS-RAY
M-TraceId
X-Vercel-Id
Cache-Key
X-FPC
X-Pad
X-Ad-Load-Variation
SID
Fastly-Drupal-Html
X-MSEdge-Features
X-MSEdge-Flight
X-HostName
Tcn
WebServer
Content-Style-Type
X-M-Reqid
Path
Cluster
Pramga
X-Scope-Id
X-M-Log
X-LiteSpeed-Tag
X-SRV
Content-Script-Type
X-Request-Start
X-APP-VERSION
CountryCode
Cf-Ipcountry
X-Api-Version
X-Cdn-Request-ID
Cdnsip
Cdncip
X-AK-Request-ID
X-NWS-UUID-VERIFY
X-Varnish-Beresp-Status
X-Shield-Cache-Expires
X-Qnm-Cache
X-Amz-Meta-Opti
X-Esi
X-Request-URI
X-Air-Pt
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
X-Branch-Name
X-Upstream-Ht
X-Platform-Server
X-Wp-Cf-Super-Cache
HostName
State
X-Wp-Cf-Super-Cache-Cache-Control
X-Planisys-CDN-Cache
X-Upstream-Ct
Edge-Cache
X-HS-Content-Campaign-Id
X-Cache-Date
X-Github-Request-Id
X-Wp-Cf-Super-Cache-Cookies-Bypass
Yak-Timeinfo
X-Release
X-TH-Server
X-Vgn-Hpd-Ssi
X-Fastly-Cache
Ohc-File-Size
X-Vgn-Hpd-Cached
XkeyRZ
X-Proxy-CacheRZ
X-Vgn-Hpd-Variations-Key
Cache-Tv-Group
X-WP-CF-Super-Cache-Cookies-Bypass
CDN
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-CACHE-KEY
X-Generated-In
X-HS-Status
X-Tim-N
Srv
X-Cdn-Forward
X-Cache-Remote
X-Rocket-Build-Number
X-Sigma
X-V-Cache
X-Servedbyhost
X-Req
X-SB
X-Render-Time
Tube-Return
Tube-Got-Results
X-Acquia-Purge-Cdn-Unconfigured
X-Aicache-OS
X-Cache-FS-Status
X-B3-Trace-ID
Tube-Got-Eval
Tube-Get-Contents
X-Traceid
Geoip-Latitude
X-LB-ID
Click-Count-Action-Start
Click-Count-Error
X-Nc
X-Sigma-Backend
Wpo-Cache-Message
X-Via-Poph
X-Akamai-Pragma-Client-IP
X-Via-Popn
X-Via-Popv
Wpo-Cache-Status
Proxy-Connection
X-Wa
Lb
X-Lb-Cache
CF-Cached-On
Cache
X-User
X-VCL-Version
X-Ha-Backend
X-UA
V-Age
Ohc-Cache-HIT
X-Vary
X-Fastly-Backend-Reqs
Server-Id
X-Men
X-Dw-Trace-Id
On-Server
X-TT-LOGID
X-Scheme
Ngx-Var-Key
X-CUA
MIME-Version
PICS-Label
X-Via-Ucdn
X-GeoIP-City
X-Acquia-Purge-Tags
X-Gamma-Serve
X-Acquia-Site
X-GoCache-CacheStatus
X-EC-Lua
X-Acquia-Application-UUID
X-Lb-Nocache
X-Acquia-Application-Trace
X-TX-ID
Yjs-Id
X-Iplb-Request-Id
X-Iplb-Instance
X-Provided-By
Mime-Version
X-RAMCache
X-Vc
Vha6-Origin
X-Cached-Since
X-Snapshot-Date
X-Fastly-Cache-Hits
CACHE-MISS-TO-ORIGIN
Inserted-Into-Cache-At
X-ElasticPress-Query
X-Litespeed-Cache-Control
X-Cdn-Cache-Status
X-CF-Cache-Header-Cache-Control
X-CF-Cache-Header-Vary
Cneonction
X-Miniprofiler-Ids
Ngx
Log-Origin
X-Udemy-Cache-App-Namespace