Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Cf-Request-Id
CF-RAY
CF-Cache-Status
Last-Modified
X-XSS-Protection
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-Runtime
X-AspNet-Version
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Cache-Status
X-Generator
X-Request-ID
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Content-Security-Policy
Content-Encoding
X-CDN
X-Envoy-Upstream-Service-Time
Status
Feature-Policy
X-Ua-Compatible
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
X-AspNetMvc-Version
Access-Control-Max-Age
X-Via
Upgrade
Keep-Alive
X-Ws-Request-Id
X-Age
X-Turbo-Charged-By
X-AH-Environment
X-Robots-Tag
Request-Context
X-Proxy-Cache
EagleId
X-Cache-Group
Server-Timing
X-Backend
X-Hacker
X-Amz-Request-Id
Report-To
X-Server
Host-Header
X-Amz-Id-2
X-Server-Powered-By
Grace
X-Nginx-Cache-Status
X-UA-Device
X-LiteSpeed-Cache
X-Dns-Prefetch-Control
X-Varnish-Cache
X-Rq
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-Page-Speed
Cf-Railgun
X-Pingback
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
NEL
X-Amz-Version-Id
X-OneAgent-JS-Injection
Xkey
X-WebKit-CSP
X-Cache-Spec
Allow
X-Backend-Server
X-Host
X-CST
X-Vhost
X-Device
EagleEye-TraceId
X-Server-Id
X-ASPNET-VERSION
Surrogate-Control
Request-Id
X-Dispatcher
Accept-CH
X-Node
Content-Location
X-Response-Time
Accept-CH-Lifetime
X-Akam-SW-Version
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Ruxit-JS-Agent
X-Template
X-Ac
X-Language
X-Application-Context
X-Kinja-Server-Push
X-Cache-Lookup
X-Country
X-Readtime
X-Mod-Pagespeed
X-Cloud-Trace-Context
MS-Author-Via
X-B3-TraceId
X-Origin-Cache
Rating
X-Cnection
X-MS-InvokeApp
X-Url
X-HW
X-Vname
X-TtlSet
X-PC
X-ORACLE-DMS-ECID
Accept-Ch
X-Clacks-Overhead
X-FastCGI-Cache
X-GitHub-Request-Id
Edge-Control
X-ESI
Accept-Ch-Lifetime
X-Trace
X-Middleton-Response
Response
Pagespeed
X-Middleton-Display
Display
X-Sol
X-Content-Type
X-Vcap-Request-Id
Arr-Disable-Session-Affinity
X-Kinja-Revision
X-Kinja-Build
X-Kinja-Server
X-Use-Magma
X-D2id
Verso
X-Kinja
X-GoogleNews-Bot
X-Cdn-Fetch
X-Exp-Variant
X-Exp-Id
X-Buckets
X-Goog-Hash
X-Rack-Cache
X-Server-Name
X-Country-Code
Service-Worker-Allowed
X-Navigation-Version
X-Varnish-TTL
X-VARITI-CCR
X-Abt-Application-Version
X-Amz-Rid
X-Oneagent-Js-Injection
X-Pinterest-Rid
Pinterest-Version
X-ORACLE-DMS-RID
Pinterest-Generated-By
X-Powered-By-Plesk
X-Cache-TTL
X-Client-IP
SPRequestGuid
X-SharePointHealthScore
X-Fastly-Request-ID
X-Release
SPRequestDuration
X-MSEdge-Ref
SPIisLatency
X-Dw-Request-Base-Id
X-Element-Page-Cache
Fastly-Restarts
X-NF-Request-ID
X-Cached
Public-Key-Pins
Mrf-Cache-Status
X-B3-TraceId-Primal
MRF-Tech
RTSS
X-Ttl
X-Origin-Upstream-Status
Ar-Sid
X-Edge
AR-CACHE
AR-ATIME
AR-Request-ID
AR-PoweredBy
Access-Control-Request-Method
X-TTL
X-Px
X-SRCache-Fetch-Status
X-Webkit-CSP
X-SRCache-Store-Status
X-LLID
X-Powered-CMS
Fusion-Content-Id
Fusion-Content-Source
Fusion-Template-Id
Fusion-Component-Id
Fusion-Source
Fusion-Deployment-Id
X-Ezoic-Cdn
X-Upstream
Content-MD5
X-Jurisdiction
X-HP-Webp
X-MCACHE
X-Mid
X-ECACHE
X-Amz-Server-Side-Encryption
Charset
X-Recruiting
Cache-Tag
X-Content-Digest
X-Mg-S
S
X-Pinterest-Direct
X-PressLabs-Stats
X-Version
X-Aspnetmvc-Version
TCN
MicrosoftSharePointTeamServices
Fastcgi-Cache
Front-End-Https
X-Debug
X-T
X-Content-Security-Policy-Report-Only
X-Grace
Filters
X-Kinsta-Cache
Cache-Tags
Server-Node
Edge-Cache-Tag
X-XRDS-Location
X-Id
X-Forwarded-Proto
X-Accel-Expires
X-Logged-In
X-Correlation-Id
X-Amzn-Trace-Id
X-Yandex-Sdch-Disable
Server-Name
Nginx-Cache
Surrogate-Key
X-Varnish-Age
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Cache-Key
X-Forwarded-For
TP-L2-Cache
TP-Cache
X-B3-Sampled
X-Request-Processing-Time
X-Request-Received
X-DynaTrace
X-Microsite
X-Request-Handler-Origin-Region
X-Hits
X-Ser
X-DIS-Request-ID
Powered-By-ChinaCache
X-Shield-Request-Id
X-AppVersion
X-Az
X-Activity-Id
X-Amz-Replication-Status
X-Server-ID
X-F-Cache
X-HS-Cache-Config
X-HS-Hub-Id
X-HS-Content-Id
X-Ruxit-Js-Agent
X-HS-Combine-CSS
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-GUploader-UploadID
Accept-Charset
X-Origin-Server
X-FTR-Request-ID
X-Git-Hash
X-Respond-Thread
X-Hostname
X-Geo-Country
X-LB-Cache
X-DataDome
X-Upgrade-Enabled
Section-Io-Cache
X-Rid
X-Frontend
Access-Control-Allow-Method
X-Cache-Age
Cache
Alternate-Protocol
X-Mobile-URL
Host
Cleartype
X-Cdn
MS-CV
Paypal-Debug-Id
Healthy
X-IPLB-Instance
X-Type
X-Content-Options
ServerID
X-WebKit-CSP-Report-Only
X-AOL-HN
X-Whom
X-App-Environment
Payment
X-Seen-By
X-B-Cache
X-Route-Name
X-Signature
X-Cache-Action
X-Request-Guid
X-Aspnet-Duration-Ms
X-Varnish-Backend
X-Is-Crawler
X-Flags
X-Debug-Info
X-Providence-Cookie
X-TT
X-VCache
X-XRDS-LOCATION
Fastcgi-Useragent
X-Page-Id
X-Jobs
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-NWS-LOG-UUID
X-N
X-Source
X-Mobile
X-Browser-Type
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Load-Cache
X-RateLimit-Remaining
X-Time
X-Via-JSL
X-Cached-By
X-Daa-Tunnel
X-FB-Debug
X-Akamai-Edgescape
Version
Nel
X-Litespeed-Cache
X-Cache-Rule
X-Cache-Operation
Viewport
Refresh
X-Original-Request-Id
X-Response-Served-From
X-Rule
X-Accel-Buffering
DynaTrace
X-Proxy
X-Zen-Fury
X-Drupal-Cache-Tags
DC
X-Framework
X-Cacheable-TTL
X-ProcessESI
X-RemovedCookies
X-RTag
Realpath
X-Instance
Ms-Operation-Id
GEO-INFO
Access-Control-Request-Headers
X-Tt-Trace-Tag
X-Fastcgi-Cache
X-Contextid
X-Tt-Trace-Host
X-Real-IP
X-Region
X-UUID
X-Cache-Time
X-Wix-Request-Id
X-Distributor
X-Drupal-Cache-Contexts
X-HTML-Minification-Powered-By
Referer-Policy
X-Yottaa-Optimizations
X-Page-View
X-Yottaa-Metrics
X-Cache-Expired-At
Countrycode
X-FW-Hash
X-FW-Dynamic
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-FW-Serve
Eomportal-Instance
X-FW-Static
X-FW-Type
X-FW-Server
X-B
Node
X-L-Path
X-Environment-Context
X-Cluster-Name
Liferay-Portal
X-Cache-Control
X-Tumblr-User
X-Node-Name
X-G
X-Tumblr-Pixel-1
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Content-Powered-By
X-IPS-LoggedIn
X-Cache-Hit
X-User-Agent
X-Tumblr-Pixel-2
Server-Info
Webserver
X-Pass-Why
X-Amz-Meta-S3cmd-Attrs
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
Section-Io-Id
From-Origin
Section-Origin-Responded
X-App-Server
X-Varnish-Ttl
X-Ratelimit-Limit
SRV
Protected
Ec-Rule-Version
X-Protected-By
X-FireWall-Port
X-Revision
X-Oracle-Dms-Rid
X-Backend-Name
Frame-Options
X-Cache-Server
Cache-Status
CF-IPCountry
X-Handled-By
X-RN-RSRV
Meta-Geo
X-Hl-Ver
X-Hyper-Cache
X-Mode
X-Www-Served-By
X-Endurance-Cache-Level
X-ES-SERVER
X-UPSTREAM-Address
Retry-After
X-NYM-Debug-Backend
X-Locale
X-Site-Version
X-Forwarded-Host
X-Soup
X-FB-TRIP-ID
X-Storage
X-Varnishpool
X-Cache-Grace
X-Human
X-Web-Node
X-Pubstack
Fastly-SSL
Decoy-Debug-TTL
Decoy-Debug-Key
Country
Cache-Tv-Group
Decoy-Debug-Status
X-Adobe-Loc
X-Adobe-Content
Azure-RegionName
Azure-InstanceId
X-Be
TWC-Connection-Speed
Azure-SiteName
X-Format
TWC-Device-Class
TWC-GeoIP-Country
TWC-GeoIP-LatLong
X-BYPASS-REASON
TWC-Locale-Group
TWC-Privacy
Webcakes-App-Name
Webcakes-Region
Selected-Fe
X-Say-Cacheable
X-Access
X-Labrador-Cache-Channel
X-Proxy-Build
X-Section
X-Proto
X-ProxyCache-Key
X-ProxyCache-Status
X-Uri
X-Timing-Wait
Cache-Name
X-PHP-Host
X-PCL
X-TT-LOGID
Property-Id
X-Redis-Cache
Azure-Version
X-Say-TTL
X-Origin-Hint
X-SayCDN-TTL
X-OCL
Azure-SlotName
Webcakes-App-Version
X-S-Maxage
X-WA-Info
X-LAGOON
X-PERF
X-Via-CDN
X-Origin-Date
X-Server-W
X-FW-Version
X-ApacheServer
X-UA-Device-Type
X-Sql-Count
X-Sql-Duration-Ms
X-AIR-PT
X-Via-Fastly
X-TNCMS
X-Request-Time
X-Loop
X-No-Session
X-Hosted-By
X-R9-Blue-Green-Version
X-AWS-Id
X-FTR-Cache-Status
X-FTR-DC
X-FTR-Balancer
X-MP-GENERATED-AT
S-Cnection
X-Cluster
X-Country-Code-Real
X-LJ-Flow-ID
X-FTR-Backend
Mn-Server-Ip
X-FTR-Backend-Server
X-FTR-Realm
X-Status
X-VWS-Id
X-Qloud-Router
X-Shopify-Stage
X-ShopId
X-Storefront-Renderer-Rendered
X-Sorting-Hat-PodId
X-Routing-Service
X-Sorting-Hat-ShopId
X-Cache-TTL-Remaining
X-CCM
X-Zipkin-Id
X-ShardId
X-Alternate-Cache-Key
X-Proxied
X-Ratelimit-Remaining
X-Xfnlog-Site
Cache-Hits
X-FTR-Expires
Xserver
X-Rendered-As
X-Is-Bot
X-Dynatrace
X-Unique-Id
X-Device-Type
X-Tec-Api-Version
X-Tec-Api-Origin
X-Tec-Api-Root
X-Cache-Var-Map
X-Cache-Var
X-Air-Hostname
X-SRV
X-Detected-As
X-EdgeConnect-Cache-Status
X-Info
AMP-Access-Control-Allow-Source-Origin
X-Nginx-Cache
Apigw-Requestid
X-Webkit-Csp
X-Cache-Host
X-Amz-Apigw-Id
X-Amzn-Remapped-Content-Length
X-Amzn-RequestId
X-Dc
X-Microcachable
X-Debug-IsPreview
X-Debug-IsConnected
X-Cache-Enabled
X-GEO
X-Varnish-Grace
SD-X-WS
X-Content-Age
X-Varnish-Server
X-Platform
Tracecode
Amp-Access-Control-Allow-Source-Origin
X-Time-Microsecs
X-Azure-Ref
X-Backend-TTL
X-Backend-Host
X-GG-Cache-Date
Uber-Trace-Id
X-APP-VERSION
X-ServerID
X-Cache-Backend
X-DynaTrace-JS-Agent
X-Proxy-Cache-Status
DSUID
X-Erf-Stays-Bingo-Pdp-Web
X-Oss-Hash-Crc64ecma
Akamai-GRN
X-Tb
X-Oss-Object-Type
X-Oss-Request-Id
X-Oss-Storage-Class
X-BCube-Filmed-By
X-Oss-Server-Time
X-NewRelic-App-Data
X-ATG-Version
Backend
X-Sucuri-ID
X-ID
PB-RID
X-Trace-Id
Arc-Version
PB-PID
X-Akamai-Transformed
X-Magnolia-Registration
X-Correlation-ID
ServedBy
Meta-Geo-Continent
DCR-Processing-Time-Ms
X-Varnish-Cache-Hits
MD5-Digest
Expiry
Machine
DCR-Decision-By
BehaviorPad-Version
X-RCS-CacheZone
X-Cache-PHP
Instruction
Lfy
Fastcgi-X-Cache-Version
X-Cache-NGX
X-Varnish-Hostname
X-Aed
X-PBS-Appsvrname
X-PAYTM-SRV-ID
X-Processor
X-Request-UUID
X-Rojux
X-Rewrite-Enabled
X-Origin-TTL
X-Origin-CC
X-GeoIP-City
X-Generation-Time
X-Level-Front-Cache
X-Location
X-Matched-Rule
X-S
X-S-Cookie
X-VG-WebServer
X-VG-WebCache
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
Xc-Version
X-Vdms-Version
X-Vdms-Path
X-Session-Fingerprint
X-ScT
X-SRCache-Key
X-Thinkindot-L3
X-Trv-Group
X-Generated-On
X-From
Thinkindot-CacheControl-Type
Thinkindot-CacheControl
Thinkindot-Control
X-A
X-A-Dam
X-A-Ccd
T-Server
SR-User-Adfree
Path
Odigeo-Trace-Id
Pramga
Release
Rendered-Blocks
X-A-Dcw
X-A-Dgt
X-Destination
X-D
X-Device-Os
X-External-Request-Id
X-Fetched-On
X-Connection-Hash
X-CF-Lambda-Version
X-Application
X-A-Wwc
X-ARC
X-Cache-NE
X-CF-Lambda-Fn
Mobile-Detection-Method
X-B-Cookie
X-Origin-Response-Time
X-CSRF-Token
X-Irp-Debug
X-Azure-Ref-OriginShield
X-JWT-State
Gh-Request-Id
Ha-Gx-Prefs
Host-ID
HA-Ipaddr
Fastly-Backend-Name
X-Micro-Cache
Cf-Device-Type
X-OVcl
X-OVcl-Cache
X-Node-Id
Cache-Host
X-HS-Content-Campaign-Id
X-Mvc-Supplant-Cachable
X-Owner
X-Has-Esi
X-Cdn-Origin
X-NWS-UUID-VERIFY
X-CGP
X-Cache-Info
X-Cache-Date
X-Backend-State
X-Bip
X-Cache-Bucket
UCS
X-Csrf-Jwt
X-Generated-In
X-Geo-Header
C-Via
X-FC-Vary-Parameters
X-Eu-Site
Ssr
X-Adobe-Source
L5d-Success-Class
X-Is-Gdpr
X-SVT-ORM-RULES
X-Sn-Servicetimems
X-User
X-SVT-ORM-VERSION
AKAMAI
X-Tumblr-Pixel-3
X-Swa-Ws
X-VServer
X-Ms-Version
X-Debug-Cache
X-Thanos
X-Skip-Cache
X-Ms-Request-Id
DB-Nickname
Server-Ext
X-Envoy-Decorator-Operation
X-Fastly-Cache
On-Server
User-Cache-Control
X-B3-Traceid
X-Generated-By
Pagetype
Server-Host
PFcat
X-Fastly-Backend
X-Developers
Wxu-Next-Hostname
Wxu-Next-Commit
V-Age
Wxu-Next-Region
X-Cache-Tags
X-TrackingId
X-Wikidot-Static-Cache
X-Wikidot-Backend
X-Clientip
X-Cms-Context
X-Varnish-Hits
X-GeoIP
Sever-Int
X-Developer
X-CUA
X-VarnishDD-TTL
X-Core-Value
Server-Hostname
NGX
X-Cache-Remote
X-Origin-Expires
X-Request-Host
X-Reqid
X-Scheme
CloudFront-Viewer-Country
X-Nginx-Cache-Key
Content-Disposition
X-Request-URI
X-Policy
X-IP
X-HN
Locid
CacheControlHeader
L
X-Var-Ttl
Magicmarker
X-Rebelmouse-Cache-Control
X-Clara-WADP
Location
X-NU-AKA-ACS-Version
X-Block-Status
X-Branch-Name
X-Origin
X-WADP-Cache
X-Cache-Id
X-Cache-Expires
X-Request-Start
X-Platform-Server
X-Old-Content-Length
X-Rebelmouse-Surrogate-Control
X-VG-TLSProxy
X-Servername
X-Hnp-Log
X-Fmm-Version
X-Varnish-CookieHashed-On
X-TX-ID
X-Gen-Mode
X-Varnish-Beresp-Grace
X-Gzip
X-Variation
X-Ratelimit-Reset
X-Varnish-CookieINHashed-On
X-Esi-Check
X-Loc
X-Method
X-GoCache-CacheStatus
X-DefElseHash
X-DPWN-IS-SECURE
X-LI-UUID
X-Li-Fabric
X-Li-Pop
X-SIPLIST1
X-Varnish-Remaining-TTL
X-DefHash
Platform
Origin
IsBot
Rt-Fastcgi-Cache
True-Client-Country-4JS
Web-Mar-Node
Vix-Hermes-Req-Id
Is-Eu
Fastly-SWR
Apple-News-Services-Host
Apple-News-Services-Handled
Adler-Geo
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
Fastly-SIE
Cf-Bgj
X-TA-CDN-Provider
CDCHOST
X-NC
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
NM-Fastcgi-Cache
X-Gamma-Serve
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Dispatcher-Server
Fastly-Drupal-HTML
CDN-Uid
CDN-EdgeStorageId
CDN-CachedAt
CDN-PullZone
CDN-RequestCountryCode
X-Slack-Backend
CDN-RequestId
CDN-Cache
X-B3-Spanid
X-Cache-Debug
X-NAPM-TraceId
X-App-Version
HostName
X-EC-Lua
CACHE
X-NCache
Url
X-Core-Mission
X-Hash
X-Varnish-Url
X-Host-Name
X-CS
X-Varnish-Cacheable
X-Aicache-OS
X-Response-By
X-Cdn-Forward
X-Mvc-Supplant-OutputCached
S-Rt
X-PF-Uncompressing
X-B3-SpanId
X-LB-ID
X-Refresh
X-Proxy-Cachei7
X-CACHE-GROUP
Xkeyi7
Pics-Label
X-BBXSRF
N-Cache
Cross-Origin-Window-Policy
Sid
X-CDN-Forward
Content-Secure-Policy
X-Via-Poph
X-Esi
X-FireWall-Protection
Esi-Enabled
X-Via-Popn
X-Via-Popv
X-Cache-2
X-Sucuri-Cache
Ohc-File-Size
X-Cc-Req-Id
X-Cc-Via
Cteonnt-Length
X-Epic-Correlation-Id
X-Contensis-Viewer-Groups
X-Varnish-Authentication
X-Cache-ASPX
D-Cc-Upstream
Source
X-Tb-Optimization-Total-Bytes-Saved
X-RateLimit-Limit
X-Nc
X-Svr
X-Error
X-DC
MIME-Version
X-Servedbyhost
X-TraceId
X-Wa
Who
X-Srv
X-Cs
X-TIME
X-Unique-ID
Req-Svc-Chain
Country-Code
Geoip-Latitude
X-Server-IP
X-Webkit-CSP-Report-Only
Server-Ttl
HitType
XServer
X-LiteSpeed-Cache-Control
X-Planisys-CDN-Rules
Hostname
GeoIp-Country-Code
X-Gdpr
X-Planisys-CDN-Cache
X-Nyt-Route
X-Cache-Config
X-API-Version
X-Origin-Time
X-Planisys-CDN-TTL
X-FPC
X-SN
X-LI-Proto
X-HS-Status
X-VC
X-URL
X-NGINX-Cache
X-Fastly-Request-Id
Ohc-Cache-HIT
Server-ID
X-VCL-Version
X-Webstats-RespID
X-SB
X-NodeID
Svr
Cmsid
Cmstype
X-CACHE-KEY
Geo-Info
Kp-EeAlive
X-Check-Cacheable
X-SD-PageType
X-Served-From
VivaBuild
Viewtype
SID
X-Viewer-Country
A
X-Ua
X-Render-Time
X-Vgn-Hpd-Reason
Cache-Key
X-HOST
NtCoent-Length
X-Hcs-Proxy-Type
Request-ID
X-Vcl-Version
M-TraceId
X-CCDN-CacheTTL
EpKe-Alive
X-CCDN-Origin-Time
X-BBC-Edge-Cache-Status
X-UA
X-DI
Resin-Trace
X-RAMCache
X-DW
X-Li-Proto
Cache-Provider
X-RPM
X-FORWARDED-FOR
X-DB
X-CF-Powered-By
X-Worker
X-Air-Source
Server-Id
Cross-Origin-Opener-Policy
Arc-Country
X-CSRF-TOKEN
X-DSS
X-TIM-N
X-RPS
X-RSL
TDXMobile
X-Auto-Login
X-Ftr-Cache-Host
X-Dynatrace-Js-Agent
Filterid
GeoIP-Country-Code
ProcessTime
X-App
Upgrade-Insecure-Requests
X-Internal-Host
GeoIP-Latitude
X-Vc
X-COUNTRY
X-Action
Processtime
X-Cluster-Node
CDN
Srv
X-Newrelic-Synthetics
Datacenter
X-FTR-Cache-Host
X-WA
Mime-Version
X-Oss-Cdn-Auth
X-Fpc
X-Service
Tcn
X-ServedByHost
NGB
CF-Cached-On
X-CLOUD-TRACE-CONTEXT
X-Geo
X-BBC-Origin-Response-Status
Proxy-Connection
OT-Force-Account-Verify
X-HITS
X-HostName
X-SaId
Cdn
X-Via-PopV
X-Via-NSCOPI
X-Akamai-Pragma-Client-IP
X-ND-Cache
X-Via-PopH
X-Via-PopN
X-PHP-Backend
WZWS-RAY
X-Dw-Trace-Id
X-NGENIX-Cache
X-MSEdge-Features
X-MSEdge-Flight
FSS-Cache
X-Fastly-Backend-Reqs
X-BACKEND-TTL
X-JoinUs
X-Cache-Tag
X-Forwarded-Site
DataCenter
X-Client-Ip
X-Edge-Location
X-Cdn-Request-ID
X-CACHE-AGE
X-Extlb
X-Lb-Id
Dnion-Transfer-Encoding
W
X-IN-APIGATEWAY
PICS-Label
X-IN-APIGATEWAYSSL
X-Hello
X-Flog
X-Parent-Response-Time
X-Pf-Uncompressing
X-ABtesting
X-Provided-By
Surrogated-Key
Vha6-Origin
Epwk-X-Cache
Media-Length
X-LiteSpeed-Tag
X-Swift-Error
LB
Memcached
X-Bc-Bl
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-Region-Sid
X-Req
X-VC-Cache
X-UnsetCookies
X-Proxy-Upstream
X-PJAX-URL
X-Accel-Expires-Debug
X-Oracle-DMS-ECID
X-Date
X-Depends-On
X-Pad
X-Presslabs-Stats
We-Hiring
X-Rocket-Build-Number
X-Sigma
X-Sigma-Backend
Env
X-MiniProfiler-Ids
Memory
Time
Mail-Subject
Xet-Cookie
X-ZONE
URI
X-Zone
Cf-Ipcountry
X-Akamai-ERRuleID
X-Varnish-Beresp-TTL
X-Acquia-Application-UUID
X-Akamai-ERPolicy
X-Acquia-Purge-Tags
X-Vcache
X-Akamai-Request-ID
X-Acquia-Site
X-APP
X-Snapshot-Date
X-ElasticPress-Query
X-Acquia-Application-Trace
X-Men
X-Request-URL
X-Ms-Meta-Originalurl
X-Request-Url
X-Amz-Meta-Cb-Modifiedtime
X-B3-Parentspanid
X-Varnish-URL
X-Air-Trace-Id
X-Csrf-Token
X-ElasticPress-Search
X-Ms-Meta-Staticbatchstarttime
CountryCode
X-Tid
X-Storefront-Renderer-Verified
X-Redis-Duration-Ms
Inserted-Into-Cache-At
X-Redis-Count
Environment
X-Acc-Debug-Context
X-C
Content-Script-Type
X-Via-SSL
Ohc-Response-Time
Phost
NnCoection
Content-Style-Type
Edge-Copy-Time
X-Traceid
X-ServerName
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-Litespeed-Cache-Control
X-Acc-Rdl
X-Via-Edge