Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-Xss-Protection
X-UA-Compatible
X-Served-By
CF-Ray
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-FRAME-OPTIONS
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-Iinfo
X-DNS-Prefetch-Control
X-Dns-Prefetch-Control
Server-Timing
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Access-Control-Expose-Headers
X-XSS-PROTECTION
Content-Encoding
X-CDN
Status
X-Request-ID
Upgrade
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Via
X-Ua-Compatible
X-Amz-Id-2
Request-Context
X-Backend
X-Cache-Group
X-Turbo-Charged-By
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-AH-Environment
X-Vhost
X-Hacker
X-Proxy-Cache
X-Server
Allow
X-Rq
X-UA-Device
X-Server-Powered-By
X-Ws-Request-Id
X-Dispatcher
EagleId
X-Age
X-Varnish-Cache
X-Amz-Version-Id
P3p
Nel
X-LiteSpeed-Cache
Grace
Cf-Apo-Via
Cf-Railgun
X-OneAgent-JS-Injection
X-Page-Speed
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
EagleEye-TraceId
X-Device
X-Swift-SaveTime
X-Swift-CacheTime
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-Pingback
X-Host
X-Cache-Lookup
X-CST
Accept-CH
X-Node
X-WebKit-CSP
X-Backend-Server
Surrogate-Control
X-Server-Id
Permissions-Policy
X-Nginx-Upstream-Cache-Status
X-Readtime
X-Akam-SW-Version
X-Nginx-Cache-Status
Accept-CH-Lifetime
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Application-Context
Request-Id
Xkey
X-Ruxit-JS-Agent
X-Cloud-Trace-Context
X-Content-Security-Policy-Report-Only
X-Response-Time
X-HW
X-Trace
X-Edge
Content-Location
X-Clacks-Overhead
X-Mod-Pagespeed
X-Url
Rating
X-ESI
X-Midtier
X-Amz-Server-Side-Encryption
Cache-Tag
X-ECACHE
X-Mcache
X-Rack-Cache
X-Powered-By-Plesk
Accept-Ch
X-MS-InvokeApp
X-D2id
Service-Worker-Allowed
X-Use-Magma
X-Kinja-Revision
X-Kinja-Server
X-Kinja-Build
X-GoogleNews-Bot
X-Cdn-Fetch
X-Exp-Id
X-Exp-Variant
X-Kinja
X-Vcap-Request-Id
Verso
X-Element-Page-Cache
X-Upstream
Edge-Control
Accept-Ch-Lifetime
X-Country
X-Country-Code
Origin-Trial
X-Kinja-CCPA
X-Ac
RTSS
X-PC
X-Vname
X-TtlSet
X-Goog-Hash
X-Navigation-Version
X-VARITI-CCR
X-Abt-Application-Version
X-Browser-Type
X-Cache-TTL
X-Oneagent-Js-Injection
Fastly-Restarts
X-NWS-LOG-UUID
X-Amz-Rid
X-Aspnetmvc-Version
X-Varnish-TTL
X-Litespeed-Cache
X-Webkit-CSP
X-GitHub-Request-Id
Cross-Origin-Opener-Policy
X-Cached
X-Server-Name
X-Ttl
X-Amzn-Trace-Id
X-Times
X-Dw-Request-Base-Id
X-Sol
X-Middleton-Display
Pagespeed
Display
X-WebKit-CSP-Report-Only
X-SharePointHealthScore
SPRequestGuid
X-Ruxit-Js-Agent
Pinterest-Version
X-Pinterest-Rid
Pinterest-Generated-By
X-ORACLE-DMS-RID
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
SPIisLatency
X-ORACLE-DMS-ECID
X-Instrumentation
SPRequestDuration
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Cache-Key
X-Content-Type
X-FastCGI-Cache
AR-ATIME
AR-SID
AR-Request-ID
AR-PoweredBy
X-Powered-CMS
X-Client-IP
Arr-Disable-Session-Affinity
X-Version
X-B3-Traceid
X-Mg-S
X-Cnection
Response
X-Middleton-Response
X-Ser
X-Server-ID
Nginx-Cache
X-HP-Trace-Id
X-HP-Webp
X-Jurisdiction
X-Accel-Expires
Cache-Tags
X-T
X-Ua-Device
X-SRCache-Fetch-Status
AR-CACHE
X-SRCache-Store-Status
X-Fastly-Request-ID
X-B3-TraceId
X-RateLimit-Remaining
Cache-Status
X-NF-Request-ID
Edge-Cache-Tag
X-Hits
Public-Key-Pins
X-MSEdge-Ref
X-Px
X-Recruiting
Front-End-Https
S
X-Daa-Tunnel
X-RateLimit-Limit
X-Shield-Request-Id
Payment
X-LLID
X-Frontend
Server-Node
X-Ua-Browser
X-Request-Received
X-Request-Processing-Time
Content-MD5
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Goog-Metageneration
X-GUploader-UploadID
X-Content-Digest
Access-Control-Request-Method
MicrosoftSharePointTeamServices
X-Amz-Apigw-Id
X-Amzn-RequestId
X-DIS-Request-ID
X-Webkit-CSP-Report-Only
X-Forwarded-For
Realpath
TP-Cache
X-Protected-By
X-Request-Handler-Origin-Region
X-Microsite
X-Distributor
X-FB-Debug
X-PressLabs-Stats
Fastcgi-Cache
X-HS-Hub-Id
X-Page-Id
X-HS-Content-Id
Access-Control-Allow-Method
X-HS-Combine-CSS
X-HS-Cache-Config
Accept-Charset
X-Cluster-Name
X-LB-Cache
X-Rid
X-Id
X-Xrds-Location
Count-Hit
X-Aspnet-Version
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Edge-Location-Klb
X-Geo-Country
X-Kinsta-Cache
X-B3-Sampled
X-TTL
Cross-Origin-Resource-Policy
X-Hostname
X-Ratelimit-Remaining
TP-L2-Cache
X-Seen-By
X-App-Server
X-Correlation-Id
X-Varnish-Backend
TCN
X-Logged-In
Cleartype
X-Fastcgi-Cache
X-Ezoic-Cdn
X-Hosted-By
X-Git-Hash
X-Content-Options
X-Mobile
Referer-Policy
DC
X-COUNTRY
Retry-After
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Contextid
X-Fb-Rlafr
X-F-Cache
X-Request-Guid
X-Route-Name
X-Providence-Cookie
X-Aspnet-Duration-Ms
X-Flags
X-Is-Crawler
X-Revision
Surrogate-Key
X-Forwarded-Proto
X-Grace
X-Amz-Replication-Status
X-TT
X-App-Environment
X-Origin-Cache
X-Ratelimit-Limit
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-Debug-Info
X-TEC-API-ROOT
Frame-Options
X-Newrelic-App-Data
X-Varnish-Grace
X-Amz-Meta-S3cmd-Attrs
X-IPS-LoggedIn
X-RateLimit-Reset
X-Azure-Ref
X-Envoy-Decorator-Operation
MS-Author-Via
Section-Io-Cache
X-Magnolia-Registration
X-Www-Served-By
X-Proxy-Cache-Info
X-App-Version
X-Wix-Request-Id
X-Trace-Id
X-Webkit-Csp
X-Whom
X-Language
Healthy
X-Activity-Id
Charset
Filterid
X-AppVersion
X-Az
Viewport
WPO-Cache-Status
X-Akamai-Edgescape
WPO-Cache-Message
X-Varnish-Server
X-Origin-Server
X-Kong-Proxy-Latency
Alternate-Protocol
Server-Name
X-Kong-Upstream-Latency
Amp-Access-Control-Allow-Source-Origin
X-Datadog-Sampling-Priority
X-Backend-Name
X-Datadog-Parent-Id
X-Datadog-Trace-Id
Paypal-Debug-Id
X-Cache-Rule
Host
X-B
X-Http-Reason
X-EdgeConnect-Cache-Status
X-N
X-Original-Request-Id
X-Response-Served-From
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
SRV
X-Instance
X-Akamai-Request-ID2
X-Cache-Grace
X-Cacheable-TTL
X-Yottaa-Optimizations
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-Rule
X-Edge-Location
X-DataDome
X-Yottaa-Metrics
X-Nf-Request-Id
X-User-Agent
X-Framework
X-Environment-Context
SD-X-WS
X-Vcache
X-ARC
X-B-Cache
X-Signature
Protected
Front
X-Page-View
From-Origin
X-UUID
X-L-Path
Country
Content-Disposition
X-Unique-Id
X-Jobs
X-Region
X-Mg-Request-UUID
X-Adobe-Loc
X-Varnish-Age
Fastly-SWR
X-Datadog-Sampled
X-FW-Hash
X-Adobe-Content
Fastly-SIE
X-Load-Cache
X-FW-Type
X-FW-Version
X-Is-Bot
X-FW-Static
X-FW-Server
X-FW-Dynamic
X-FW-Serve
Akamai-GRN
X-ProcessESI
X-Rocket-Nginx-Serving-Static
X-Rendered-As
X-Status
X-RemovedCookies
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-User
X-Cache-Time
X-G
X-Tumblr-Pixel
X-Type
X-Proxy
X-Amzn-Remapped-Content-Length
X-Debug-IsConnected
X-Debug-IsPreview
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Access-Control-Request-Headers
X-ECache
ServerID
X-CDN-Forward
X-Time
Backend
X-Client-Ip
X-Erf-Web-Scheduler
Refresh
X-Cache-Age
X-Servername
X-Cache-Control
Xet-Cookie
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-DynaTrace
Url
Countrycode
X-Httpd
X-Template
Accept-Language
X-Drupal-Cache-Tags
CF-IPCountry
X-DynaTrace-JS-Agent
X-Device-Type
X-Nginx-Cache
X-Mode
X-Content-Powered-By
X-NYM-Debug-Backend
X-FTR-Request-ID
X-Generated-By
X-HTML-Minification-Powered-By
Webserver
X-Cache-Hit
Xserver
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-Storage
GEO-INFO
X-Loop
Cross-Origin-Window-Policy
X-Rewrite-Enabled
X-LAGOON
X-Content-Age
X-Say-TTL
X-Say-Cacheable
X-JoinUs
X-Rn-Rsrv
X-GeoCountry
Locale
S-Rt
Meta-Geo
Load-Balancing
Filters
X-GeoCode
X-Director
X-SayCDN-TTL
X-SaId
X-Tncms
X-UPSTREAM-Address
X-Urbn-Context-Path
X-Urbn-Site-Id
X-Cache-Operation
X-XRDS-LOCATION
X-ServerID
X-Soup
X-Cluster-Node
X-Cache-Action
X-Container-Uri
X-Varnish-Cache-Hits
X-Tt-Logid
OT-Force-Account-Verify
Onion-Location
X-MCACHE
X-Forwarded-Host
X-NGENIX-Cache
X-Source
X-Git-Commit
X-Served-From
Version
X-Ms-Request-Id
Azure-InstanceId
Azure-RegionName
X-Ms-Version
Azure-SiteName
Azure-SlotName
X-Lambda-Id
X-Tb
X-Sql-Duration-Ms
X-Varnish-Hostname
X-VC-Cache
X-VCT
X-Sql-Count
X-Skip-Cache
X-Detected-As
X-Adobe-Source
X-Labrador-Cache-Channel
X-PHP-Host
X-R9-Blue-Green-Version
Web-Mar-Node
Azure-Version
X-RM-Cache-TTL
X-RCS-CacheZone
Mn-Server-Ip
X-Logging-Id
X-Cache-Server
X-Extlb
X-Proxied
DB-Nickname
X-FB-TRIP-ID
X-Redis-Cache
X-B3-SpanId
Node
X-Routing-Service
X-Zipkin-Id
Selected-Fe
TWC-Device-Class
Webcakes-Region
TWC-Connection-Speed
Property-Id
X-Tumblr-Pixel-2
X-Tumblr-Pixel-3
Webcakes-App-Version
Webcakes-App-Name
Fastcgi-Useragent
X-Format
X-Generation-Time
X-Debug
TWC-Privacy
X-Fetched-On
X-Proxy-Build
TWC-GeoIP-LatLong
X-Origin-Hint
TWC-Locale-Group
TWC-GeoIP-Country
X-Timing-Wait
X-Endurance-Cache-Level
X-Uri
X-Proto
Source
Uber-Trace-Id
X-Zen-Fury
X-LSADC-Cache
CDN-RequestId
X-Ua
X-XRDS-Location
X-Sucuri-Cache
X-Sucuri-ID
X-S
Section-Origin-Responded
Section-Io-Id
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
X-TimeS
NGB
X-Oracle-Dms-Ecid
X-Oracle-Dms-Rid
X-Origin-CC
X-Origin-TTL
X-Newrelic-Synthetics
X-URL
X-Akamai-Transformed
Upgrade-Insecure-Requests
X-Drupal-Cache-Contexts
X-Origin-Date
X-MP-GENERATED-AT
X-Real-IP
X-Handled-By
X-Pass-Why
X-Varnish-Hits
X-Cache-Expired-At
Fastly-Drupal-HTML
X-TraceId
X-Ratelimit-Reset
X-Reqid
Apigw-Requestid
X-Srv
X-Xfnlog-Site
X-No-Session
X-Optimistic-Header
X-Cms-Context
X-AB
ServedBy
X-CACHE-AGE
X-RTag
Ms-Operation-Id
X-Restarts
MS-CV
X-TIME
X-ProxyCache-Status
X-BYPASS-REASON
X-Cache-Host
X-ProxyCache-Key
X-GEO
X-Hl-Ver
X-Geo-Region
X-Tx-Id
X-Varnish-Ttl
WP-Super-Cache
X-LJ-Flow-ID
CDN-PullZone
X-IPLB-Instance
X-IPLB-Request-ID
Liferay-Portal
CDN-RequestCountryCode
CDN-RequestPullSuccess
CDN-RequestPullCode
CDN-Uid
X-VWS-Id
X-Cache-Type
X-AWS-Id
CDN-EdgeStorageId
CDN-CachedAt
X-Cluster
CDN-Cache
X-Fastly-Request-Id
X-Cache-TTL-Remaining
X-UA-Device-Type
Cache-Provider
X-Proxy-Cache-Status
X-Node-Name
X-CF-Lambda-Version
X-CF-Lambda-Fn
X-Conf
X-Csrf-Jwt
X-CacheTTL
X-CGP
BehaviorPad-Version
Candidate-Md5Url
X-BCube-Filmed-By
X-Bc-Bl
Canary
X-Bip
X-D
X-Bl-Debug
X-Cache-NE
X-Debug-Cache-Store
X-External-Request-Id
X-Eu-Site
X-Upgrade-Enabled
X-Fastly-Backend
X-Generated-On
X-FC-Vary-Parameters
X-Epic-Correlation-Id
Rendered-Blocks
X-Destination
X-B-Cookie
X-Developer
X-Dispatcher-Number
X-Ec-Fail
X-Ec-Custom-Error
X-Debug-Cache-Fetch
X-App
True-Client-Country-4JS
MD5-Digest
Meta-Geo-Continent
Magicmarker
Vix-Hermes-Req-Id
Lang
W
N-Cache
Ngx.Var.Host
Sslversion
Server-Host
Redirect-Candidate
Surrogated-Key
T-Server
Odigeo-Trace-Id
Origin-Agent-Cluster
L5d-Success-Class
L
X-A-Wwc
X-A-Dgt
Fastly-SSL
X-Aed
DCR-Processing-Time-Ms
X-Level-Front-Cache
DCR-Decision-By
Gannett-Cam-Experience-Id
X-A-Dcw
X-A
Web-Mar-Region
X-A-Ccd
HA-Ipaddr
X-A-Dam
Ha-Gx-Prefs
X-Application
X-Ec-GeoHdr
X-Micro-Cache
X-Viewer-Country
X-Pubstack
X-Rojux
X-S-Cookie
X-Thanos
X-SRCache-Key
X-PAYTM-SRV-ID
X-Request-Host
X-Vdms-Path
X-Vdms-Version
X-Owner
X-Vtex-Remote-Cache
X-We-Are-Hiring
X-Parent-Response-Time
Xc-Version
X-Qloud-Router
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Worker
X-Cache-Status-Check
X-ScT
X-Pool
X-Via-JSL
X-CSRF-Token
Cache-Name
X-Thinkindot-L3
X-Tenant
X-Sorting-Hat-PodId
X-Sn-Servicetimems
X-ApacheServer
X-Alternate-Cache-Key
X-Accel-Expires-Debug
X-Sorting-Hat-ShopId
X-Accel-Buffering
X-Storefront-Renderer-Rendered
X-Varnish-Remaining-TTL
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
X-Wix-Viewer-Type
Thinkindot-Control
TDXMobile
Datacenter
Req-Svc-Chain
X-Hash
Origin
X-VServer
X-Vmg-Version
X-Varnish-CookieHashed-On
X-Variation
X-Var-Ttl
X-Varnish-CookieINHashed-On
X-Varnishpool
X-VG-WebCache
X-VG-TLSProxy
We-Hiring
X-Up
X-SD-PageType
X-DPWN-IS-SECURE
X-Old-Content-Length
X-Nyt-Route
X-NodeID
X-Dispatcher-Server
X-Orig-Expires
X-DefElseHash
X-DefHash
X-Origin-Time
X-Nitro-Cache
X-Nananana
X-GeoIP-Country-Code
X-GeoIP-Region-Code
X-Human
X-Irp-Debug
X-Geo-Header
X-Gdpr
X-Mvc-Supplant-Cachable
X-Mly-Id
X-Mid
X-PERF
X-Date
X-Server-IP
X-Loc
X-Cache-Bucket
X-Cache-Debug
X-ShardId
X-Shop-Environment
X-Shopify-Stage
X-ShopId
X-BBC-Edge-Cache-Status
X-Cache-Info
X-Request-Time
X-Core-Mission
X-Core-Value
X-Policy
X-Platform
X-CMSURLCustom
X-Clientip
X-Cdn-Diag
X-Cdn-Origin
X-Refresh
X-App-Name
X-Forwarded-Path
Expect-Staple
AKAMAI
X-Correlation-ID
Cmstype
Mail-Subject
Fastly-Backend-Name
X-Server-W
Machine
X-Vgn-Hpd-Reason
Fastly-GeoIP-CountryCode
Environment
Adler-Geo
Cmsid
Host-ID
Producers
CloudFront-Viewer-Country
Is-Eu
Release
Platform
Gh-Request-Id
X-Is-Supported-Browser
X-Browser-Name
X-Tcp-Rtt
X-Is-Mobile
X-Is-Desktop
X-Is-Tablet
X-Accel-Version
X-AIR-PT
X-RateLimit-Limit-Second
Apple-News-Services-Host
Apple-News-Services-Request-Url
X-Block-Status
Apple-News-Services-Parsed-Url
X-Cache-Id
Esi-Enabled
Apple-News-Services-Handled
X-Wikidot-Static-Cache
X-Hnp-Log
X-INCAP-ABP
X-Esi-Check
X-Gzip
X-Fmm-Version
X-S-Maxage
X-Forwarded-Site
X-SVT-ORM-RULES
X-Datadome
X-Wikidot-Backend
X-Gen-Mode
X-Ah-Environment
X-WADP-Cache
X-WA-Info
X-SVT-ORM-VERSION
X-RateLimit-Remaining-Second
X-Clara-WADP
CDCHOST
User-Cache-Control
X-From
X-GeoIP
VNS-Age
Cf-Device-Type
X-Nginx-Cache-Key
X-Device-Os
X-Origin-Response-Time
X-Org
Server-Hostname
Server-Ext
X-Op-Id-All
Sever-Int
X-Node-Id
X-Origin
X-Test
X-NCache
VNS-Cache
CPC-Cache
Country-Code
X-Mvc-Supplant-OutputCached
CPC-Age
X-Auto-Login
NM-Fastcgi-Cache
DSUID
X-Buckets
X-B3-Spanid
X-Vcl-Version
NGX
X-Cache-Enabled
Server-Info
C-Via
Ssr
Pics-Label
X-Section
X-Instance-Name
Wxu-Next-Hostname
X-Access
X-LB-NoCache
Wxu-Next-Commit
X-Cdn-Srv
Wxu-Next-Region
X-Via-Fastly
Content-Secure-Policy
AMP-Access-Control-Allow-Source-Origin
X-Varnish-Beresp-Ttl
X-Akamai-Device-Characteristics
Server-ID
X-Zone
X-CACHE-GROUP
X-Varnish-Beresp-Grace
X-Amz-Meta-Cb-Modifiedtime
X-Dc
X-Presslabs-Stats
X-Origin-Cache-Key
X-API-Version
X-HA-Backend
YJS-ID
X-SIPLIST1
IsBot
X-WP-CF-Super-Cache-Active
X-B3-Parentspanid
CF-Ctrl
Hostname
X-JWT-State
X-Cached-By
X-Platform-Router
X-Platform-Cluster
X-Platform-Processor
X-Is-Gdpr
Memcached
Cdn-Requestid
X-Has-Esi
X-Frame-Option
Sid
Memory
Time
X-Internal-Host
Location
X-FTR-Balancer
X-FTR-Backend
X-FTR-Backend-Server
X-FTR-Expires
X-Wp-Cf-Super-Cache-Active
X-FTR-Cache-Status
X-Country-Code-Real
Origin-CC
Origin-EX
X-Fpc
X-Hyper-Cache
X-Tb-Optimization-Total-Bytes-Saved
X-Air-Source
Cache-Hits
X-TIM-N
X-Scale
X-Air-Trace-Id
X-Air-Hostname
X-NewRelic-App-Data
X-LiteSpeed-Cache-Control
X-TA-CDN-Provider
X-Backend-Instance
X-Webstats-RespID
X-DC
X-Cs
X-ID
X-NGINX-Cache
X-Service
X-SRV
X-PHP-Backend
X-ZONE
X-VC
X-DataCenter
Epwk-X-Cache
Resin-Trace
LB
GeoIp-Country-Code
X-Site-Version
X-Azure-Ref-OriginShield
Uri
X-CSRF-TOKEN
True-Client-Ip
X-Edge-Server
Req-ID
Cdn-Request-Time
Cdn-Host
X-Microcachable
X-NMSegId
WZWS-RAY
X-Locale
X-Nitro-Cache-From
X-Nitro-Rev
X-NODE
GeoIP-Latitude
X-VCache
GeoIP-Country-Code
X-Ad-Load-Variation
True-Client-IP
X-Origin-Expires
X-Cache-Ttl
Cache-Host
XServer
X-Request-URI
Pramga
X-Request-Start
XM
X-M-Reqid
X-M-Log
Cdn
SID
X-Datacenter
NtCoent-Length
M-TraceId
X-Scope-Id
X-Info
X-Geo
Cluster
Content-Script-Type
WebServer
X-HN
X-Pod-Name
X-VarnishDD-TTL
Content-Style-Type
PFcat
X-Vercel-Id
X-Vercel-Cache
X-Pad
X-Shield-Cache-Expires
X-Qnm-Cache
X-Varnish-Beresp-Status
X-Github-Request-Id
X-WP-CF-Super-Cache-Cookies-Bypass
X-Ad-Defer-Variation
HostName
Cache-Tv-Group
X-Cache-Date
X-Web-Node
X-FPC
User-Agent
Fastly-Drupal-Html
X-HostName
Tcn
X-MSEdge-Flight
Locid
X-LiteSpeed-Tag
X-TH-Server
Edge-Copy-Time
A
X-Via-CDN
Srvid
X-FL-QIT-DEBUG
X-Via-Edge
X-FL-EDGE
X-MSEdge-Features
X-Via-SSL
X-APP-VERSION
Cf-Ipcountry
CountryCode
X-Cdn-Request-ID
X-Api-Version
X-CS
X-Wa
X-Via-Popv
X-Via-Popn
Tube-Return
Tube-Got-Eval
Tube-Got-Results
Tube-Get-Contents
Click-Count-Error
Edge-Cache
Click-Count-Action-Start
X-Acquia-Purge-Cdn-Unconfigured
X-Aicache-OS
X-Servedbyhost
X-V-Cache
X-Nc
X-Cache-FS-Status
X-Amz-Meta-Opti
X-B3-Trace-ID
X-Via-Poph
Cdnsip
Cdncip
X-NWS-UUID-VERIFY
X-Webkit-Csp-Report-Only
X-Esi
X-AK-Request-ID
X-FireWall-Port
X-LB-ID
X-Moov-T
V-Age
X-Moov-Xdn-Version
Path
X-Contensis-Viewer-Groups
X-Req
X-Vary
X-Cache-ASPX
X-Varnish-Authentication
X-Men
On-Server
X-SB
X-ATG-Version
MIME-Version
X-Branch-Name
X-Wp-Cf-Super-Cache-Cookies-Bypass
Priority
X-VCL-Version
Yak-Timeinfo
X-Proxy-CacheRZ
Cache-Key
Ngx-Var-Key
XkeyRZ
X-CACHE-KEY
X-UA
CDN
Wpo-Cache-Status
X-Fastly-Backend-Reqs
X-Acquia-Application-Trace
Proxy-Connection
My-App
Srv
Wpo-Cache-Message
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Render-Time
Geoip-Latitude
X-Tim-N
X-Akamai-Pragma-Client-IP
X-Cdn-Forward
X-Acquia-Site
X-Rebelmouse-Surrogate-Control
X-Lb-Cache
X-Rebelmouse-Cache-Control
X-Ha-Backend
X-Provided-By
Lb
Server-Id
X-Generated-In
X-Air-Pt
X-Varnish-Director
X-Fastly-Country-Code
X-User
X-TRACE-ID
X-TT-LOGID
X-Platform-Server
X-Dw-Trace-Id
X-HS-Content-Campaign-Id
X-Planisys-CDN-Rules
Ohc-File-Size
Type
Ohc-Cache-HIT
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
State
X-Via-Ucdn
X-Lb-Nocache
X-CUA
X-Wp-Cf-Super-Cache
PICS-Label
X-Wp-Cf-Super-Cache-Cache-Control
CF-Cached-On
X-EC-Lua
X-Iplb-Instance
Yjs-Id
X-Iplb-Request-Id
Vha6-Origin
Cache
Warning
X-Vgn-Hpd-Variations-Key
Fusion-Content-Id
X-Cdn-Cache-Status
Cross-Origin-Embedder-Policy-Report-Only
X-CDN-Cache-Status
X-Lb-Id
X-Vgn-Hpd-Cached
Fusion-Template-Id
X-Cached-Since
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Source
Fusion-Component-Id
X-Miniprofiler-Ids
Inserted-Into-Cache-At
Log-Origin
X-CF-Cache-Header-Vary
X-Snapshot-Date
X-Udemy-Cache-App-Namespace
X-Fastly-Cache-Hits
X-HS-Status
X-CF-Cache-Header-Cache-Control
X-Vgn-Hpd-Ssi
X-Fastly-Cache
X-Litespeed-Cache-Control
Cneonction
X-RAMCache
X-Cache-Remote
X-Release
Ngx
X-ElasticPress-Query