Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
CF-RAY
Cf-Request-Id
CF-Cache-Status
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-XSS-Protection
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
P3P
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-UA-Compatible
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Request-Id
X-Xss-Protection
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-Runtime
X-AspNet-Version
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Cache-Status
X-Generator
X-Cacheable
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Content-Security-Policy
X-Ua-Compatible
X-Request-ID
X-Iinfo
Content-Encoding
X-CDN
Feature-Policy
X-AspNetMvc-Version
Status
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
Access-Control-Max-Age
X-Via
Keep-Alive
X-Ws-Request-Id
X-AH-Environment
X-Age
X-Robots-Tag
Request-Context
EagleId
X-Cache-Group
X-Turbo-Charged-By
X-Proxy-Cache
Server-Timing
X-Server
X-Backend
X-Hacker
X-Dns-Prefetch-Control
Host-Header
X-Server-Powered-By
Report-To
X-Amz-Request-Id
X-Nginx-Cache-Status
X-Amz-Id-2
Grace
X-UA-Device
X-Rq
X-Varnish-Cache
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
X-Page-Speed
X-OneAgent-JS-Injection
Cf-Railgun
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Device
X-CST
X-Amz-Version-Id
NEL
X-Cache-Spec
Allow
X-Vhost
X-Host
X-Backend-Server
X-WebKit-CSP
X-ASPNET-VERSION
X-Server-Id
X-Dispatcher
Surrogate-Control
EagleEye-TraceId
X-Node
Xkey
Request-Id
X-Response-Time
Content-Location
Accept-CH
X-Akam-SW-Version
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Ruxit-JS-Agent
P3p
X-Cache-Lookup
Accept-CH-Lifetime
X-Application-Context
X-Country
X-Ac
X-Mod-Pagespeed
X-Cloud-Trace-Context
X-Readtime
X-Template
X-Language
X-B3-TraceId
MS-Author-Via
X-HW
Rating
X-Url
X-Cnection
X-MS-InvokeApp
Accept-Ch-Lifetime
X-PC
X-Vname
X-TtlSet
X-Origin-Cache
Edge-Control
X-Clacks-Overhead
X-ESI
X-GitHub-Request-Id
X-Varnish-TTL
X-Trace
Accept-Ch
Response
Display
Pagespeed
X-Middleton-Display
X-Content-Type
X-Sol
X-Middleton-Response
X-D2id
Verso
Arr-Disable-Session-Affinity
X-Kinja-Server
X-Kinja-Revision
X-Use-Magma
X-Kinja-Build
X-Exp-Variant
X-Cdn-Fetch
X-GoogleNews-Bot
X-Kinja
X-Exp-Id
X-FastCGI-Cache
X-Powered-By-Plesk
X-Goog-Hash
X-Country-Code
X-Vcap-Request-Id
X-Rack-Cache
X-Webkit-CSP
X-TTL
X-VARITI-CCR
X-ORACLE-DMS-RID
X-Navigation-Version
X-Amz-Rid
X-Abt-Application-Version
X-ORACLE-DMS-ECID
Fastly-Restarts
Service-Worker-Allowed
X-Server-Name
X-Fastly-Request-ID
X-Cached
X-Client-IP
X-Buckets
X-MSEdge-Ref
X-Release
X-Element-Page-Cache
Cache-Tag
X-Dw-Request-Base-Id
X-NF-Request-ID
MRF-Tech
X-B3-TraceId-Primal
Mrf-Cache-Status
X-Cache-TTL
RTSS
Access-Control-Request-Method
Public-Key-Pins
X-SharePointHealthScore
SPRequestGuid
SPRequestDuration
SPIisLatency
X-Edge
X-Ezoic-Cdn
AR-ATIME
Ar-Sid
AR-CACHE
AR-Request-ID
AR-PoweredBy
X-Powered-CMS
X-LLID
X-Upstream
X-Version
Pinterest-Version
Pinterest-Generated-By
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Pinterest-Rid
S
X-HP-Webp
X-Jurisdiction
Content-MD5
X-Kinsta-Cache
X-Recruiting
X-MCACHE
X-Mid
X-ECACHE
Charset
X-Mg-S
X-PressLabs-Stats
X-T
Cache-Tags
X-DynaTrace
X-Accel-Expires
X-Origin-Upstream-Status
X-Content-Digest
X-Forwarded-Proto
Fastcgi-Cache
Fusion-Component-Id
Fusion-Template-Id
X-Litespeed-Cache
Fusion-Content-Id
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Source
X-Content-Security-Policy-Report-Only
X-Logged-In
X-Px
X-Ttl
X-Correlation-Id
TP-Cache
TP-L2-Cache
Filters
Server-Node
Edge-Cache-Tag
Server-Name
TCN
X-Id
X-Amz-Server-Side-Encryption
X-Oneagent-Js-Injection
Front-End-Https
X-Forwarded-For
X-Request-Processing-Time
X-Request-Received
Nginx-Cache
MicrosoftSharePointTeamServices
X-Grace
X-XRDS-Location
X-Shield-Request-Id
Alternate-Protocol
X-Hits
X-Amzn-Trace-Id
X-B3-Sampled
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Request-Handler-Origin-Region
X-Server-ID
X-Microsite
X-NWS-LOG-UUID
X-Az
X-Activity-Id
X-AppVersion
X-Ruxit-Js-Agent
X-F-Cache
X-HS-Combine-CSS
X-HS-Cache-Config
X-Amz-Replication-Status
X-HS-Content-Id
X-HS-Hub-Id
X-Origin-Server
X-Varnish-Age
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-GUploader-UploadID
X-Debug
X-RateLimit-Remaining
X-Frontend
X-Rid
X-Daa-Tunnel
Realpath
Nel
Host
Section-Io-Cache
X-Yandex-Sdch-Disable
X-Cache-Age
Accept-Charset
X-Geo-Country
X-DIS-Request-ID
X-Hostname
X-Fastcgi-Cache
Surrogate-Key
X-Git-Hash
X-Ser
X-VCache
X-Respond-Thread
Access-Control-Allow-Method
X-Time
X-Mobile-URL
Cleartype
X-WebKit-CSP-Report-Only
X-Contextid
X-Source
X-DataDome
MS-CV
X-Seen-By
X-Upgrade-Enabled
X-Type
ServerID
X-AOL-HN
Paypal-Debug-Id
X-XRDS-LOCATION
X-Route-Name
X-Request-Guid
X-LB-Cache
X-Aspnet-Duration-Ms
X-Providence-Cookie
X-Is-Crawler
X-Flags
Payment
X-TT
X-Varnish-Backend
Healthy
X-Content-Options
X-Signature
X-Debug-Info
X-Load-Cache
X-IPLB-Instance
X-B-Cache
X-Whom
X-Cache-Action
X-Cache-Key
X-N
X-Page-Id
X-App-Environment
X-FB-Debug
Fastcgi-Useragent
Node
X-Jobs
Cache
X-Webkit-Csp
X-Rule
X-Mobile
X-Cache-Expired-At
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
Refresh
X-FireWall-Port
Viewport
X-Accel-Buffering
X-Response-Served-From
X-Original-Request-Id
X-Wix-Request-Id
DC
X-Cacheable-TTL
Ms-Operation-Id
X-RTag
X-Cluster-Name
Access-Control-Request-Headers
X-HTML-Minification-Powered-By
X-Instance
X-Cache-Control
X-Real-IP
X-Content-Powered-By
X-Framework
X-Distributor
Referer-Policy
X-Zen-Fury
X-ProcessESI
X-Page-View
X-Debug-IsPreview
X-Debug-IsConnected
X-UUID
X-B
X-RemovedCookies
X-Region
X-Tt-Trace-Host
X-Proxy
Eomportal-Instance
X-Tt-Trace-Tag
X-Drupal-Cache-Tags
X-Cache-Time
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-IPS-LoggedIn
Version
X-Www-Served-By
Countrycode
X-Tec-Api-Version
X-FTR-Request-ID
X-Tec-Api-Origin
X-Tec-Api-Root
X-Drupal-Cache-Contexts
X-Protected-By
X-Nginx-Cache
X-FW-Serve
X-FW-Dynamic
X-FW-Hash
X-App-Server
X-FW-Type
X-G
X-FW-Static
X-FW-Server
X-Tumblr-Pixel-1
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Tumblr-User
X-Cached-By
X-Varnish-Grace
X-Yottaa-Optimizations
X-Yottaa-Metrics
Liferay-Portal
X-Cache-Operation
CF-IPCountry
X-Via-JSL
X-Cache-Rule
GEO-INFO
X-Pass-Why
Xserver
Section-Origin-Responded
Section-Io-Origin-Time-Seconds
Section-Io-Id
Section-Io-Origin-Status
X-Device-Type
X-Akamai-Edgescape
X-Cache-Hit
X-Environment-Context
X-L-Path
SRV
X-TA-CDN-Provider
Powered-By-ChinaCache
Server-Info
X-Varnish-Server
Retry-After
X-Adobe-Loc
X-Adobe-Content
X-User-Agent
X-TEC-API-ROOT
DynaTrace
X-TEC-API-VERSION
Cache-Status
X-TEC-API-ORIGIN
Frame-Options
X-Pinterest-Direct
Ec-Rule-Version
X-Handled-By
X-Tumblr-Pixel-2
X-ES-SERVER
X-Endurance-Cache-Level
X-UPSTREAM-Address
X-Hl-Ver
From-Origin
Meta-Geo
X-RN-RSRV
Cache-Tv-Group
Webserver
X-Backend-Name
Uber-Trace-Id
X-Proxy-Cache-Status
Fastly-SSL
X-Mode
X-FB-TRIP-ID
X-Pubstack
X-ProxyCache-Status
X-Access
X-ProxyCache-Key
TWC-Device-Class
Decoy-Debug-TTL
Property-Id
Decoy-Debug-Status
Decoy-Debug-Key
Apigw-Requestid
Country
TWC-Connection-Speed
X-Request-Time
Webcakes-App-Name
Webcakes-App-Version
TWC-Privacy
TWC-Locale-Group
TWC-GeoIP-Country
TWC-GeoIP-LatLong
Webcakes-Region
X-Be
X-Varnishpool
X-WA-Info
X-MP-GENERATED-AT
X-OCL
X-Uri
X-Section
X-Human
X-NYM-Debug-Backend
X-Origin-Hint
X-PCL
X-Soup
X-Format
X-Storage
X-Cache-Server
X-BYPASS-REASON
X-Timing-Wait
X-TNCMS
X-Sql-Duration-Ms
Cache-Name
X-LJ-Flow-ID
Mn-Server-Ip
X-Sql-Count
X-Server-W
X-Loop
X-Labrador-Cache-Channel
X-No-Session
X-UA-Device-Type
X-Info
X-Origin-Date
X-AWS-Id
X-LAGOON
X-Proto
X-ApacheServer
X-SayCDN-TTL
X-S-Maxage
X-Say-Cacheable
X-Say-TTL
X-Proxy-Build
X-PHP-Host
X-R9-Blue-Green-Version
Selected-Fe
X-Via-Fastly
X-PERF
X-VWS-Id
X-Web-Node
Azure-SiteName
Protected
Azure-SlotName
Azure-Version
X-Xfnlog-Site
Azure-RegionName
X-GG-Cache-Date
X-Cache-TTL-Remaining
Amp-Access-Control-Allow-Source-Origin
Azure-InstanceId
X-ShopId
X-Shopify-Stage
X-Sorting-Hat-PodId
X-ShardId
X-Redis-Cache
X-NWS-UUID-VERIFY
X-Alternate-Cache-Key
X-Sorting-Hat-ShopId
X-SRV
X-Content-Age
X-Status
X-Hosted-By
X-Hyper-Cache
X-Storefront-Renderer-Rendered
X-Routing-Service
X-Is-Bot
X-Proxied
X-Zipkin-Id
X-Rendered-As
X-Cache-Enabled
X-Locale
X-Backend-Host
X-Azure-Ref
X-Site-Version
X-Cluster
X-FW-Version
X-Microcachable
S-Cnection
X-Cache-Grace
X-Ratelimit-Limit
X-App-Version
X-Forwarded-Host
X-TT-LOGID
X-AIR-PT
X-Platform
X-Trace-Id
X-Qloud-Router
X-CSRF-Token
Akamai-GRN
X-Revision
ServedBy
X-RateLimit-Limit
X-Cache-NGX
X-EdgeConnect-Cache-Status
X-Aspnetmvc-Version
X-ATG-Version
X-Cache-PHP
X-Varnish-Hostname
AMP-Access-Control-Allow-Source-Origin
Who
X-Via-CDN
X-RCS-CacheZone
X-Debug-Cache
Cache-Hits
X-Detected-As
Filterid
Country-Code
DB-Nickname
X-Akamai-Transformed
X-Dc
X-CCM
X-Node-Name
X-CS
X-B3-SpanId
X-TX-ID
X-Cache-Host
X-Amzn-RequestId
X-Adobe-Source
X-Amzn-Remapped-Content-Length
X-Varnish-Beresp-Grace
X-Amz-Apigw-Id
SD-X-WS
X-CACHE-KEY
X-ID
X-Ms-Version
X-Unique-Id
X-BCube-Filmed-By
X-GEO
X-Ms-Request-Id
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
X-Edge-Location-Klb
Backend
X-A-Dgt
X-A-Wwc
X-A-Ccd
X-A-Dcw
X-A-Dam
Meta-Geo-Continent
X-Oss-Request-Id
X-Oss-Server-Time
X-Oss-Object-Type
T-Server
Rendered-Blocks
X-NAPM-TraceId
X-Oss-Storage-Class
X-Location
MD5-Digest
Machine
X-Aed
Mobile-Detection-Method
Odigeo-Trace-Id
X-A
X-B-Cookie
BehaviorPad-Version
X-D
X-Connection-Hash
X-CF-Lambda-Version
X-Destination
X-Generation-Time
X-From
X-Generated-On
X-External-Request-Id
X-CF-Lambda-Fn
X-Cache-NE
Fastly-Backend-Name
X-ARC
X-Application
X-Varnish-Cache-Hits
Fastcgi-X-Cache-Version
Expiry
X-Cache-Bucket
DCR-Decision-By
DCR-Processing-Time-Ms
X-Level-Front-Cache
X-Oss-Hash-Crc64ecma
X-Origin-TTL
X-Nc
X-Vdms-Version
X-Rewrite-Enabled
X-Rojux
X-Request-UUID
X-Vtex-Remote-Cache
X-Owner
NGB
X-PBS-Appsvrname
X-Vtex-Processado-Em
X-Vdms-Path
X-VG-WebServer
X-VG-WebCache
X-ScT
X-Processor
X-Session-Fingerprint
X-Varnish-Ttl
X-SRCache-Key
X-S
X-Trv-Group
X-Origin-CC
X-S-Cookie
X-PAYTM-SRV-ID
X-Time-Microsecs
X-Server-Lifecycle-Phase
X-Instrumentation
X-Kraken-Routeconfig-Destination
X-Kraken-Loop-Name
Content-Disposition
Cf-Device-Type
X-Tumblr-Pixel-3
X-Thanos
Cache-Host
Arc-Version
X-Developers
AKAMAI
CacheControlHeader
X-Core-Value
X-Thinkindot-L3
X-Cms-Context
X-Var-Ttl
X-TrackingId
Gh-Request-Id
Pagetype
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Thinkindot-Control
Path
PB-PID
Release
Server-Host
Ssr
PB-RID
UCS
V-Age
X-B3-Traceid
X-Azure-Ref-OriginShield
Esi-Enabled
X-Backend-State
Host-ID
Wxu-Next-Region
Magicmarker
Wxu-Next-Commit
Wxu-Next-Hostname
X-Bip
X-Device-Os
X-GeoIP-City
X-Reqid
X-Backend-TTL
X-OVcl
X-Generated-In
X-Has-Esi
X-OVcl-Cache
X-Irp-Debug
X-IP
X-Is-Gdpr
X-JWT-State
X-Policy
X-Magnolia-Registration
X-Geo-Header
X-ServerID
X-Fetched-On
X-FC-Vary-Parameters
X-APP-VERSION
User-Cache-Control
X-Platform-Server
X-Li-Fabric
X-Li-Pop
X-LI-UUID
X-Nginx-Cache-Key
X-VServer
Server-Hostname
X-Ratelimit-Reset
X-Planisys-CDN-TTL
X-NU-AKA-ACS-Version
X-VG-TLSProxy
X-Planisys-CDN-Rules
X-Node-Id
Sever-Int
Vix-Hermes-Req-Id
X-Rebelmouse-Cache-Control
X-Wikidot-Static-Cache
X-Origin-Expires
True-Client-Country-4JS
Server-Ext
X-Origin
X-Origin-Response-Time
X-Mvc-Supplant-Cachable
X-Old-Content-Length
X-Planisys-CDN-Cache
X-Micro-Cache
X-Method
X-Wikidot-Backend
Web-Mar-Node
X-Varnish-CookieHashed-On
X-SVT-ORM-RULES
X-Gen-Mode
X-DefHash
X-DefElseHash
X-Generated-By
X-GeoIP
X-Csrf-Jwt
X-SVT-ORM-VERSION
X-Scheme
X-Developer
X-Skip-Cache
X-Fastly-Backend
X-Fastly-Cache
X-Eu-Site
X-Epic-Correlation-Id
X-Dispatcher-Server
X-DPWN-IS-SECURE
X-Envoy-Decorator-Operation
X-Clientip
X-CGP
X-HS-Content-Campaign-Id
X-Hnp-Log
X-Block-Status
X-Rebelmouse-Surrogate-Control
X-SIPLIST1
X-Varnish-Remaining-TTL
X-Varnish-Hits
X-Varnish-CookieINHashed-On
X-Branch-Name
X-Variation
X-Cache-Tags
X-Request-Host
X-Request-URI
X-GoCache-CacheStatus
X-Cache-Debug
X-HN
X-User
X-VarnishDD-TTL
X-Cache-Info
HA-Ipaddr
Ha-Gx-Prefs
X-FTR-Backend-Server
CDN-PullZone
X-FTR-Balancer
X-FTR-Cache-Status
L5d-Success-Class
L
IsBot
CDN-RequestCountryCode
X-FTR-Backend
DSUID
CDN-Uid
Cf-Bgj
X-Country-Code-Real
CDN-RequestId
Fastly-SWR
Fastly-SIE
Apple-News-Services-Parsed-Url
X-FTR-DC
Is-Eu
CDN-Cache
Location
Adler-Geo
HostName
Apple-News-Services-Handled
Apple-News-Services-Host
Apple-News-Services-Request-Url
C-Via
CDCHOST
PFcat
Platform
CDN-CachedAt
X-FTR-Realm
Locid
NGX
CDN-EdgeStorageId
Origin
NM-Fastcgi-Cache
X-Amz-Meta-S3cmd-Attrs
X-DynaTrace-JS-Agent
X-NewRelic-App-Data
X-Goog-Meta-Goog-Reserved-File-Mtime
Cmsid
X-Gzip
X-Fmm-Version
X-Clara-WADP
X-Cache-Id
X-Esi-Check
X-Gamma-Serve
Fastly-Drupal-HTML
X-Hash
Rt-Fastcgi-Cache
X-Aicache-OS
On-Server
Req-Svc-Chain
X-WADP-Cache
X-Slack-Backend
X-Tb
X-LB-ID
Cmstype
X-EC-Lua
X-Loc
X-Ratelimit-Remaining
X-Sucuri-ID
X-Correlation-ID
X-Unique-ID
X-Served-From
Svr
Kp-EeAlive
Xc-Version
X-Varnish-Url
X-Servername
X-Vgn-Hpd-Reason
X-Swa-Ws
Pics-Label
X-Via-Popv
X-Via-Poph
X-Air-Hostname
X-Mvc-Supplant-OutputCached
A
X-Via-Popn
X-FTR-Expires
Viewtype
X-PF-Uncompressing
M-TraceId
VivaBuild
X-Refresh
Url
X-DC
X-NGENIX-Cache
X-PHP-Backend
SID
X-SaId
X-JoinUs
X-Cdn-Forward
Arc-Country
Instruction
X-Edge-Location
Tracecode
Cache-Key
SR-User-Adfree
Cross-Origin-Opener-Policy
X-CDN-Forward
X-Cache-Var
X-Cache-Var-Map
TDXMobile
X-CUA
X-NC
MIME-Version
Lfy
X-Matched-Rule
NtCoent-Length
X-NCache
X-Vc
Content-Secure-Policy
X-Sn-Servicetimems
X-Service
X-Tb-Optimization-Total-Bytes-Saved
X-Cache-Expires
X-Cdn-Origin
CloudFront-Viewer-Country
X-Extlb
Sid
X-TraceId
X-Internal-Host
X-CLOUD-TRACE-CONTEXT
Pramga
X-Servedbyhost
X-Cache-Backend
DataCenter
Server-ID
X-Cache-Date
X-Wa
X-Core-Mission
X-Bc-Bl
Geo-Info
X-Forwarded-Site
Source
Tcn
X-Request-Start
X-HS-Status
X-Proxy-Upstream
FSS-Cache
X-Srv
X-Webkit-CSP-Report-Only
X-LI-Proto
Geoip-Latitude
Memcached
X-B3-Spanid
Hostname
Surrogated-Key
X-Req
LB
GeoIp-Country-Code
X-Newrelic-Synthetics
X-VC-Cache
X-Date
X-FireWall-Protection
X-Esi
X-VCL-Version
Mail-Subject
X-Accel-Expires-Debug
We-Hiring
X-Via-NSCOPI
X-Error
Upgrade-Insecure-Requests
X-VHOST
CACHE
Env
X-App
X-RateLimit-Limit-Second
X-Viewer-Country
X-RateLimit-Remaining-Second
X-Varnish-Cacheable
X-Sigma
X-Response-By
X-Sigma-Backend
X-Rocket-Build-Number
X-HOST
GeoIP-Latitude
X-CCDN-CacheTTL
X-Hcs-Proxy-Type
GeoIP-Country-Code
X-PJAX-URL
X-Cache-Ttl
X-Men
XServer
X-Vcl-Version
Request-ID
X-CCDN-Origin-Time
Time
X-MSEdge-Features
X-Li-Proto
Resin-Trace
X-Air-Source
Memory
Server-Ttl
X-MSEdge-Flight
X-LiteSpeed-Cache-Control
X-Zone
X-Geo
X-RPS
X-RPM
X-DW
X-RSL
X-DI
X-DSS
X-DB
Xkeyi7
X-TIM-N
CF-Cached-On
X-Proxy-Cachei7
X-BBXSRF
X-Mg-Request-UUID
X-ZONE
CPC-Cache
X-APP
X-Cs
X-WA
VNS-Cache
VNS-Age
N-Cache
S-Rt
X-RAMCache
CPC-Age
HitType
X-Contensis-Viewer-Groups
State
Fastcgi-Cache-TTL
My-App
X-Action
ProcessTime
X-Cache-ASPX
X-ServedByHost
X-Varnish-Authentication
X-Air-Trace-Id
X-Cache-2
X-HostName
X-Svr
X-UA
X-Cc-Via
X-Minions-Version
X-FPC
X-Cc-Req-Id
X-Region-Sid
D-Cc-Upstream
X-Oss-Cdn-Auth
Server-Id
X-Cache-Type
X-Swift-Error
X-Dynatrace-Js-Agent
X-Provided-By
Mime-Version
X-FORWARDED-FOR
X-Depends-On
Cache-Provider
W
X-Cdn-Request-ID
Srv
X-URL
X-Nyt-Route
X-Origin-Time
X-Cache-Config
X-Dw-Trace-Id
X-Server-IP
X-UnsetCookies
X-API-Version
CDN
X-TIME
X-Fpc
OT-Force-Account-Verify
X-CF-Powered-By
X-CSRF-TOKEN
X-BACKEND-TTL
X-Gdpr
X-SERVER-NAME
X-Xrds-Location
Cteonnt-Length
X-Client-Ip
X-ServerName
X-ND-Cache
X-Hello
X-ABtesting
X-Flog
X-VC
X-Tenant
X-Parent-Response-Time
X-Pf-Uncompressing
Cdn
X-Shop-Environment
X-Orig-Expires
X-Forwarded-Path
X-Fastly-Request-Id
Proxy-Connection
Cross-Origin-Window-Policy
X-Cache-Remote
Datacenter
Ohc-File-Size
X-Sucuri-Cache
X-Akamai-Pragma-Client-IP
X-NGINX-Cache
X-SD-PageType
X-Snapshot-Date
X-Pad
WZWS-RAY
X-Check-Cacheable
X-NodeID
X-Fastly-Backend-Reqs
X-Presslabs-Stats
Dnion-Transfer-Encoding
X-Oracle-DMS-ECID
X-Traceid
X-SN
Media-Length
Vha6-Origin
Ohc-Cache-HIT
X-Erf-Stays-Bingo-Pdp-Web
X-Webstats-RespID
X-Via-PopV
X-SB
X-Pjax-Url
X-Ftr-Cache-Host
X-Air-Pt
X-Ftr-Request-Id
Cf-Ipcountry
X-Via-PopN
PICS-Label
X-Via-PopH
X-BBC-Edge-Cache-Status
X-ElasticPress-Search
Epwk-X-Cache
X-Cluster-Node
X-LiteSpeed-Tag
EpKe-Alive
X-Ms-Meta-Originalurl
X-Ms-Meta-Staticbatchstarttime
X-Cache-Tag
X-Acquia-Application-Trace
X-MiniProfiler-Ids
X-Vcache
Warning
X-Acquia-Site
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Akamai-ERRuleID
X-Lb-Id
Xet-Cookie
X-IN-APIGATEWAYSSL
X-Yottaa-OS
X-IN-APIGATEWAY
X-Conf
X-Host-Name
X-Akamai-ERPolicy
X-Varnish-URL
CountryCode
X-Tx-Id
X-Apw-Hits
X-Cache-Status-Check
X-V-Cache
X-Mg-Request-Id
Count-Hit
X-C
X-Ckpd-Fst-Backend
X-Redis-Count
URI
X-Debug-Cache-Fetch
X-Debug-Cache-Store
Environment
X-Request-URL
NnCoection
Phost
Ohc-Response-Time
X-B3-Parentspanid
X-BBC-Origin-Response-Status
Inserted-Into-Cache-At
X-Render-Time
Content-Script-Type
Content-Style-Type
X-Apw-Access-Action
X-Apw-Access-Object
X-Litespeed-Cache-Control
X-Amz-Meta-Cb-Modifiedtime
X-Redis-Duration-Ms
X-Tid
X-Varnish-Beresp-TTL
X-Apw-Access-Token