Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
CF-RAY
X-XSS-Protection
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
X-Xss-Protection
P3P
X-Cache-Hits
X-UA-Compatible
X-Served-By
CF-Ray
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-Envoy-Upstream-Service-Time
X-FRAME-OPTIONS
X-Dns-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-DNS-Prefetch-Control
Server-Timing
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Access-Control-Expose-Headers
Content-Encoding
X-Ua-Compatible
X-CDN
Status
X-XSS-PROTECTION
Upgrade
X-Request-ID
X-AspNetMvc-Version
Access-Control-Max-Age
X-Via
X-Amz-Request-Id
X-Amz-Id-2
Request-Context
X-Backend
X-Cache-Group
X-Turbo-Charged-By
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-AH-Environment
X-Vhost
X-UA-Device
X-Hacker
X-Proxy-Cache
X-Server
Allow
X-Rq
X-Server-Powered-By
X-Ws-Request-Id
X-Dispatcher
EagleId
X-Age
X-Varnish-Cache
X-Amz-Version-Id
P3p
X-LiteSpeed-Cache
Nel
Grace
Cf-Apo-Via
Cf-Railgun
X-Page-Speed
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
EagleEye-TraceId
X-Device
X-Swift-SaveTime
X-Swift-CacheTime
X-OneAgent-JS-Injection
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-Pingback
X-Host
X-CST
X-Cache-Lookup
Accept-CH
X-WebKit-CSP
X-Node
X-Backend-Server
Surrogate-Control
X-Server-Id
Permissions-Policy
Accept-CH-Lifetime
X-Readtime
X-Nginx-Upstream-Cache-Status
X-Akam-SW-Version
X-Nginx-Cache-Status
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Application-Context
Request-Id
Xkey
X-Cloud-Trace-Context
X-Content-Security-Policy-Report-Only
X-Response-Time
X-Ruxit-JS-Agent
X-HW
X-Trace
Content-Location
X-Edge
X-Clacks-Overhead
X-Mod-Pagespeed
X-Url
Rating
X-Midtier
X-ESI
X-Amz-Server-Side-Encryption
X-ECACHE
Cache-Tag
X-Country
X-Mcache
X-Powered-By-Plesk
X-Rack-Cache
X-MS-InvokeApp
Service-Worker-Allowed
X-D2id
X-Exp-Id
X-GoogleNews-Bot
X-Use-Magma
X-Kinja
X-Exp-Variant
X-Kinja-Build
X-Cdn-Fetch
X-Kinja-Server
X-Kinja-Revision
X-Vcap-Request-Id
X-Upstream
X-Oneagent-Js-Injection
Verso
X-Element-Page-Cache
Accept-Ch
Edge-Control
X-Country-Code
X-Ac
X-Kinja-CCPA
Origin-Trial
RTSS
X-TtlSet
X-Vname
X-PC
Accept-Ch-Lifetime
X-Goog-Hash
X-Navigation-Version
X-VARITI-CCR
X-Abt-Application-Version
X-Browser-Type
X-Cache-TTL
X-NWS-LOG-UUID
Fastly-Restarts
X-Amz-Rid
X-GitHub-Request-Id
Cross-Origin-Opener-Policy
X-Ruxit-Js-Agent
X-Aspnetmvc-Version
X-Varnish-TTL
X-Server-Name
X-Litespeed-Cache
X-Cached
X-Webkit-CSP
X-Dw-Request-Base-Id
X-Amzn-Trace-Id
X-Sol
X-Middleton-Display
Pagespeed
Display
X-SharePointHealthScore
X-Ttl
SPRequestGuid
Pinterest-Generated-By
Pinterest-Version
X-Pinterest-Rid
X-Times
X-WebKit-CSP-Report-Only
SPIisLatency
X-ORACLE-DMS-RID
SPRequestDuration
X-ORACLE-DMS-ECID
X-Server-ID
X-Content-Type
X-Instrumentation
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Cache-Key
X-Client-IP
AR-ATIME
AR-SID
AR-PoweredBy
AR-Request-ID
X-Powered-CMS
X-B3-Traceid
Arr-Disable-Session-Affinity
X-Cnection
X-Version
X-Mg-S
X-Ser
X-Middleton-Response
Response
Nginx-Cache
X-Jurisdiction
X-HP-Webp
X-HP-Trace-Id
X-FastCGI-Cache
X-Accel-Expires
Cache-Tags
X-T
AR-CACHE
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Fastly-Request-ID
Cache-Status
Edge-Cache-Tag
X-Hits
X-B3-TraceId
X-RateLimit-Remaining
X-NF-Request-ID
X-Px
Public-Key-Pins
X-MSEdge-Ref
S
X-Recruiting
X-Daa-Tunnel
Front-End-Https
X-Shield-Request-Id
Payment
X-LLID
X-Frontend
Server-Node
X-Ua-Browser
X-RateLimit-Limit
X-Request-Received
X-Request-Processing-Time
Content-MD5
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-GUploader-UploadID
X-Goog-Metageneration
X-Content-Digest
MicrosoftSharePointTeamServices
Access-Control-Request-Method
X-Amz-Apigw-Id
X-Amzn-RequestId
X-DIS-Request-ID
X-Forwarded-For
X-Protected-By
X-Fastcgi-Cache
Realpath
TP-Cache
X-Microsite
X-Request-Handler-Origin-Region
X-Distributor
X-Webkit-CSP-Report-Only
X-FB-Debug
X-PressLabs-Stats
Fastcgi-Cache
X-HS-Hub-Id
X-HS-Combine-CSS
X-HS-Cache-Config
Access-Control-Allow-Method
X-HS-Content-Id
X-TTL
X-Page-Id
Accept-Charset
X-Cluster-Name
X-Id
X-Rid
X-LB-Cache
Count-Hit
X-Ratelimit-Remaining
X-Edge-Location-Klb
X-Kinsta-Cache
X-B3-Sampled
X-Geo-Country
Cross-Origin-Resource-Policy
X-Goog-Stored-Content-Length
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Hostname
X-Xrds-Location
X-Aspnet-Version
X-Ua-Device
TP-L2-Cache
X-App-Server
X-Seen-By
X-Logged-In
TCN
X-Varnish-Backend
X-Git-Hash
Cleartype
X-Hosted-By
X-Ezoic-Cdn
X-Content-Options
X-Ratelimit-Limit
X-Mobile
X-Correlation-Id
Retry-After
Referer-Policy
X-TEC-API-ROOT
X-TEC-API-ORIGIN
DC
X-TEC-API-VERSION
X-Newrelic-App-Data
X-F-Cache
X-Contextid
X-Fb-Rlafr
X-Forwarded-Proto
X-Origin-Cache
X-Route-Name
X-Grace
X-Revision
X-Request-Guid
X-Flags
X-Is-Crawler
Surrogate-Key
X-Providence-Cookie
X-Aspnet-Duration-Ms
X-TT
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Amz-Replication-Status
X-App-Environment
X-Debug-Info
Frame-Options
X-Amz-Meta-S3cmd-Attrs
X-IPS-LoggedIn
X-Varnish-Grace
X-Azure-Ref
MS-Author-Via
X-Envoy-Decorator-Operation
X-Magnolia-Registration
Section-Io-Cache
X-RateLimit-Reset
X-Www-Served-By
X-Trace-Id
X-Proxy-Cache-Info
X-App-Version
X-Wix-Request-Id
X-Az
X-Activity-Id
X-AppVersion
X-Whom
Filterid
Healthy
X-Language
X-Nf-Request-Id
Charset
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-COUNTRY
X-Akamai-Edgescape
X-Varnish-Server
Server-Name
Viewport
X-Webkit-Csp
WPO-Cache-Status
X-Origin-Server
Alternate-Protocol
WPO-Cache-Message
X-Datadog-Parent-Id
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-Backend-Name
X-N
Paypal-Debug-Id
Host
VIX-Pulpo-Node
X-Cache-Rule
VIX-Pulpo-Upstream-Status
X-Http-Reason
X-Original-Request-Id
X-Response-Served-From
X-B
Content-Disposition
X-EdgeConnect-Cache-Status
Amp-Access-Control-Allow-Source-Origin
X-Yottaa-Optimizations
X-UUID
X-Rule
X-B-Cache
X-Edge-Location
X-Cacheable-TTL
X-Instance
X-Cache-Grace
SRV
X-Yottaa-Metrics
X-Signature
Front
X-Akamai-Request-ID2
X-User-Agent
X-L-Path
X-ARC
X-Mg-Request-UUID
X-Unique-Id
X-Framework
X-Environment-Context
X-Jobs
X-Region
SD-X-WS
X-Load-Cache
X-Time
Protected
From-Origin
Country
X-Adobe-Content
Akamai-GRN
X-FW-Dynamic
X-Adobe-Loc
X-RemovedCookies
X-Status
X-Rocket-Nginx-Serving-Static
X-Varnish-Age
Fastly-SIE
X-Datadog-Sampled
Fastly-SWR
X-Rendered-As
X-ProcessESI
X-FW-Server
X-FW-Serve
X-FW-Static
X-FW-Version
X-Page-View
X-Is-Bot
X-FW-Hash
X-FW-Type
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Tumblr-User
X-G
X-Tumblr-Pixel
X-Tec-Api-Version
X-Tec-Api-Root
X-Tec-Api-Origin
X-Proxy
X-Cache-Time
X-Type
X-Amzn-Remapped-Content-Length
X-Debug-IsConnected
X-DataDome
X-Debug-IsPreview
X-Vcache
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Access-Control-Request-Headers
X-CDN-Forward
ServerID
Backend
X-ECache
X-Nginx-Cache
X-Tt-Trace-Host
X-Cache-Age
X-Tt-Trace-Tag
Refresh
X-Client-Ip
Url
Countrycode
Xet-Cookie
X-Servername
X-Cache-Control
X-DynaTrace
X-Httpd
X-Erf-Web-Scheduler
Accept-Language
X-Template
CF-IPCountry
X-Device-Type
X-XRDS-LOCATION
X-FTR-Request-ID
X-Drupal-Cache-Tags
X-NYM-Debug-Backend
X-Content-Powered-By
X-DynaTrace-JS-Agent
X-Mode
X-Generated-By
X-HTML-Minification-Powered-By
Xserver
Webserver
X-Cache-Hit
X-Storage
X-CCDN-CacheTTL
X-Hcs-Proxy-Type
X-CCDN-Origin-Time
X-NGENIX-Cache
GEO-INFO
Version
X-Tt-Logid
X-Urbn-Site-Id
X-Urbn-Context-Path
X-SayCDN-TTL
X-Soup
X-ServerID
X-LAGOON
X-GeoCountry
Load-Balancing
Locale
X-GeoCode
X-Tncms
X-Cache-Operation
X-JoinUs
Filters
X-Loop
X-Content-Age
X-Rewrite-Enabled
Cross-Origin-Window-Policy
X-Say-TTL
S-Rt
X-SaId
X-Director
X-Say-Cacheable
X-UPSTREAM-Address
X-Rn-Rsrv
Meta-Geo
X-URL
Onion-Location
X-Forwarded-Host
X-Cache-Action
OT-Force-Account-Verify
X-Container-Uri
X-Git-Commit
X-Cluster-Node
X-Served-From
X-Varnish-Cache-Hits
Azure-SiteName
X-Labrador-Cache-Channel
X-Varnish-Hostname
Azure-RegionName
X-R9-Blue-Green-Version
X-Adobe-Source
Azure-InstanceId
X-RM-Cache-TTL
X-VC-Cache
X-Ms-Request-Id
X-Lambda-Id
X-Source
X-Ms-Version
X-VCT
Azure-Version
X-PHP-Host
X-Tb
X-Detected-As
Web-Mar-Node
X-Skip-Cache
Azure-SlotName
X-Cache-Server
Node
X-Extlb
DB-Nickname
X-FB-TRIP-ID
Mn-Server-Ip
X-Sql-Count
X-Redis-Cache
X-RCS-CacheZone
X-Zipkin-Id
X-Sql-Duration-Ms
X-Proxied
X-Routing-Service
X-Logging-Id
Webcakes-App-Version
X-Proxy-Build
Webcakes-App-Name
X-Tumblr-Pixel-3
TWC-Privacy
X-Fetched-On
X-Tumblr-Pixel-2
X-Origin-Hint
TWC-GeoIP-LatLong
Webcakes-Region
Property-Id
X-Format
X-Uri
Selected-Fe
TWC-Connection-Speed
X-Timing-Wait
X-Generation-Time
TWC-GeoIP-Country
TWC-Device-Class
TWC-Locale-Group
X-Debug
X-TimeS
Fastcgi-Useragent
X-MCACHE
X-Endurance-Cache-Level
X-Proto
X-B3-SpanId
Source
Uber-Trace-Id
X-Zen-Fury
X-LSADC-Cache
X-Ua
X-S
X-Sucuri-ID
X-Sucuri-Cache
CDN-RequestId
NGB
Section-Io-Origin-Status
Section-Io-Id
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
X-Varnish-Ttl
X-XRDS-Location
Upgrade-Insecure-Requests
X-Ratelimit-Reset
X-Origin-CC
X-Origin-TTL
X-Oracle-Dms-Rid
X-Real-IP
X-Oracle-Dms-Ecid
X-Akamai-Transformed
X-Varnish-Hits
X-TraceId
X-Newrelic-Synthetics
X-Handled-By
X-Origin-Date
X-Drupal-Cache-Contexts
X-Pass-Why
X-MP-GENERATED-AT
X-Srv
X-RTag
MS-CV
Ms-Operation-Id
Fastly-Drupal-HTML
X-Cache-Expired-At
Apigw-Requestid
X-AB
X-Xfnlog-Site
X-Reqid
X-No-Session
X-Cms-Context
X-Optimistic-Header
X-Restarts
ServedBy
X-ProxyCache-Key
X-ProxyCache-Status
X-Cache-Host
X-BYPASS-REASON
Liferay-Portal
X-Geo-Region
WP-Super-Cache
X-Correlation-ID
X-CACHE-AGE
X-AWS-Id
X-IPLB-Instance
X-LJ-Flow-ID
X-VWS-Id
X-Hl-Ver
X-Cluster
X-IPLB-Request-ID
CDN-RequestPullCode
CDN-RequestCountryCode
CDN-EdgeStorageId
CDN-CachedAt
CDN-RequestPullSuccess
CDN-Uid
X-GEO
X-CSRF-Token
CDN-Cache
CDN-PullZone
X-Cache-Type
X-Cache-TTL-Remaining
X-Tx-Id
X-Proxy-Cache-Status
X-Upgrade-Enabled
X-UA-Device-Type
X-Cache-Status-Check
X-Fastly-Request-Id
X-Via-JSL
X-Node-Name
Cache-Provider
X-Generated-On
X-B-Cookie
X-Application
X-CF-Lambda-Fn
Candidate-Md5Url
Canary
X-Dispatcher-Number
X-Bl-Debug
X-Debug-Cache-Store
X-Destination
X-Level-Front-Cache
X-Developer
X-Debug-Cache-Fetch
X-D
X-CacheTTL
X-CGP
X-Conf
X-Cache-NE
X-Csrf-Jwt
X-CF-Lambda-Version
X-Bip
X-Fastly-Backend
X-External-Request-Id
X-Micro-Cache
X-FC-Vary-Parameters
BehaviorPad-Version
X-Eu-Site
X-Epic-Correlation-Id
X-BCube-Filmed-By
X-Ec-Custom-Error
X-Ec-Fail
X-Ec-GeoHdr
X-Bc-Bl
X-Owner
Magicmarker
X-Thanos
MD5-Digest
Meta-Geo-Continent
Ngx.Var.Host
N-Cache
True-Client-Country-4JS
Vix-Hermes-Req-Id
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
L5d-Success-Class
X-SRCache-Key
Lang
Odigeo-Trace-Id
X-Vdms-Path
Server-Host
Sslversion
X-Worker
Xc-Version
Redirect-Candidate
Rendered-Blocks
X-We-Are-Hiring
X-Vtex-Remote-Cache
Origin-Agent-Cluster
X-Vdms-Version
X-Viewer-Country
T-Server
Surrogated-Key
W
L
X-A-Dam
X-PAYTM-SRV-ID
X-A-Ccd
X-Pool
X-Qloud-Router
X-Pubstack
X-A-Dcw
X-A-Dgt
X-Aed
X-App
DCR-Decision-By
DCR-Processing-Time-Ms
X-A-Wwc
Fastly-SSL
X-A
X-ScT
Web-Mar-Region
Ha-Gx-Prefs
X-Rojux
X-S-Cookie
X-Request-Host
HA-Ipaddr
Gannett-Cam-Experience-Id
X-B3-Spanid
Cache-Name
X-Accel-Expires-Debug
X-ApacheServer
X-Cache-Info
X-Cdn-Diag
X-Alternate-Cache-Key
Req-Svc-Chain
X-Cache-Debug
X-Cache-Bucket
VNS-Cache
Thinkindot-Control
Thinkindot-CacheControl
TDXMobile
X-BBC-Edge-Cache-Status
X-App-Name
We-Hiring
Thinkindot-CacheControl-Type
VNS-Age
X-Irp-Debug
X-Storefront-Renderer-Rendered
X-Sorting-Hat-ShopId
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Thinkindot-L3
X-Tenant
X-Sorting-Hat-PodId
X-Sn-Servicetimems
X-Server-IP
X-SD-PageType
X-ShardId
X-Shop-Environment
X-Shopify-Stage
X-ShopId
X-Up
X-Var-Ttl
X-Wikidot-Backend
X-VServer
X-Wikidot-Static-Cache
Datacenter
X-Hash
Origin
X-Vmg-Version
X-VG-WebCache
X-Varnish-CookieHashed-On
X-Variation
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
X-VG-TLSProxy
X-Varnishpool
X-Request-Time
X-Refresh
X-Gdpr
X-Forwarded-Path
X-Geo-Header
X-GeoIP-Country-Code
X-Human
X-GeoIP-Region-Code
X-DPWN-IS-SECURE
X-Dispatcher-Server
X-Core-Mission
X-CMSURLCustom
X-Core-Value
X-Date
X-DefHash
X-DefElseHash
Release
X-Loc
X-Orig-Expires
X-Old-Content-Length
X-Origin-Time
X-PERF
X-Policy
X-Platform
X-Nyt-Route
X-NodeID
X-Mly-Id
X-Mid
X-Mvc-Supplant-Cachable
X-Nananana
X-Nitro-Cache
X-Clientip
X-Cdn-Origin
Cmstype
CPC-Age
Cmsid
CloudFront-Viewer-Country
AKAMAI
CPC-Cache
Environment
Gh-Request-Id
Fastly-GeoIP-CountryCode
Fastly-Backend-Name
Expect-Staple
Adler-Geo
X-AIR-PT
X-Vgn-Hpd-Reason
X-Server-W
X-Datadome
Producers
X-Browser-Name
X-Is-Desktop
X-Parent-Response-Time
X-Tcp-Rtt
X-Is-Tablet
X-Is-Mobile
Host-ID
X-Is-Supported-Browser
Platform
Is-Eu
Machine
Mail-Subject
X-TIME
AMP-Access-Control-Allow-Source-Origin
X-Accel-Version
X-INCAP-ABP
X-Hnp-Log
X-Gzip
NM-Fastcgi-Cache
X-Mvc-Supplant-OutputCached
Apple-News-Services-Handled
X-Nginx-Cache-Key
X-NCache
Server-Hostname
X-Cache-Id
X-GeoIP
X-Clara-WADP
X-Test
X-Wix-Viewer-Type
X-Esi-Check
X-Device-Os
X-Org
X-Fmm-Version
Esi-Enabled
X-Block-Status
X-Gen-Mode
X-From
X-Forwarded-Site
Sever-Int
Apple-News-Services-Parsed-Url
Country-Code
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
Server-Ext
Apple-News-Services-Host
X-S-Maxage
X-WADP-Cache
User-Cache-Control
X-WA-Info
DSUID
X-Accel-Buffering
X-Origin-Response-Time
Cf-Device-Type
CDCHOST
X-Node-Id
X-Op-Id-All
Apple-News-Services-Request-Url
X-Auto-Login
X-Origin
X-Buckets
X-Vcl-Version
X-Origin-Cache-Key
X-Ah-Environment
Pics-Label
Wxu-Next-Commit
X-Via-Fastly
X-LB-NoCache
X-Section
X-Instance-Name
Server-Info
X-Cache-Enabled
Wxu-Next-Hostname
Wxu-Next-Region
NGX
X-Access
Ssr
C-Via
X-Cdn-Srv
Content-Secure-Policy
X-Varnish-Beresp-Ttl
X-Zone
X-Varnish-Beresp-Grace
X-Dc
Server-ID
X-Amz-Meta-Cb-Modifiedtime
X-API-Version
IsBot
X-CACHE-GROUP
YJS-ID
X-Akamai-Device-Characteristics
X-SIPLIST1
X-Presslabs-Stats
X-HA-Backend
Cdn-Requestid
X-B3-Parentspanid
CF-Ctrl
X-WP-CF-Super-Cache-Active
X-Frame-Option
X-Cached-By
Sid
X-TA-CDN-Provider
X-Platform-Router
X-Internal-Host
X-JWT-State
X-Platform-Processor
X-Platform-Cluster
Location
X-Is-Gdpr
Cache-Hits
X-FTR-Balancer
X-FTR-Cache-Status
X-FTR-Expires
X-Has-Esi
X-FTR-Backend-Server
X-FTR-Backend
X-Country-Code-Real
Memcached
X-Air-Trace-Id
X-Air-Source
X-Air-Hostname
Time
X-Fpc
Hostname
X-TIM-N
Memory
X-LiteSpeed-Cache-Control
X-Wp-Cf-Super-Cache-Active
X-Webstats-RespID
X-Scale
X-Hyper-Cache
Origin-CC
X-Tb-Optimization-Total-Bytes-Saved
Origin-EX
X-Backend-Instance
X-Service
X-DC
X-Cs
X-VC
X-ID
X-SRV
X-PHP-Backend
X-ZONE
Epwk-X-Cache
X-Site-Version
X-VCache
True-Client-Ip
X-DataCenter
X-NewRelic-App-Data
Resin-Trace
LB
Cdn-Request-Time
Cdn-Host
X-NGINX-Cache
Uri
X-Azure-Ref-OriginShield
X-Esi
Req-ID
X-Edge-Server
X-Locale
X-Webkit-Csp-Report-Only
X-NMSegId
GeoIP-Latitude
X-Nitro-Cache-From
X-Microcachable
X-Ad-Load-Variation
GeoIp-Country-Code
X-Nitro-Rev
X-NODE
X-Request-URI
WZWS-RAY
GeoIP-Country-Code
XServer
X-Datacenter
X-M-Log
X-Request-Start
X-M-Reqid
X-Geo
X-Scope-Id
X-Origin-Expires
HostName
X-Cache-Ttl
Pramga
Cache-Host
X-CSRF-TOKEN
XM
X-Varnish-Beresp-Status
M-TraceId
Cdn
X-Shield-Cache-Expires
NtCoent-Length
SID
Cluster
Content-Style-Type
True-Client-IP
Content-Script-Type
X-Vercel-Cache
X-Qnm-Cache
X-Info
X-Vercel-Id
X-WP-CF-Super-Cache-Cookies-Bypass
X-Cache-Date
WebServer
X-HN
X-Pad
PFcat
Cache-Tv-Group
X-VarnishDD-TTL
X-Github-Request-Id
X-Pod-Name
Fastly-Drupal-Html
X-TH-Server
X-Ad-Defer-Variation
X-Web-Node
User-Agent
X-FPC
X-HostName
Tcn
X-LiteSpeed-Tag
A
X-V-Cache
X-LB-ID
X-Via-Poph
X-Nc
X-Servedbyhost
X-Wa
Locid
X-Via-Popv
X-Cache-FS-Status
X-Via-Popn
Edge-Copy-Time
Srvid
Tube-Return
X-FL-QIT-DEBUG
X-FL-EDGE
X-MSEdge-Features
X-MSEdge-Flight
X-Via-Edge
X-Via-CDN
Click-Count-Action-Start
Click-Count-Error
X-Acquia-Purge-Cdn-Unconfigured
X-Aicache-OS
X-Via-SSL
Tube-Got-Results
Tube-Get-Contents
Tube-Got-Eval
X-B3-Trace-ID
X-APP-VERSION
CountryCode
X-Api-Version
X-CS
Cf-Ipcountry
X-Cdn-Request-ID
Priority
X-Req
X-Vary
Edge-Cache
X-Men
X-SB
X-Amz-Meta-Opti
Cdnsip
Cdncip
X-AK-Request-ID
X-NWS-UUID-VERIFY
V-Age
On-Server
X-Contensis-Viewer-Groups
X-Cache-ASPX
X-Akamai-Pragma-Client-IP
X-Varnish-Authentication
X-Moov-T
Path
X-ATG-Version
X-FireWall-Port
Ngx-Var-Key
X-Branch-Name
X-Moov-Xdn-Version
MIME-Version
X-VCL-Version
X-Wp-Cf-Super-Cache-Cookies-Bypass
My-App
X-Fastly-Backend-Reqs
X-Proxy-CacheRZ
XkeyRZ
Yak-Timeinfo
Cache-Key
Lb
X-Provided-By
X-UA
CDN
X-CACHE-KEY
X-Tim-N
X-Render-Time
X-Acquia-Site
X-Fastly-Country-Code
X-Cdn-Forward
Proxy-Connection
Wpo-Cache-Message
X-Varnish-Director
Wpo-Cache-Status
Geoip-Latitude
Srv
X-Acquia-Application-Trace
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
Cache
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-Lb-Cache
X-User
X-Air-Pt
X-Ha-Backend
Server-Id
X-Generated-In
X-TT-LOGID
X-TRACE-ID
PICS-Label
X-Wp-Cf-Super-Cache-Cache-Control
Cross-Origin-Embedder-Policy-Report-Only
Ohc-Cache-HIT
X-Wp-Cf-Super-Cache
X-Cdn-Cache-Status
X-Dw-Trace-Id
X-Via-Ucdn
X-Planisys-CDN-Cache
X-Check-Cacheable
Ohc-File-Size
State
X-Lb-Nocache
X-Platform-Server
X-Serial
CF-Cached-On
X-HS-Content-Campaign-Id
X-EC-Lua
X-Planisys-CDN-TTL
X-GoCache-CacheStatus
X-Planisys-CDN-Rules
X-CUA
X-GeoIP-City
X-Gamma-Serve
X-Upstream-Ht
X-Iplb-Instance
X-Iplb-Request-Id
Yjs-Id
X-TX-ID
X-Upstream-Ct
X-Release
X-Mg-Cache
Fusion-Component-Id
Vha6-Origin
Fusion-Content-Id
Fusion-Template-Id
Mime-Version
Warning
X-CDN-Cache-Status
Type
Fusion-Deployment-Id
Fusion-Source
Fusion-Content-Source
Log-Origin
X-Miniprofiler-Ids
X-Udemy-Cache-App-Namespace
X-Snapshot-Date
X-CF-Cache-Header-Vary
X-CF-Cache-Header-Cache-Control
Cneonction
X-Fastly-Cache-Hits
X-Fastly-Cache
X-RAMCache
X-HS-Status
X-Cache-Remote
X-Litespeed-Cache-Control
X-ElasticPress-Query
Ngx
X-Vgn-Hpd-Variations-Key
X-Vgn-Hpd-Cached
X-Vgn-Hpd-Ssi
Inserted-Into-Cache-At
X-Cached-Since