Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-Cache-Status
Link
Accept-Ranges
CF-RAY
ETag
Expect-CT
Pragma
X-Powered-By
X-XSS-Protection
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-UA-Compatible
P3P
X-Served-By
X-Xss-Protection
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-AspNet-Version
X-Adblock-Key
X-Runtime
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-DNS-Prefetch-Control
X-Drupal-Cache
X-Cache-Status
X-Check
X-Generator
X-Cacheable
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Content-Security-Policy
X-Iinfo
Feature-Policy
Status
X-Envoy-Upstream-Service-Time
Content-Encoding
Access-Control-Expose-Headers
P3p
X-Drupal-Dynamic-Cache
X-CDN
X-AspNetMvc-Version
Upgrade
X-Via
CF-Ray
X-Ws-Request-Id
Access-Control-Max-Age
X-Request-ID
Server-Timing
EagleId
X-Cache-Group
Report-To
X-Turbo-Charged-By
Keep-Alive
X-UA-Device
Request-Context
X-Age
X-Backend
X-Proxy-Cache
X-Server-Powered-By
X-AH-Environment
X-Robots-Tag
X-Hacker
X-Amz-Request-Id
X-Server
Host-Header
X-Amz-Id-2
Grace
X-Rq
X-LiteSpeed-Cache
X-Swift-SaveTime
X-Swift-CacheTime
X-Varnish-Cache
X-Nginx-Cache-Status
Ali-Swift-Global-Savetime
X-WebKit-CSP
NEL
X-Page-Speed
X-Vhost
EagleEye-TraceId
X-Ua-Compatible
X-Amz-Version-Id
X-OneAgent-JS-Injection
X-Pingback
X-Dispatcher
X-Device
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Cache-Spec
Accept-CH
X-Host
X-Server-Id
X-Dns-Prefetch-Control
Cf-Railgun
X-Node
X-Backend-Server
X-Readtime
Surrogate-Control
X-Akam-SW-Version
Request-Id
X-Response-Time
X-HW
Xkey
X-Application-Context
Content-Location
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Rating
Accept-CH-Lifetime
X-Country
X-Cloud-Trace-Context
X-Ruxit-JS-Agent
X-B3-TraceId
X-Cache-Lookup
Accept-Ch-Lifetime
X-Trace
X-Url
Allow
X-Ac
X-Content-Type
X-PC
X-TtlSet
X-Vname
X-Varnish-TTL
X-Clacks-Overhead
X-Aws-Lambda-Call-Status
Edge-Control
X-Server-Name
X-Mod-Pagespeed
X-ESI
Fastly-Restarts
Cache-Tag
Service-Worker-Allowed
X-FastCGI-Cache
X-VARITI-CCR
X-Rack-Cache
X-Element-Page-Cache
Verso
MS-Author-Via
X-Upstream
X-Vcap-Request-Id
X-MS-InvokeApp
X-Amz-Rid
Public-Key-Pins
X-GitHub-Request-Id
X-Dw-Request-Base-Id
X-Cached
X-Client-IP
X-Abt-Application-Version
X-D2id
X-Cache-TTL
X-Cnection
X-Px
RTSS
X-Exp-Id
X-Cdn-Fetch
X-GoogleNews-Bot
X-Use-Magma
X-Kinja-Server
X-Kinja-Build
X-Kinja
X-Exp-Variant
X-Kinja-Revision
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-Navigation-Version
Arr-Disable-Session-Affinity
X-Country-Code
X-Powered-By-Plesk
Access-Control-Request-Method
X-NF-Request-ID
X-Goog-Hash
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-Instrumentation
X-Powered-CMS
Pagespeed
Display
X-Sol
X-Middleton-Display
AR-CACHE
AR-Request-ID
AR-SID
AR-ATIME
AR-PoweredBy
X-Version
X-Origin-Cache
Response
X-Middleton-Response
X-TTL
X-LLID
X-MSEdge-Ref
X-Amz-Server-Side-Encryption
Nginx-Cache
TCN
X-Edge-Location-Klb
X-Kinsta-Cache
X-RateLimit-Remaining
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Edge
X-Protected-By
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-CST
X-T
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
X-Content-Security-Policy-Report-Only
X-Forwarded-For
X-Shield-Request-Id
X-Aspnetmvc-Version
X-Mg-S
X-Id
S
Edge-Cache-Tag
Content-MD5
X-Language
X-Ruxit-Js-Agent
SPIisLatency
SPRequestDuration
Fastcgi-Cache
Front-End-Https
Realpath
X-Mid
X-Request-Processing-Time
X-Request-Received
Server-Node
Pinterest-Version
X-Recruiting
Pinterest-Generated-By
X-Pinterest-Rid
X-Frontend
X-DynaTrace
Filters
X-Ua-Browser
X-Content
Server-Name
X-Ab
X-Ser
X-Cache-Key
X-MCACHE
X-Ttl
X-Correlation-Id
X-HS-Cache-Config
X-HS-Content-Id
X-NWS-LOG-UUID
X-HS-Hub-Id
Accept-Ch
X-Yandex-Sdch-Disable
X-HS-Combine-CSS
X-Template
X-Ezoic-Cdn
SPRequestGuid
X-SharePointHealthScore
X-Hits
X-ECACHE
X-Parallel-Accel
X-Tt-Trace-Tag
X-Tt-Trace-Host
Cache-Tags
MicrosoftSharePointTeamServices
Charset
X-Kong-Upstream-Latency
X-Page-Id
X-Kong-Proxy-Latency
X-B3-Sampled
Cleartype
Host
Alternate-Protocol
X-Git-Hash
X-Www-Served-By
X-Geo-Country
Fusion-Content-Source
Fusion-Content-Id
Fusion-Component-Id
X-Daa-Tunnel
Fusion-Deployment-Id
Fusion-Template-Id
Fusion-Source
X-Debug-Info
X-Content-Options
X-DIS-Request-ID
X-Hostname
X-Amzn-Trace-Id
X-Content-Digest
X-Amz-Replication-Status
Cross-Origin-Opener-Policy
X-Ratelimit-Limit
Filterid
X-Varnish-Age
X-FB-Debug
X-Az
X-Activity-Id
X-AppVersion
X-Grace
X-Upgrade-Enabled
X-N
X-VCache
X-F-Cache
ServerID
X-Nginx-Upstream-Cache-Status
X-WebKit-CSP-Report-Only
X-Accel-Expires
X-Rid
X-Origin-Server
X-Mobile-URL
X-Aspnet-Duration-Ms
X-Forwarded-Proto
X-Request-Guid
X-Route-Name
X-Flags
Access-Control-Allow-Method
X-Is-Crawler
X-Providence-Cookie
X-Server-ID
X-Type
X-Whom
X-Fastly-Request-ID
X-DataDome
X-TT
X-Varnish-Grace
X-Goog-Metageneration
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-Goog-Storage-Class
X-LB-Cache
X-Goog-Generation
X-Seen-By
Viewport
X-App-Environment
X-Goog-Stored-Content-Encoding
X-Tb
X-FW-Type
X-FW-Dynamic
Payment
X-Distributor
X-FW-Static
X-FW-Server
X-FW-Hash
TP-Cache
X-FW-Serve
TP-L2-Cache
Node
DC
Paypal-Debug-Id
X-User-Agent
X-XRDS-LOCATION
X-Fastly-Request-Id
Country
X-Wix-Request-Id
Accept-Charset
X-App-Server
Fastcgi-Useragent
X-Ratelimit-Reset
X-Litespeed-Cache
X-Cache-Control
X-Cache-Rule
X-NGENIX-Cache
X-Fastcgi-Cache
X-Webkit-Csp
X-Origin-Upstream-Status
X-Via-JSL
Referer-Policy
Version
X-Drupal-Cache-Tags
X-Cluster-Name
X-Microsite
X-Request-Handler-Origin-Region
X-Buckets
X-Contextid
X-Logged-In
X-B-Cache
Amp-Access-Control-Allow-Source-Origin
X-Tec-Api-Origin
X-Signature
X-Tec-Api-Version
X-Tec-Api-Root
Cache-Status
X-Cache-Age
X-Node-Name
Refresh
X-Response-Served-From
VIX-Pulpo-Node
X-Original-Request-Id
VIX-Pulpo-Upstream-Status
SD-X-WS
X-Mobile
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Page-View
X-Load-Cache
X-Varnish-Backend
X-Is-Bot
X-Vgn-Hpd-Reason
X-Cache-Expired-At
X-Rendered-As
X-Debug
NGB
X-Jobs
X-IPLB-Instance
X-Revision
X-Cacheable-TTL
X-Proxy-Cache-Status
X-UUID
X-RemovedCookies
X-Real-IP
X-Rule
X-Cache-Action
Access-Control-Request-Headers
X-Instance
X-Proxy
X-B
X-ProcessESI
X-Yottaa-Optimizations
Akamai-GRN
X-Drupal-Cache-Contexts
X-Yottaa-Metrics
X-Device-Type
X-Debug-IsPreview
Surrogate-Key
X-Cache-Time
X-Debug-IsConnected
X-Framework
X-FW-Version
X-G
CF-IPCountry
SID
X-Oracle-Dms-Rid
X-Oracle-Dms-Ecid
X-Presslabs-Stats
X-XRDS-Location
X-Accel-Buffering
GEO-INFO
X-TEC-API-ORIGIN
X-Air-Trace-Id
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Air-Hostname
X-Air-Source
X-Oneagent-Js-Injection
DynaTrace
X-Cache-NGX
Count-Hit
X-Nginx-Cache
X-APP-VERSION
Uber-Trace-Id
X-Source
X-Cache-Operation
X-Ms-Request-Id
X-Ms-Version
X-Azure-Ref
Liferay-Portal
X-Zen-Fury
X-RateLimit-Limit
Frame-Options
X-EdgeConnect-Cache-Status
X-PressLabs-Stats
X-CDN-Forward
Protected
X-RTag
MS-CV
Ms-Operation-Id
X-Cache-Hit
Healthy
X-Backend-Name
X-Mode
X-Environment-Context
X-L-Path
Ec-Rule-Version
Xserver
Cross-Origin-Window-Policy
X-IPS-LoggedIn
X-Cache-TTL-Remaining
X-Hyper-Cache
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Servername
X-Tumblr-User
X-Ratelimit-Remaining
X-Varnish-Server
X-Trace-Id
WPO-Cache-Message
Countrycode
WPO-Cache-Status
LB
Backend
X-Adobe-Content
X-Adobe-Loc
Meta-Geo
X-Tid
X-UPSTREAM-Address
Content-Disposition
X-JoinUs
X-Detected-As
X-Content-Age
X-RN-RSRV
X-Rewrite-Enabled
X-SaId
X-Region
X-Forwarded-Host
X-Uri
X-Generation-Time
X-Zipkin-Id
X-Hosted-By
X-Format
X-Debug-Cache
Apigw-Requestid
Decoy-Debug-TTL
Decoy-Debug-Key
X-Routing-Service
X-Cache-Grace
X-Redis-Cache
X-Cache-Server
X-Proxied
X-Extlb
Decoy-Debug-Status
X-Sql-Duration-Ms
X-Sql-Count
CDN-Cache
Eomportal-Instance
CDN-PullZone
CDN-CachedAt
Fastly-SSL
CDN-EdgeStorageId
X-ServerID
X-Sorting-Hat-ShopId
X-Site-Version
X-PCL
X-Sorting-Hat-PodId
X-Access
X-Alternate-Cache-Key
X-ShardId
Mn-Server-Ip
X-ApacheServer
X-PERF
X-OCL
X-TIME
CDN-Uid
Url
X-Via-Fastly
X-Varnish-Beresp-Grace
X-Shopify-Stage
X-ShopId
X-Microcachable
CDN-RequestId
Country-Code
X-NCache
X-FB-TRIP-ID
X-No-Session
CDN-RequestCountryCode
X-Section
X-Human
X-Status
TWC-GeoIP-LatLong
TWC-Privacy
TWC-Locale-Group
TWC-GeoIP-Country
TWC-Device-Class
TWC-Connection-Speed
Property-Id
X-PHP-Backend
X-Cache-Host
X-NYM-Debug-Backend
X-Origin-Hint
X-Content-Powered-By
X-Say-Cacheable
X-Akamai-Edgescape
X-Storage
X-ProxyCache-Status
X-Origin-Date
X-UA-Device-Type
Cache-Name
X-Cluster-Node
X-Cache-Type
Webcakes-Region
Webcakes-App-Version
X-Generated-By
X-Server-W
X-SayCDN-TTL
X-BYPASS-REASON
X-Say-TTL
X-ProxyCache-Key
X-Pubstack
Webcakes-App-Name
X-Web-Node
Section-Io-Cache
Cache-Tv-Group
X-Be
X-Soup
X-Hl-Ver
X-R9-Blue-Green-Version
Azure-SiteName
Azure-RegionName
Content-Secure-Policy
Azure-SlotName
Azure-InstanceId
X-Varnishpool
Azure-Version
X-Webkit-CSP
X-Ua
X-Timing-Wait
X-Proxy-Build
Retry-After
X-LSADC-Cache
Selected-Fe
DB-Nickname
X-NewRelic-App-Data
X-Nginx-Cache-Key
OT-Force-Account-Verify
X-Unique-Id
X-Cached-By
X-Azure-Ref-OriginShield
X-Cache-Remote
X-TT-LOGID
Source
X-Akamai-Transformed
X-Platform-Server
X-Auto-Login
Cache
X-Dc
X-Bc-Bl
X-GEO
X-EC-Lua
X-Xfnlog-Site
SRV
X-LAGOON
X-Cdn
Upgrade-Insecure-Requests
X-Cache-Tags
ServedBy
Mime-Version
X-Origin-CC
X-Origin-TTL
From-Origin
Cache-Hits
X-SRV
X-Varnish-Cache-Hits
X-Varnish-Hits
X-Loop
X-TNCMS
X-HTML-Minification-Powered-By
X-Varnish-Hostname
X-Request-Time
HostName
Onion-Location
X-S-Maxage
X-AOL-HN
WP-Super-Cache
Webserver
X-Request-Host
Xet-Cookie
X-NWS-UUID-VERIFY
X-CSRF-Token
X-ECache
X-Tumblr-Pixel-3
Web-Mar-Node
X-Tumblr-Pixel-2
N-Cache
X-App-Version
X-Cache-Enabled
X-Proto
X-Endurance-Cache-Level
X-FireWall-Port
X-Time
X-Handled-By
X-B3-SpanId
X-Amz-Meta-S3cmd-Attrs
X-Correlation-ID
X-Tenant
Nel
X-Origin-Response-Time
X-AWS-Id
X-VWS-Id
X-LJ-Flow-ID
Surrogated-Key
Sslversion
User-Cache-Control
X-Reqid
BehaviorPad-Version
DCR-Decision-By
A
X-V-Cache
X-Adobe-Source
X-RCS-CacheZone
DCR-Processing-Time-Ms
X-Vdms-Path
Pramga
Redirect-Candidate
Odigeo-Trace-Id
Mobile-Detection-Method
Fastcgi-X-Cache-Version
Meta-Geo-Continent
Rendered-Blocks
X-ARC
X-ND-Cache
X-NAPM-TraceId
X-Orig-Expires
X-PAYTM-SRV-ID
X-PBS-Appsvrname
X-Ig-Push-State
X-Hnp-Log
X-Forwarded-Path
X-Ftr-Request-Id
X-Gen-Mode
X-GG-Cache-Date
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Vdms-Version
X-SD-PageType
X-Session-Fingerprint
X-Shop-Environment
X-Slack-Backend
X-ScT
X-S-Cookie
X-Planisys-CDN-TTL
X-Processor
X-Rojux
X-S
X-External-Request-Id
X-Epic-Correlation-Id
X-A-Wwc
X-A-Dgt
X-Aed
X-Application
X-SRCache-Key
X-A-Dcw
X-TIM-N
Vix-Hermes-Req-Id
X-A
X-A-Ccd
X-A-Dam
X-B-Cookie
X-Block-Status
X-Connection-Hash
X-Conf
X-D
X-Destination
X-Developer
X-Cluster
X-Ckpd-Fst-Backend
X-Cache-NE
X-VG-WebCache
X-CF-Lambda-Fn
X-CF-Lambda-Version
V-Age
Expiry
X-Vtex-Remote-Cache
Xc-Version
X-Time-Microsecs
X-Vtex-Processado-Em
S-Rt
X-MP-GENERATED-AT
X-Mg-Request-UUID
X-Edge-Location
X-Magnolia-Registration
X-Mvc-Supplant-Cachable
Host-ID
X-VG-TLSProxy
X-LI-UUID
X-Location
Gh-Request-Id
X-Webstats-RespID
Cmsid
CDCHOST
CacheControlHeader
Cmstype
X-Origin-Time
X-Old-Content-Length
X-Li-Pop
Fastcgi-Cache-TTL
X-NodeID
X-GeoIP-Region-Code
Wxu-Next-Commit
X-Cache-Date
X-Cache-Info
X-Cdn-Srv
Wxu-Next-Hostname
Wxu-Next-Region
X-Aicache-OS
X-Backend-TTL
X-Cache-Bucket
True-Client-Country-4JS
Svr
X-GeoIP-Country-Code
X-Akamai-Request-ID2
X-Hash
Origin
X-Geo-Header
State
X-Fastly-Cache
X-Gdpr
X-Li-Fabric
X-Nyt-Route
X-Policy
X-Rocket-Nginx-Serving-Static
Apple-News-Services-Handled
X-Http-Reason
X-Proxy-Upstream
X-Request-URI
X-Server-IP
X-Sucuri-ID
X-Sucuri-Cache
AKAMAI
Apple-News-Services-Request-Url
Arc-Country
X-Viewer-Country
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
CloudFront-Viewer-Country
X-PHP-Host
Environment
Server-Info
X-Amz-Apigw-Id
X-Labrador-Cache-Channel
X-Via-NSCOPI
X-Amzn-RequestId
X-Cache-Var
X-Cache-Var-Map
X-Origin-Expires
X-Csrf-Jwt
X-Datadog-Trace-Id
X-Date
X-Datadog-Sampling-Priority
X-Datadog-Parent-Id
X-Core-Value
X-Sigma-Backend
X-Skip-Cache
X-Cache-Id
X-Branch-Name
X-Varnish-Beresp-Status
X-UnsetCookies
Origin-EX
X-VarnishDD-TTL
Traceparent
X-Backend-State
X-TrackingId
X-TH-Server
X-VServer
X-CGP
X-SVT-ORM-RULES
X-Developers
X-SVT-ORM-VERSION
X-Cache-Debug
X-Storefront-Renderer-Rendered
X-Served-From
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-Region-Sid
X-Locale
X-Req
X-Core-Mission
X-Men
Origin-CC
X-Fetched-On
X-Device-Os
X-GeoIP
X-Origin
X-Platform
X-Level-Front-Cache
X-Rocket-Build-Number
X-Sigma
X-Gamma-Serve
X-Forwarded-Site
X-Eu-Site
X-Esi-Check
X-Generated-On
X-Owner
X-HS-Content-Campaign-Id
X-Irp-Debug
X-HN
X-Gzip
X-Scheme
X-Envoy-Decorator-Operation
X-BBC-Edge-Cache-Status
Mail-Subject
X-Accel-Expires-Debug
X-Sn-Servicetimems
Magicmarker
Web-Mar-Region
L5d-Success-Class
Machine
X-Fastly-Backend
PFcat
Server-Host
X-Cdn-Origin
X-Varnish-Beresp-Ttl
Req-Svc-Chain
Fastly-Drupal-Html
Ssr
L
We-Hiring
Locid
DSUID
Fastly-GeoIP-CountryCode
HA-Ipaddr
Ha-Gx-Prefs
X-Xrds-Location
X-Is-Gdpr
X-GeoIP-City
Release
X-Loc
X-Pod-Name
X-DefElseHash
X-DPWN-IS-SECURE
X-NU-AKA-ACS-Version
X-JWT-State
NM-Fastcgi-Cache
X-Qloud-Router
X-Restarts
X-Node-Id
X-Rebelmouse-Cache-Control
Memcached
X-Has-Esi
X-FC-Vary-Parameters
NGX
X-Response-By
X-Rebelmouse-Surrogate-Control
X-Tx-Id
X-DefHash
Is-Eu
Fastly-SWR
X-Varnish-Remaining-TTL
X-Amzn-Remapped-Content-Length
TDXMobile
X-ATG-Version
Thinkindot-CacheControl-Type
X-Varnish-CookieINHashed-On
X-Variation
Fastly-SIE
Cf-Device-Type
Thinkindot-Control
X-Varnish-CookieHashed-On
Adler-Geo
Thinkindot-CacheControl
X-Thinkindot-L3
Platform
X-Worker
X-Ua-Device
AMP-Access-Control-Allow-Source-Origin
X-CS
X-VC-Cache
Kp-EeAlive
X-Request-Start
X-Zone
X-M-Log
X-Up
X-M-Reqid
X-NC
X-RPS
X-DI
CDN
X-Bip
X-DSS
X-API-Version
X-DB
X-DW
X-Action
Edge-Cache
X-RPM
X-Qnm-Cache
X-RSL
X-Wix-Viewer-Type
X-Thanos
Accept-Language
X-Mvc-Supplant-OutputCached
X-TraceId
Ms-Author-Via
X-LB-ID
Pics-Label
X-Trace-ID
X-LB-NoCache
X-Generated-In
X-Cache-Backend
X-Tb-Optimization-Total-Bytes-Saved
Env
X-Minions-Version
Memory
Time
X-Cache-Config
X-Srv
X-Optimistic-Header
X-Via-Popv
X-Via-Poph
X-Refresh
X-CacheTTL
WebServer
X-Via-Popn
X-Varnish-Ttl
X-Urbn-Context-Path
X-Urbn-Site-Id
X-DC
X-Tt-Logid
Locale
Datacenter
GeoIp-Country-Code
X-Edge-Pop
Candidate-Md5Url
X-HA-Backend
X-CACHE-KEY
NtCoent-Length
X-Datadome
X-Vc
Server-ID
X-Servedbyhost
X-Esi
X-User
X-Ec-Fail
X-TA-CDN-Provider
X-Ec-GeoHdr
X-Parent-Response-Time
X-DynaTrace-JS-Agent
X-MSEdge-Flight
WWW-Authenticate
X-ZONE
X-MSEdge-Features
On-Server
X-CLOUD-TRACE-CONTEXT
X-Cs
Esi-Enabled
X-TX-ID
Cdnsip
Cdncip
X-Unique-ID
X-VCL-Version
X-Varnish-Beresp-TTL
X-AK-Request-ID
X-Fpc
My-App
X-Service
X-WADP-Cache
Cluster
X-Cache-Ttl
X-Fmm-Version
X-Clara-WADP
X-Cache-PHP
X-LI-Proto
X-App
C-Via
X-URL
Tracecode
X-Newrelic-Synthetics
X-Dynatrace
X-Li-Proto
X-Webkit-Csp-Report-Only
Geoip-Latitude
Proxy-Connection
X-Pass-Why
X-Traceid
X-From
X-FPC
Lfy
T-Server
X-B3-Spanid
Test
X-Var-Ttl
X-CUA
X-Webkit-CSP-Report-Only
Cf-Int-Pingora-Origin-Digest
X-NODE
Fastly-Drupal-HTML
X-Fragments
DataCenter
X-Cache-Status-Check
X-Vcl-Version
Lang
X-Render-Time
X-Mcache
Geo-Info
X-LiteSpeed-Cache-Control
Resin-Trace
Target-Params
X-CSRF-TOKEN
M-TraceId
X-VC
Hostname
Server-Id
X-Provided-By
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-ID
X-Ha-Backend
X-RAMCache
MIME-Version
Hit
GeoIP-Country-Code
X-Clientip
X-Httpd
X-Proxy-Cache-Info
X-B3-Traceid
X-ServedByHost
X-Dynatrace-Js-Agent
X-Geo
X-LiteSpeed-Tag
X-Cdn-Forward
Servername
X-Oss-Storage-Class
X-Oss-Hash-Crc64ecma
X-Oss-Object-Type
X-Edge-POP
X-Oss-Request-Id
X-Oss-Server-Time
Permissions-Policy
WZWS-RAY
Producers
X-Via-PopN
Cache-Host
X-Pad
X-Via-PopH
UCS
X-Via-PopV
HIT
X-Info
X-AIR-PT
Section-Io-Origin-Status
X-Fastly-Backend-Reqs
ENV
FSS-Cache
S-Cnection
X-SB
X-Check-Cacheable
X-Edge-Cache
Section-Io-Id
X-NGINX-Cache
X-Api-Version
Section-Origin-Responded
Section-Io-Origin-Time-Seconds
X-Udemy-Cache-App-Namespace
X-Platform-Processor
X-Pool
X-Platform-Cluster
Ohc-File-Size
X-Ucs
X-Platform-Router
X-ElasticPress-Query
Uri
X-Lb-Id
X-GoCache-CacheStatus
X-Cache-CFC
X-Scale
Fastly-Backend-Name
X-Ec-Custom-Error
User-Agent
X-UP
X-Acquia-Application-Trace
X-Micro-Cache
X-Acquia-Purge-Tags
URI
X-Lb-Nocache
ServerName
PICS-Label
X-HS-Status
X-Acquia-Application-UUID
X-Acquia-Site
X-BBC-Origin-Response-Status
X-Srcache-Store-Status
X-Srcache-Fetch-Status
X-Swift-Error
X-ServerName
Cneonction
X-Backend-Host
Server-Hostname
Server-Ext
Sever-Int
X-Cache-Expires
Cteonnt-Length
X-SIPLIST1
X-Release
X-Dispatcher-Number
Tcn
MD5-Digest
X-Cdn-Request-ID
X-Fastly-Cache-Hits
Server-Ttl
IsBot
Load-Balancing
X-Nc
X-RateLimit-Reset
X-Dw-Trace-Id
X-Via-Ucdn
X-Akamai-ERRuleID
X-Akamai-ERPolicy
X-Newrelic-App-Data
X-B3-ParentSpanId
EpKe-Alive
Wpo-Cache-Status
Wpo-Cache-Message
X-Vcache
Shield-Pop
X-APP
X-Snapshot-Date
X-Contensis-Viewer-Groups
X-Cache-ASPX
X-BCube-Filmed-By
CF-Cached-On
X-Yottaa-OS
CountryCode
Cf-Ipcountry
X-TRACE-ID
Vha6-Origin
X-HostName
Sid
X-Cache-Ngx
X-Air-Pt
Cdn
X-Apw-Access-Action
X-Te-Duration-Ms
X-Te-Count
X-B3-Parentspanid
X-Http-Duration-Ms
X-Varnish-Authentication
X-Litespeed-Cache-Control
X-Sentry-ID
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
X-Apw-Access-Object
X-Http-Count
Ohc-Cache-HIT
X-CacheKey
X-Logging-Id
Req-ID
X-Akamai-Pragma-Client-IP
X-Last-Modified
Ngx
X-Akamai-Request-ID
X-Apw-Access-Token
X-Apw-Hits
Path
X-UA
X-Shopify-Generated-Cart-Token