Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
CF-RAY
X-XSS-Protection
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
X-Xss-Protection
P3P
X-Cache-Hits
X-UA-Compatible
X-Served-By
CF-Ray
X-Download-Options
X-Timer
X-Request-Id
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-Envoy-Upstream-Service-Time
X-FRAME-OPTIONS
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-Dns-Prefetch-Control
X-Request-ID
X-Drupal-Dynamic-Cache
Server-Timing
Feature-Policy
X-Content-Security-Policy
Access-Control-Expose-Headers
Content-Encoding
X-CDN
Status
X-XSS-PROTECTION
Upgrade
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Via
X-Amz-Id-2
X-Ua-Compatible
Request-Context
X-Backend
X-Turbo-Charged-By
X-Cache-Group
X-AH-Environment
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-Hacker
X-UA-Device
X-Vhost
X-Proxy-Cache
X-Server
X-Rq
Allow
X-Server-Powered-By
X-Ws-Request-Id
X-Age
X-Dispatcher
EagleId
X-Varnish-Cache
X-Amz-Version-Id
X-LiteSpeed-Cache
P3p
Nel
Grace
Cf-Apo-Via
Cf-Railgun
X-Page-Speed
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
EagleEye-TraceId
X-Swift-SaveTime
X-Swift-CacheTime
X-OneAgent-JS-Injection
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-Pingback
X-Host
X-Node
Accept-CH
X-Cache-Lookup
X-CST
X-WebKit-CSP
X-Backend-Server
Surrogate-Control
X-Server-Id
Permissions-Policy
X-Readtime
Accept-CH-Lifetime
X-Nginx-Upstream-Cache-Status
X-Nginx-Cache-Status
X-Akam-SW-Version
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
Request-Id
X-Application-Context
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
X-Response-Time
X-Ruxit-JS-Agent
Xkey
X-HW
X-Trace
X-Edge
Content-Location
X-Clacks-Overhead
X-Mod-Pagespeed
X-Url
Rating
X-ESI
X-Midtier
X-Amz-Server-Side-Encryption
X-ECACHE
X-Mcache
Cache-Tag
X-Country
X-MS-InvokeApp
X-Rack-Cache
X-Powered-By-Plesk
X-D2id
X-Kinja-Server
X-Cdn-Fetch
X-GoogleNews-Bot
X-Exp-Id
X-Exp-Variant
X-Kinja
X-Oneagent-Js-Injection
X-Use-Magma
X-Kinja-Revision
X-Kinja-Build
X-Upstream
Verso
X-Element-Page-Cache
X-Vcap-Request-Id
Service-Worker-Allowed
Accept-Ch
Edge-Control
X-TtlSet
X-Vname
X-PC
X-Country-Code
RTSS
X-Ac
Origin-Trial
X-Goog-Hash
Accept-Ch-Lifetime
X-VARITI-CCR
X-Navigation-Version
X-Abt-Application-Version
X-Cache-TTL
Fastly-Restarts
X-Browser-Type
X-Kinja-CCPA
X-Varnish-TTL
X-Amz-Rid
X-Cached
X-Litespeed-Cache
X-Ruxit-Js-Agent
X-NWS-LOG-UUID
X-WebKit-CSP-Report-Only
X-Aspnetmvc-Version
Cross-Origin-Opener-Policy
X-GitHub-Request-Id
X-Server-Name
X-Webkit-CSP
X-Sol
X-Middleton-Display
Display
Pagespeed
X-Dw-Request-Base-Id
X-Amzn-Trace-Id
SPRequestGuid
X-SharePointHealthScore
X-Ttl
X-Times
X-Content-Type
SPRequestDuration
SPIisLatency
X-Server-ID
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Instrumentation
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
X-Cache-Key
AR-Request-ID
AR-SID
AR-ATIME
AR-PoweredBy
X-Powered-CMS
X-ORACLE-DMS-RID
X-ORACLE-DMS-ECID
X-Mg-S
Arr-Disable-Session-Affinity
Response
X-Middleton-Response
X-Version
X-Client-IP
X-Ser
X-Cnection
X-Jurisdiction
X-HP-Trace-Id
X-B3-Traceid
X-HP-Webp
X-B3-TraceId
Nginx-Cache
X-FastCGI-Cache
X-Accel-Expires
AR-CACHE
X-T
Cache-Tags
X-SRCache-Store-Status
X-SRCache-Fetch-Status
Cache-Status
Edge-Cache-Tag
X-Fastly-Request-ID
X-Hits
Front-End-Https
X-MSEdge-Ref
X-Px
Public-Key-Pins
X-NF-Request-ID
X-Recruiting
S
Payment
X-Shield-Request-Id
X-LLID
X-Frontend
X-RateLimit-Remaining
X-Request-Received
X-Request-Processing-Time
Server-Node
X-Ua-Browser
X-Daa-Tunnel
MRF-Tech
X-B3-TraceId-Primal
Mrf-Cache-Status
X-Goog-Metageneration
X-GUploader-UploadID
Content-MD5
X-Webkit-CSP-Report-Only
X-DIS-Request-ID
MicrosoftSharePointTeamServices
Access-Control-Request-Method
X-RateLimit-Limit
X-Content-Digest
X-Amzn-RequestId
X-Amz-Apigw-Id
X-Ratelimit-Remaining
TP-Cache
Realpath
X-Forwarded-For
X-Protected-By
X-Distributor
X-Microsite
X-Request-Handler-Origin-Region
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Content-Id
X-HS-Hub-Id
Fastcgi-Cache
X-FB-Debug
X-TTL
Access-Control-Allow-Method
X-Fastcgi-Cache
X-Page-Id
X-Rid
X-Cluster-Name
Accept-Charset
X-LB-Cache
X-Webkit-Csp
X-PressLabs-Stats
X-Hostname
X-Geo-Country
X-Goog-Stored-Content-Length
X-Goog-Storage-Class
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-B3-Sampled
X-Xrds-Location
Count-Hit
TP-L2-Cache
X-Ratelimit-Limit
X-Aspnet-Version
X-Ua-Device
Cross-Origin-Resource-Policy
X-Kinsta-Cache
X-Seen-By
X-Correlation-Id
X-Edge-Location-Klb
X-Ezoic-Cdn
X-Id
X-Erf-Stays-Pdp-Viaduct-Migration-Web
Cleartype
TCN
X-App-Server
X-Logged-In
Referer-Policy
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Varnish-Backend
X-TEC-API-ORIGIN
X-Content-Options
X-Mobile
X-Hosted-By
X-Git-Hash
DC
X-Contextid
X-Origin-Cache
X-Route-Name
X-Fb-Rlafr
X-Flags
X-Aspnet-Duration-Ms
X-Providence-Cookie
X-Is-Crawler
X-Request-Guid
Retry-After
X-Amz-Replication-Status
X-Revision
X-Grace
X-Debug-Info
Surrogate-Key
X-Forwarded-Proto
X-App-Environment
X-TT
Frame-Options
X-Newrelic-App-Data
X-F-Cache
X-IPS-LoggedIn
X-Varnish-Grace
X-Amz-Meta-S3cmd-Attrs
X-Envoy-Decorator-Operation
X-Azure-Ref
X-Magnolia-Registration
Section-Io-Cache
MS-Author-Via
X-Wix-Request-Id
X-Proxy-Cache-Info
X-Whom
Healthy
X-App-Version
Charset
Alternate-Protocol
Viewport
X-Akamai-Edgescape
X-Www-Served-By
X-RateLimit-Reset
X-Nf-Request-Id
X-COUNTRY
X-Origin-Server
Filterid
X-Language
WPO-Cache-Message
X-Az
X-AppVersion
WPO-Cache-Status
X-Activity-Id
X-Backend-Name
Amp-Access-Control-Allow-Source-Origin
X-Varnish-Server
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-B
Server-Name
Paypal-Debug-Id
X-Datadog-Sampling-Priority
SRV
X-Trace-Id
X-Datadog-Trace-Id
X-Datadog-Parent-Id
X-DataDome
X-Http-Reason
X-Original-Request-Id
Host
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
SD-X-WS
X-Response-Served-From
X-EdgeConnect-Cache-Status
X-Cache-Rule
Front
X-Cache-Grace
X-Edge-Location
X-Akamai-Request-ID2
X-Instance
X-Rule
X-User-Agent
X-UUID
X-Time
X-Tumblr-Pixel
X-Region
X-Vcache
X-Rocket-Nginx-Serving-Static
X-Tumblr-Pixel-0
X-Tumblr-User
Country
From-Origin
X-Unique-Id
X-Page-View
X-Tumblr-Pixel-1
X-N
X-Jobs
X-L-Path
X-Environment-Context
X-Cacheable-TTL
X-FW-Type
X-FW-Static
X-FW-Server
X-Varnish-Age
X-Adobe-Content
X-Yottaa-Optimizations
X-FW-Version
X-RemovedCookies
Protected
X-Adobe-Loc
X-ProcessESI
Fastly-SWR
X-Status
X-FW-Dynamic
X-Client-Ip
X-Framework
X-Rendered-As
Akamai-GRN
X-Load-Cache
X-FW-Serve
X-Yottaa-Metrics
X-FW-Hash
Fastly-SIE
X-Is-Bot
X-Type
X-G
X-ARC
Content-Disposition
X-Mg-Request-UUID
X-Cache-Time
X-Proxy
X-Datadog-Sampled
X-B-Cache
X-Signature
ServerID
Access-Control-Request-Headers
X-Debug-IsPreview
X-Amzn-Remapped-Content-Length
X-Debug-IsConnected
X-CDN-Forward
Backend
X-Cache-Control
X-WP-CF-Super-Cache
X-WP-CF-Super-Cache-Cache-Control
X-Cache-Age
X-ECache
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-Nginx-Cache
Countrycode
Xet-Cookie
Refresh
X-Httpd
X-Servername
X-DynaTrace
Url
Accept-Language
X-Tt-Trace-Host
X-Drupal-Cache-Tags
X-Tt-Trace-Tag
X-Erf-Web-Scheduler
X-DynaTrace-JS-Agent
CF-IPCountry
X-Generated-By
X-HTML-Minification-Powered-By
X-Device-Type
X-Template
X-NYM-Debug-Backend
X-Mode
X-Content-Powered-By
X-Source
Xserver
X-Storage
GEO-INFO
X-Say-Cacheable
X-UPSTREAM-Address
X-SayCDN-TTL
Meta-Geo
X-Say-TTL
X-LAGOON
X-JoinUs
X-GeoCode
X-GeoCountry
S-Rt
X-Cache-Operation
X-ServerID
X-Urbn-Context-Path
X-Content-Age
OT-Force-Account-Verify
Load-Balancing
Filters
X-Cache-Hit
X-Rn-Rsrv
X-Cache-Action
Version
X-Urbn-Site-Id
Locale
X-Rewrite-Enabled
X-SaId
X-Director
X-Container-Uri
X-Cluster-Node
X-Varnish-Hostname
Cross-Origin-Window-Policy
X-Git-Commit
Onion-Location
X-Soup
X-Forwarded-Host
X-Tumblr-Pixel-3
X-Loop
X-Tt-Logid
X-Tumblr-Pixel-2
X-Tncms
X-CCDN-Origin-Time
X-Detected-As
Web-Mar-Node
X-CCDN-CacheTTL
X-Hcs-Proxy-Type
X-Cache-Server
X-Adobe-Source
X-Ms-Version
Webserver
X-VCT
X-Served-From
X-RM-Cache-TTL
X-VC-Cache
X-Varnish-Cache-Hits
X-Tb
X-PHP-Host
X-Sql-Duration-Ms
X-Lambda-Id
X-Sql-Count
X-Labrador-Cache-Channel
X-Ms-Request-Id
X-Zipkin-Id
Azure-Version
X-Skip-Cache
Azure-RegionName
Azure-SiteName
Azure-InstanceId
X-URL
Azure-SlotName
X-Routing-Service
X-RCS-CacheZone
X-XRDS-LOCATION
Node
X-Extlb
X-Proxied
Mn-Server-Ip
DB-Nickname
X-FB-TRIP-ID
X-Logging-Id
X-R9-Blue-Green-Version
Selected-Fe
Fastcgi-Useragent
X-MCACHE
X-Timing-Wait
X-Oracle-Dms-Ecid
X-Proxy-Build
X-Proto
X-Generation-Time
X-Fetched-On
X-Format
X-Debug
X-B3-SpanId
X-Uri
X-Oracle-Dms-Rid
TWC-Privacy
TWC-Locale-Group
X-Endurance-Cache-Level
TWC-GeoIP-LatLong
Webcakes-Region
Webcakes-App-Version
X-Origin-Hint
Webcakes-App-Name
X-XRDS-Location
TWC-GeoIP-Country
TWC-Connection-Speed
Property-Id
TWC-Device-Class
X-Redis-Cache
X-NGENIX-Cache
Uber-Trace-Id
X-LSADC-Cache
X-Zen-Fury
Source
CDN-RequestId
X-Ratelimit-Reset
X-Sucuri-ID
X-FTR-Request-ID
X-Sucuri-Cache
X-S
X-Ua
Section-Io-Id
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Origin-Responded
X-Drupal-Cache-Contexts
X-Srv
X-Origin-CC
X-Origin-TTL
NGB
X-TimeS
X-MP-GENERATED-AT
X-Pass-Why
X-Origin-Date
X-Varnish-Hits
Upgrade-Insecure-Requests
X-Real-IP
Fastly-Drupal-HTML
X-Cache-Expired-At
X-Fastly-Request-Id
X-Akamai-Transformed
Liferay-Portal
X-Handled-By
X-Upgrade-Enabled
X-Xfnlog-Site
X-CACHE-AGE
X-Cms-Context
Apigw-Requestid
X-Optimistic-Header
X-Reqid
X-GEO
X-Newrelic-Synthetics
ServedBy
X-Restarts
X-ProxyCache-Status
Ms-Operation-Id
MS-CV
X-ProxyCache-Key
X-Hl-Ver
X-BYPASS-REASON
X-Cache-TTL-Remaining
X-UA-Device-Type
X-No-Session
X-Tx-Id
X-RTag
X-Cache-Host
CDN-RequestPullCode
CDN-Cache
WP-Super-Cache
X-CSRF-Token
X-Parent-Response-Time
X-Cache-Type
CDN-PullZone
CDN-EdgeStorageId
X-Via-JSL
X-Node-Name
CDN-RequestCountryCode
CDN-Uid
CDN-CachedAt
CDN-RequestPullSuccess
X-IPLB-Instance
X-Cluster
X-VWS-Id
X-Pubstack
X-AWS-Id
X-Varnish-Ttl
X-AB
X-LJ-Flow-ID
X-IPLB-Request-ID
MD5-Digest
N-Cache
Meta-Geo-Continent
Canary
Candidate-Md5Url
DCR-Decision-By
DCR-Processing-Time-Ms
Ngx.Var.Host
BehaviorPad-Version
X-Proxy-Cache-Status
Cache-Provider
Fastly-SSL
Gannett-Cam-Experience-Id
L5d-Success-Class
Lang
L
Host-ID
Ha-Gx-Prefs
HA-Ipaddr
Magicmarker
X-A-Dgt
X-Epic-Correlation-Id
X-Ec-GeoHdr
X-Eu-Site
X-External-Request-Id
X-FC-Vary-Parameters
X-Fastly-Backend
X-Ec-Fail
X-Ec-Custom-Error
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-Destination
X-Developer
X-Dispatcher-Number
X-Request-Host
X-Rojux
X-Viewer-Country
X-Vdms-Version
X-Vtex-Remote-Cache
X-We-Are-Hiring
Xc-Version
X-Worker
X-Vdms-Path
X-SRCache-Key
X-ScT
X-S-Cookie
X-SD-PageType
X-Slack-Backend
X-Slack-Shared-Secret-Outcome
X-D
X-Csrf-Jwt
Vix-Hermes-Req-Id
True-Client-Country-4JS
W
Web-Mar-Region
X-A-Ccd
X-A
T-Server
Surrogated-Key
Redirect-Candidate
Origin-Agent-Cluster
Rendered-Blocks
Server-Host
Sslversion
X-A-Dam
X-A-Dcw
X-CacheTTL
X-Cache-NE
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-Conf
X-CGP
X-Bl-Debug
X-Bc-Bl
X-Aed
X-A-Wwc
X-App
X-Application
X-B-Cookie
Odigeo-Trace-Id
X-BCube-Filmed-By
X-Micro-Cache
X-Server-W
X-Geo-Region
X-TraceId
X-Cache-Status-Check
X-Clientip
X-Platform
X-SVT-ORM-VERSION
X-Forwarded-Path
X-Varnish-CookieINHashed-On
X-Server-IP
X-ShardId
X-ShopId
X-Shopify-Stage
Origin
X-Shop-Environment
X-Varnish-Remaining-TTL
Mail-Subject
X-Wikidot-Backend
X-Accel-Expires-Debug
X-Wix-Viewer-Type
X-Gdpr
X-Accel-Buffering
Is-Eu
X-GeoIP-Country-Code
X-Varnish-CookieHashed-On
X-CMSURLCustom
X-Core-Mission
X-GeoIP-Region-Code
X-Wikidot-Static-Cache
X-Generated-On
X-Policy
TDXMobile
Thinkindot-CacheControl
X-VG-TLSProxy
X-DefElseHash
X-DefHash
X-VG-WebCache
Thinkindot-CacheControl-Type
Thinkindot-Control
X-Date
VNS-Age
X-Origin-Time
VNS-Cache
X-Storefront-Renderer-Rendered
X-Vmg-Version
X-SVT-ORM-RULES
X-Sn-Servicetimems
Release
Producers
Platform
X-Owner
X-VServer
Req-Svc-Chain
X-Sorting-Hat-ShopId
We-Hiring
X-Varnishpool
X-DPWN-IS-SECURE
X-Sorting-Hat-PodId
X-Core-Value
X-Var-Ttl
X-Cache-Bucket
Adler-Geo
X-Irp-Debug
X-Cache-Debug
X-Level-Front-Cache
X-Thinkindot-L3
X-Pool
X-Cdn-Origin
X-Cdn-Diag
X-Bip
X-Variation
X-PAYTM-SRV-ID
X-Qloud-Router
X-RateLimit-Limit-Second
X-Mvc-Supplant-Cachable
X-Nitro-Cache
X-Nananana
X-RateLimit-Remaining-Second
X-Mly-Id
X-Thanos
X-Loc
X-Refresh
X-Mid
X-Request-Time
X-BBC-Edge-Cache-Status
X-Alternate-Cache-Key
Environment
X-Old-Content-Length
X-Nyt-Route
Datacenter
X-Org
Expect-Staple
X-Orig-Expires
X-Hash
Fastly-GeoIP-CountryCode
Fastly-Backend-Name
CPC-Cache
CPC-Age
X-Node-Id
X-S-Maxage
Cache-Name
X-Human
X-NodeID
X-Up
X-App-Name
Cmstype
Cmsid
X-Tenant
X-Cache-Info
X-TIME
X-Presslabs-Stats
User-Cache-Control
X-Clara-WADP
X-Akamai-Device-Characteristics
X-Test
X-Origin
X-Block-Status
X-Correlation-ID
X-Cache-Id
X-WADP-Cache
CDCHOST
X-Hnp-Log
X-INCAP-ABP
X-ApacheServer
Cf-Device-Type
DSUID
CloudFront-Viewer-Country
Country-Code
X-Instance-Name
X-Dispatcher-Server
X-PERF
X-Mvc-Supplant-OutputCached
X-Nginx-Cache-Key
X-Geo-Header
Apple-News-Services-Handled
Apple-News-Services-Request-Url
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
X-Origin-Response-Time
AKAMAI
X-WA-Info
X-Esi-Check
NM-Fastcgi-Cache
Server-Ext
Server-Hostname
X-AIR-PT
Sever-Int
X-Device-Os
Esi-Enabled
X-Fmm-Version
X-GeoIP
Gh-Request-Id
X-Gzip
X-Forwarded-Site
X-Gen-Mode
Machine
X-From
Content-Secure-Policy
X-Section
X-LB-NoCache
X-Cdn-Srv
Wxu-Next-Commit
Server-Info
Ssr
Wxu-Next-Hostname
Wxu-Next-Region
X-Via-Fastly
X-Op-Id-All
C-Via
X-Cache-Enabled
NGX
X-NCache
X-ID
Pics-Label
X-Auto-Login
X-Access
X-Datadome
X-Accel-Version
X-B3-Spanid
Server-ID
X-Is-Supported-Browser
X-Is-Desktop
X-Is-Tablet
X-Browser-Name
X-Vgn-Hpd-Reason
X-Is-Mobile
X-Tcp-Rtt
X-Amz-Meta-Cb-Modifiedtime
X-API-Version
X-Varnish-Beresp-Grace
AMP-Access-Control-Allow-Source-Origin
X-Varnish-Beresp-Ttl
X-Buckets
X-Dc
IsBot
X-HA-Backend
X-CACHE-GROUP
X-SIPLIST1
X-Vcl-Version
X-Is-Gdpr
Memcached
X-Has-Esi
X-JWT-State
X-Zone
Hostname
YJS-ID
X-Platform-Router
Time
X-Platform-Processor
X-B3-Parentspanid
Memory
X-Platform-Cluster
Sid
Cdn-Requestid
X-TA-CDN-Provider
X-Cached-By
X-Scale
X-Tb-Optimization-Total-Bytes-Saved
Location
Origin-CC
Origin-EX
Cache-Hits
CF-Ctrl
X-Wp-Cf-Super-Cache-Active
X-Origin-Cache-Key
X-Air-Hostname
X-Air-Trace-Id
X-Air-Source
X-WP-CF-Super-Cache-Active
X-Internal-Host
X-Fpc
X-TIM-N
X-PHP-Backend
X-NewRelic-App-Data
X-Frame-Option
X-ZONE
Resin-Trace
X-DC
X-Backend-Instance
X-Hyper-Cache
X-Cs
X-LiteSpeed-Cache-Control
X-Azure-Ref-OriginShield
X-VC
X-Webstats-RespID
X-Service
X-FTR-Expires
X-FTR-Cache-Status
X-FTR-Backend
X-Country-Code-Real
X-FTR-Backend-Server
X-FTR-Balancer
X-Github-Request-Id
Epwk-X-Cache
LB
X-Site-Version
GeoIP-Latitude
X-DataCenter
True-Client-Ip
X-Microcachable
X-Locale
X-Origin-Expires
X-Nitro-Rev
X-Nitro-Cache-From
GeoIP-Country-Code
Cache-Host
Uri
X-NGINX-Cache
WebServer
X-Info
XM
GeoIp-Country-Code
X-VCache
X-Web-Node
WZWS-RAY
X-VarnishDD-TTL
XServer
Cdn
X-HN
X-Cache-Ttl
X-SRV
Req-ID
X-Pod-Name
Cdn-Host
X-NMSegId
X-Edge-Server
PFcat
Cdn-Request-Time
X-CSRF-TOKEN
X-Datacenter
X-Ad-Defer-Variation
True-Client-IP
M-TraceId
X-Ad-Load-Variation
User-Agent
X-Vercel-Cache
X-Vercel-Id
NtCoent-Length
X-Pad
X-Geo
X-CS
X-FL-QIT-DEBUG
X-FL-EDGE
X-Request-Start
X-Scope-Id
Pramga
X-M-Log
X-Via-Edge
X-Via-SSL
X-M-Reqid
Srvid
X-Request-URI
Locid
X-Via-CDN
A
SID
Edge-Copy-Time
X-MSEdge-Features
X-MSEdge-Flight
Content-Script-Type
Content-Style-Type
X-Qnm-Cache
X-Varnish-Beresp-Status
X-FPC
X-Shield-Cache-Expires
Cluster
Fastly-Drupal-Html
HostName
Tcn
X-HostName
X-LiteSpeed-Tag
X-Cache-Date
Cache-Tv-Group
X-Contensis-Viewer-Groups
X-Varnish-Authentication
X-ATG-Version
Edge-Cache
X-Moov-Xdn-Version
X-Moov-T
X-FireWall-Port
X-Cache-ASPX
X-APP-VERSION
X-Cdn-Request-ID
X-TRACE-ID
X-Api-Version
Cf-Ipcountry
CountryCode
X-VCL-Version
X-Amz-Meta-Opti
X-WP-CF-Super-Cache-Cookies-Bypass
X-TH-Server
X-NWS-UUID-VERIFY
X-AK-Request-ID
Cdnsip
Cdncip
X-Esi
Cache-Key
Path
Click-Count-Error
X-Via-Popn
Tube-Return
X-SB
X-Nc
X-B3-Trace-ID
X-Via-Popv
X-Cache-FS-Status
X-LB-ID
Tube-Get-Contents
X-Req
X-Branch-Name
X-UA
Tube-Got-Eval
X-Wa
X-Servedbyhost
X-V-Cache
Click-Count-Action-Start
Tube-Got-Results
X-Aicache-OS
X-Acquia-Purge-Cdn-Unconfigured
X-Via-Poph
X-Wp-Cf-Super-Cache-Cookies-Bypass
X-Proxy-CacheRZ
MIME-Version
XkeyRZ
Yak-Timeinfo
X-Air-Pt
X-Vary
V-Age
On-Server
X-Men
X-CACHE-KEY
CDN
Wpo-Cache-Status
State
X-Planisys-CDN-Rules
Geoip-Latitude
X-Planisys-CDN-Cache
X-Render-Time
Proxy-Connection
X-Planisys-CDN-TTL
X-Platform-Server
Ngx-Var-Key
X-Fastly-Backend-Reqs
X-Tim-N
X-Wp-Cf-Super-Cache-Cache-Control
X-Wp-Cf-Super-Cache
X-HS-Content-Campaign-Id
Wpo-Cache-Message
Srv
X-Cdn-Forward
X-Akamai-Pragma-Client-IP
X-Rebelmouse-Surrogate-Control
X-Lb-Cache
X-Rebelmouse-Cache-Control
X-User
Lb
X-Upstream-Ct
My-App
X-Generated-In
X-Dw-Trace-Id
Priority
X-Upstream-Ht
X-Vgn-Hpd-Variations-Key
X-Vgn-Hpd-Cached
CF-Cached-On
X-Vgn-Hpd-Ssi
X-Ha-Backend
X-Acquia-Purge-Tags
X-Acquia-Site
Server-Id
X-Acquia-Application-UUID
X-Release
X-Acquia-Application-Trace
X-Fastly-Cache
X-TT-LOGID
X-Rocket-Build-Number
X-Traceid
X-Sigma
X-Cache-Remote
X-Sigma-Backend
X-HS-Status
X-Fastly-Country-Code
X-Via-Ucdn
Ohc-Cache-HIT
X-EC-Lua
PICS-Label
X-Varnish-Director
Ohc-File-Size
X-CUA
X-Lb-Nocache
Yjs-Id
X-Iplb-Instance
X-Iplb-Request-Id
Warning
X-Snapshot-Date
Vha6-Origin
X-Cached-Since
X-ElasticPress-Query
Cache
X-Fastly-Cache-Hits
CACHE-MISS-TO-ORIGIN
Inserted-Into-Cache-At
X-Litespeed-Cache-Control
Ngx
X-CF-Cache-Header-Cache-Control
X-CF-Cache-Header-Vary
Cneonction
X-Miniprofiler-Ids
Log-Origin
X-RAMCache
X-Udemy-Cache-App-Namespace