Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-Xss-Protection
X-UA-Compatible
X-Served-By
CF-Ray
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-FRAME-OPTIONS
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-Dns-Prefetch-Control
X-Iinfo
X-DNS-Prefetch-Control
Server-Timing
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Access-Control-Expose-Headers
X-XSS-PROTECTION
Content-Encoding
X-CDN
Status
Upgrade
X-AspNetMvc-Version
Access-Control-Max-Age
X-Request-ID
X-Via
X-Amz-Request-Id
X-Ua-Compatible
X-Amz-Id-2
Request-Context
X-Backend
X-Cache-Group
X-Turbo-Charged-By
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-AH-Environment
X-Vhost
X-Hacker
X-UA-Device
X-Proxy-Cache
X-Server
Allow
X-Rq
X-Server-Powered-By
X-Ws-Request-Id
X-Dispatcher
X-Age
EagleId
X-Varnish-Cache
X-Amz-Version-Id
P3p
Nel
X-LiteSpeed-Cache
Grace
Cf-Apo-Via
Cf-Railgun
X-OneAgent-JS-Injection
X-Page-Speed
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
EagleEye-TraceId
X-Device
X-Swift-CacheTime
X-Swift-SaveTime
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-Pingback
X-Host
X-CST
X-Cache-Lookup
Accept-CH
X-Node
X-Backend-Server
X-WebKit-CSP
Surrogate-Control
X-Server-Id
Permissions-Policy
X-Nginx-Upstream-Cache-Status
X-Readtime
X-Nginx-Cache-Status
X-Akam-SW-Version
Accept-CH-Lifetime
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Application-Context
Request-Id
Xkey
X-Ruxit-JS-Agent
X-Cloud-Trace-Context
X-Content-Security-Policy-Report-Only
X-Response-Time
X-HW
X-Trace
X-Edge
Content-Location
X-Clacks-Overhead
X-Mod-Pagespeed
X-Url
Rating
X-ESI
X-Midtier
X-Amz-Server-Side-Encryption
X-ECACHE
Cache-Tag
X-Mcache
X-Rack-Cache
Accept-Ch
X-Powered-By-Plesk
X-MS-InvokeApp
X-D2id
Service-Worker-Allowed
X-Cdn-Fetch
X-Kinja
X-Kinja-Build
X-GoogleNews-Bot
X-Exp-Variant
X-Exp-Id
X-Kinja-Revision
X-Kinja-Server
X-Use-Magma
Verso
X-Vcap-Request-Id
X-Element-Page-Cache
X-Upstream
Edge-Control
Accept-Ch-Lifetime
X-Country-Code
X-Country
Origin-Trial
X-Ac
X-Kinja-CCPA
X-TtlSet
X-PC
X-Vname
RTSS
X-Goog-Hash
X-Navigation-Version
X-VARITI-CCR
X-Abt-Application-Version
X-Browser-Type
X-Cache-TTL
X-Oneagent-Js-Injection
Fastly-Restarts
X-Amz-Rid
X-NWS-LOG-UUID
X-Aspnetmvc-Version
X-Varnish-TTL
X-Litespeed-Cache
X-Webkit-CSP
X-GitHub-Request-Id
Cross-Origin-Opener-Policy
X-Cached
X-Server-Name
X-Ttl
X-Amzn-Trace-Id
X-Times
Display
X-Dw-Request-Base-Id
X-Middleton-Display
Pagespeed
X-Sol
X-WebKit-CSP-Report-Only
X-SharePointHealthScore
SPRequestGuid
X-Ruxit-Js-Agent
Pinterest-Generated-By
Pinterest-Version
X-Pinterest-Rid
X-Instrumentation
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-ORACLE-DMS-RID
SPRequestDuration
X-ORACLE-DMS-ECID
SPIisLatency
X-Cache-Key
X-FastCGI-Cache
X-Content-Type
AR-ATIME
AR-Request-ID
AR-PoweredBy
AR-SID
X-Powered-CMS
X-Client-IP
Arr-Disable-Session-Affinity
X-B3-Traceid
X-Mg-S
X-Version
X-Cnection
X-Middleton-Response
Response
X-Ser
X-Server-ID
Nginx-Cache
X-HP-Webp
X-HP-Trace-Id
X-Jurisdiction
X-Accel-Expires
Cache-Tags
X-T
AR-CACHE
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Fastly-Request-ID
X-B3-TraceId
X-RateLimit-Remaining
Cache-Status
X-NF-Request-ID
Edge-Cache-Tag
X-Hits
X-MSEdge-Ref
Public-Key-Pins
X-Px
X-Recruiting
Front-End-Https
S
X-Daa-Tunnel
X-RateLimit-Limit
X-Shield-Request-Id
Payment
X-LLID
X-Frontend
Server-Node
X-Ua-Browser
X-Request-Received
X-Request-Processing-Time
Content-MD5
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
X-Goog-Metageneration
X-GUploader-UploadID
X-Content-Digest
X-Amz-Apigw-Id
X-Amzn-RequestId
Access-Control-Request-Method
MicrosoftSharePointTeamServices
X-DIS-Request-ID
X-Webkit-CSP-Report-Only
X-Forwarded-For
Realpath
TP-Cache
X-Distributor
X-Protected-By
X-Request-Handler-Origin-Region
X-Microsite
X-FB-Debug
Fastcgi-Cache
X-PressLabs-Stats
X-Webkit-Csp
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Hub-Id
X-HS-Content-Id
X-Page-Id
Access-Control-Allow-Method
Accept-Charset
X-Cluster-Name
X-Rid
X-LB-Cache
X-Id
Count-Hit
X-Xrds-Location
X-Aspnet-Version
X-Ua-Device
X-Edge-Location-Klb
X-Goog-Storage-Class
X-Kinsta-Cache
X-B3-Sampled
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Geo-Country
X-TTL
Cross-Origin-Resource-Policy
X-Hostname
X-Ratelimit-Remaining
TP-L2-Cache
X-Seen-By
X-Correlation-Id
X-App-Server
TCN
X-Varnish-Backend
X-Fastcgi-Cache
Cleartype
X-Ezoic-Cdn
X-Logged-In
X-Git-Hash
X-Hosted-By
X-Mobile
X-Content-Options
Referer-Policy
X-COUNTRY
DC
X-Erf-Stays-Pdp-Viaduct-Migration-Web
Retry-After
X-Fb-Rlafr
X-Contextid
X-Request-Guid
X-Route-Name
X-Aspnet-Duration-Ms
X-F-Cache
X-Providence-Cookie
X-Flags
X-Is-Crawler
X-Grace
X-Revision
Surrogate-Key
X-Forwarded-Proto
X-Amz-Replication-Status
X-TT
X-App-Environment
X-Origin-Cache
X-Ratelimit-Limit
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-Debug-Info
X-TEC-API-ROOT
Frame-Options
X-Newrelic-App-Data
X-Amz-Meta-S3cmd-Attrs
X-Varnish-Grace
X-IPS-LoggedIn
X-RateLimit-Reset
X-Azure-Ref
X-Envoy-Decorator-Operation
MS-Author-Via
Section-Io-Cache
X-Magnolia-Registration
X-Www-Served-By
X-App-Version
X-Trace-Id
X-Wix-Request-Id
X-Whom
X-Proxy-Cache-Info
Healthy
X-Language
X-Az
X-AppVersion
X-Activity-Id
Filterid
Charset
Viewport
WPO-Cache-Status
WPO-Cache-Message
X-Akamai-Edgescape
Server-Name
Alternate-Protocol
X-Origin-Server
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Varnish-Server
X-Datadog-Sampling-Priority
X-Backend-Name
X-Datadog-Parent-Id
Amp-Access-Control-Allow-Source-Origin
X-Datadog-Trace-Id
Paypal-Debug-Id
X-B
X-EdgeConnect-Cache-Status
X-N
X-Original-Request-Id
X-Cache-Rule
Host
X-Response-Served-From
X-Http-Reason
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
SRV
X-Edge-Location
X-Instance
X-DataDome
X-Tec-Api-Root
X-Akamai-Request-ID2
X-User-Agent
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Nf-Request-Id
X-Tec-Api-Version
X-Rule
X-Tec-Api-Origin
X-Cache-Grace
X-Cacheable-TTL
X-Framework
X-B-Cache
SD-X-WS
X-Region
Front
X-Signature
X-ARC
Protected
X-Vcache
X-Environment-Context
X-Unique-Id
X-Mg-Request-UUID
Country
X-Jobs
X-L-Path
X-Page-View
Content-Disposition
From-Origin
X-UUID
Fastly-SIE
Fastly-SWR
X-Adobe-Loc
X-Varnish-Age
X-Status
X-Adobe-Content
X-Rocket-Nginx-Serving-Static
X-FW-Hash
X-Rendered-As
X-RemovedCookies
X-ProcessESI
X-FW-Dynamic
X-Load-Cache
X-FW-Static
X-FW-Server
X-FW-Serve
X-FW-Version
X-FW-Type
X-Datadog-Sampled
Akamai-GRN
X-Is-Bot
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Cache-Time
X-Tumblr-User
X-G
X-Type
X-Proxy
X-Amzn-Remapped-Content-Length
X-Debug-IsConnected
X-Debug-IsPreview
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Access-Control-Request-Headers
X-ECache
ServerID
X-CDN-Forward
X-Time
Backend
X-Client-Ip
X-Erf-Web-Scheduler
X-Cache-Age
Refresh
X-Servername
Xet-Cookie
X-Cache-Control
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-DynaTrace
Url
Countrycode
X-Template
X-Httpd
Accept-Language
X-Drupal-Cache-Tags
CF-IPCountry
X-DynaTrace-JS-Agent
X-Device-Type
X-Nginx-Cache
X-Mode
X-Content-Powered-By
X-NYM-Debug-Backend
X-Generated-By
X-FTR-Request-ID
X-HTML-Minification-Powered-By
Webserver
X-Cache-Hit
Xserver
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-Storage
GEO-INFO
Cross-Origin-Window-Policy
X-JoinUs
X-GeoCountry
X-Loop
X-Rn-Rsrv
X-Say-Cacheable
X-SaId
X-GeoCode
X-Rewrite-Enabled
X-Director
Load-Balancing
Filters
X-Cache-Operation
X-Content-Age
Locale
S-Rt
Meta-Geo
X-Say-TTL
X-LAGOON
X-UPSTREAM-Address
X-SayCDN-TTL
X-Tncms
X-XRDS-LOCATION
X-Urbn-Context-Path
X-Urbn-Site-Id
X-ServerID
X-Soup
X-Container-Uri
X-Forwarded-Host
OT-Force-Account-Verify
X-Tt-Logid
X-Cluster-Node
Onion-Location
X-Varnish-Cache-Hits
Version
X-Cache-Action
X-MCACHE
X-Source
X-Git-Commit
X-Served-From
X-NGENIX-Cache
Azure-SiteName
Azure-InstanceId
Azure-RegionName
X-Ms-Request-Id
X-Skip-Cache
X-Ms-Version
X-VCT
Azure-SlotName
X-R9-Blue-Green-Version
X-PHP-Host
X-Labrador-Cache-Channel
X-Sql-Duration-Ms
X-Detected-As
X-Adobe-Source
Web-Mar-Node
X-Varnish-Hostname
X-Sql-Count
X-Lambda-Id
X-VC-Cache
Azure-Version
X-RM-Cache-TTL
X-Extlb
X-B3-SpanId
Node
X-Redis-Cache
X-Zipkin-Id
X-Cache-Server
X-FB-TRIP-ID
Mn-Server-Ip
DB-Nickname
X-Logging-Id
X-Proxied
X-RCS-CacheZone
X-Tb
X-Routing-Service
Fastcgi-Useragent
Property-Id
TWC-Connection-Speed
Webcakes-Region
X-Generation-Time
X-Tumblr-Pixel-2
X-Format
X-Debug
TWC-Privacy
X-Tumblr-Pixel-3
Selected-Fe
Webcakes-App-Name
X-Timing-Wait
X-Origin-Hint
TWC-GeoIP-LatLong
TWC-Locale-Group
X-Proxy-Build
X-Fetched-On
TWC-GeoIP-Country
TWC-Device-Class
Webcakes-App-Version
X-Endurance-Cache-Level
X-Proto
X-Uri
Uber-Trace-Id
Source
X-Zen-Fury
X-LSADC-Cache
CDN-RequestId
X-Ua
X-Sucuri-ID
X-Sucuri-Cache
X-XRDS-Location
X-S
Section-Io-Id
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
Section-Io-Origin-Status
NGB
X-TimeS
X-Oracle-Dms-Ecid
X-Oracle-Dms-Rid
X-Origin-CC
X-Origin-TTL
Upgrade-Insecure-Requests
X-Newrelic-Synthetics
X-URL
X-Akamai-Transformed
X-Origin-Date
X-MP-GENERATED-AT
X-Drupal-Cache-Contexts
X-Real-IP
X-Varnish-Hits
X-Pass-Why
X-Handled-By
X-Ratelimit-Reset
X-Cache-Expired-At
Fastly-Drupal-HTML
X-TraceId
X-AB
X-Srv
Apigw-Requestid
X-Cms-Context
X-Optimistic-Header
X-No-Session
X-Reqid
X-Xfnlog-Site
X-Restarts
X-CACHE-AGE
ServedBy
X-RTag
Ms-Operation-Id
MS-CV
X-BYPASS-REASON
X-GEO
X-Cache-Host
X-ProxyCache-Status
X-TIME
X-ProxyCache-Key
WP-Super-Cache
X-Hl-Ver
X-Tx-Id
X-Varnish-Ttl
X-Geo-Region
X-LJ-Flow-ID
Liferay-Portal
CDN-PullZone
X-IPLB-Instance
CDN-RequestCountryCode
CDN-RequestPullCode
CDN-Uid
CDN-RequestPullSuccess
X-IPLB-Request-ID
X-VWS-Id
X-Cache-Type
X-AWS-Id
CDN-EdgeStorageId
CDN-CachedAt
X-Cluster
CDN-Cache
X-Fastly-Request-Id
X-Cache-TTL-Remaining
X-UA-Device-Type
X-Node-Name
Cache-Provider
X-Proxy-Cache-Status
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-Conf
X-Csrf-Jwt
X-CacheTTL
X-CGP
BehaviorPad-Version
Candidate-Md5Url
X-BCube-Filmed-By
X-B-Cookie
Canary
X-Bip
X-D
X-Bl-Debug
X-Cache-NE
X-Debug-Cache-Store
X-External-Request-Id
X-Eu-Site
X-Upgrade-Enabled
X-Fastly-Backend
X-Generated-On
X-FC-Vary-Parameters
X-Epic-Correlation-Id
Rendered-Blocks
X-Destination
X-Application
X-Developer
X-Dispatcher-Number
X-Ec-Fail
X-Ec-Custom-Error
X-Debug-Cache-Fetch
X-App
MD5-Digest
Meta-Geo-Continent
N-Cache
True-Client-Country-4JS
Magicmarker
W
Vix-Hermes-Req-Id
Ngx.Var.Host
Odigeo-Trace-Id
Server-Host
Redirect-Candidate
Sslversion
Surrogated-Key
Origin-Agent-Cluster
T-Server
Lang
L5d-Success-Class
X-A-Dgt
Fastly-SSL
Gannett-Cam-Experience-Id
X-A-Wwc
X-Aed
DCR-Decision-By
DCR-Processing-Time-Ms
X-A-Dcw
X-A-Dam
Web-Mar-Region
L
X-A
X-A-Ccd
Ha-Gx-Prefs
HA-Ipaddr
X-Level-Front-Cache
X-Ec-GeoHdr
X-Rojux
X-Owner
X-Viewer-Country
X-Pubstack
X-S-Cookie
X-PAYTM-SRV-ID
X-Vdms-Version
X-Pool
X-Qloud-Router
X-Thanos
X-SRCache-Key
X-Vdms-Path
X-Vtex-Remote-Cache
X-Micro-Cache
X-We-Are-Hiring
X-Cache-Status-Check
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Parent-Response-Time
X-Worker
Xc-Version
X-Via-JSL
X-ScT
Cache-Name
X-CSRF-Token
X-Accel-Buffering
X-ApacheServer
X-Thinkindot-L3
X-Storefront-Renderer-Rendered
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-Sn-Servicetimems
X-Accel-Expires-Debug
X-Alternate-Cache-Key
X-Tenant
X-Varnish-Remaining-TTL
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
X-Wix-Viewer-Type
Thinkindot-Control
TDXMobile
Datacenter
Req-Svc-Chain
X-Hash
Origin
X-VServer
X-Vmg-Version
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
X-Variation
X-Var-Ttl
X-App-Name
X-Varnishpool
X-VG-WebCache
X-VG-TLSProxy
We-Hiring
X-Up
X-SD-PageType
X-DPWN-IS-SECURE
X-Old-Content-Length
X-Nyt-Route
X-NodeID
X-Orig-Expires
X-Dispatcher-Server
X-PERF
X-DefElseHash
X-DefHash
X-Origin-Time
X-Nitro-Cache
X-Nananana
X-GeoIP-Country-Code
X-GeoIP-Region-Code
X-Human
X-Irp-Debug
X-Geo-Header
X-Gdpr
X-Mvc-Supplant-Cachable
X-Mly-Id
X-Mid
X-Platform
X-Date
X-Server-IP
X-Loc
X-Cache-Bucket
X-Cache-Debug
X-ShardId
X-Shop-Environment
X-ShopId
X-BBC-Edge-Cache-Status
X-Bc-Bl
X-Cache-Info
X-Request-Time
X-CMSURLCustom
X-Core-Mission
X-Core-Value
X-Policy
X-Clientip
X-Refresh
X-Cdn-Diag
X-Cdn-Origin
X-Request-Host
X-Shopify-Stage
X-Forwarded-Path
Mail-Subject
Adler-Geo
Fastly-GeoIP-CountryCode
Fastly-Backend-Name
Expect-Staple
AKAMAI
Machine
Cmsid
X-Correlation-ID
Host-ID
Gh-Request-Id
Is-Eu
Environment
CloudFront-Viewer-Country
Producers
Cmstype
X-Server-W
X-Vgn-Hpd-Reason
Release
Platform
X-Is-Supported-Browser
X-Is-Tablet
X-Accel-Version
X-Is-Desktop
X-Is-Mobile
X-Tcp-Rtt
X-AIR-PT
X-Browser-Name
X-Wikidot-Static-Cache
X-Ah-Environment
X-WA-Info
X-Gzip
CDCHOST
Cf-Device-Type
X-WADP-Cache
X-Wikidot-Backend
X-RateLimit-Limit-Second
NM-Fastcgi-Cache
X-Block-Status
X-SVT-ORM-VERSION
X-Datadome
Apple-News-Services-Handled
Apple-News-Services-Host
X-RateLimit-Remaining-Second
Esi-Enabled
X-Clara-WADP
Apple-News-Services-Request-Url
Apple-News-Services-Parsed-Url
X-Cache-Id
DSUID
Server-Hostname
X-Origin-Response-Time
X-GeoIP
X-From
X-SVT-ORM-RULES
User-Cache-Control
X-Forwarded-Site
X-Org
X-Test
X-Node-Id
X-S-Maxage
X-Gen-Mode
X-Hnp-Log
VNS-Age
VNS-Cache
CPC-Cache
X-Op-Id-All
CPC-Age
Country-Code
X-Auto-Login
X-Esi-Check
X-Mvc-Supplant-OutputCached
X-NCache
X-Fmm-Version
X-Device-Os
Server-Ext
X-INCAP-ABP
X-Nginx-Cache-Key
Sever-Int
X-B3-Spanid
X-Buckets
X-Instance-Name
X-Section
X-LB-NoCache
C-Via
X-Cache-Enabled
Wxu-Next-Hostname
Server-Info
Ssr
Wxu-Next-Commit
X-Access
Wxu-Next-Region
X-Cdn-Srv
X-Via-Fastly
X-Origin
Pics-Label
X-Vcl-Version
NGX
AMP-Access-Control-Allow-Source-Origin
Content-Secure-Policy
X-Akamai-Device-Characteristics
Server-ID
X-Amz-Meta-Cb-Modifiedtime
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Grace
X-Presslabs-Stats
X-Dc
X-CACHE-GROUP
X-Origin-Cache-Key
X-Zone
X-API-Version
X-HA-Backend
X-SIPLIST1
IsBot
X-WP-CF-Super-Cache-Active
YJS-ID
CF-Ctrl
X-B3-Parentspanid
Hostname
X-Cached-By
X-JWT-State
X-Platform-Router
X-Platform-Cluster
Memcached
X-Is-Gdpr
X-Platform-Processor
Cdn-Requestid
X-Frame-Option
X-Has-Esi
Sid
Memory
Time
X-Internal-Host
Location
X-FTR-Backend-Server
X-FTR-Balancer
X-Country-Code-Real
X-FTR-Backend
X-Wp-Cf-Super-Cache-Active
X-FTR-Expires
X-FTR-Cache-Status
Origin-CC
Origin-EX
X-Hyper-Cache
X-Tb-Optimization-Total-Bytes-Saved
X-Air-Hostname
X-Air-Trace-Id
X-NewRelic-App-Data
X-Fpc
X-Scale
X-TIM-N
Cache-Hits
X-Air-Source
X-LiteSpeed-Cache-Control
X-TA-CDN-Provider
X-Backend-Instance
X-Webstats-RespID
X-DC
X-Cs
X-ID
X-NGINX-Cache
X-Service
X-SRV
X-PHP-Backend
X-ZONE
X-VC
X-DataCenter
Epwk-X-Cache
Resin-Trace
LB
GeoIp-Country-Code
X-Site-Version
X-Azure-Ref-OriginShield
Uri
X-CSRF-TOKEN
True-Client-Ip
X-Edge-Server
Req-ID
Cdn-Request-Time
Cdn-Host
X-Microcachable
X-NMSegId
WZWS-RAY
X-Locale
X-Nitro-Cache-From
X-Nitro-Rev
X-NODE
GeoIP-Latitude
X-VCache
GeoIP-Country-Code
X-Ad-Load-Variation
True-Client-IP
X-Origin-Expires
X-Cache-Ttl
Cache-Host
XServer
X-Request-URI
Pramga
X-Request-Start
XM
X-M-Reqid
X-M-Log
Cdn
SID
X-Datacenter
NtCoent-Length
M-TraceId
X-Scope-Id
X-Info
X-Geo
Cluster
Content-Script-Type
WebServer
X-HN
X-Pod-Name
X-VarnishDD-TTL
Content-Style-Type
PFcat
X-Vercel-Id
X-Vercel-Cache
X-Pad
X-Shield-Cache-Expires
X-Qnm-Cache
X-Varnish-Beresp-Status
X-Github-Request-Id
X-WP-CF-Super-Cache-Cookies-Bypass
X-Ad-Defer-Variation
HostName
Cache-Tv-Group
X-Cache-Date
X-Web-Node
X-FPC
User-Agent
Fastly-Drupal-Html
X-HostName
Tcn
X-MSEdge-Flight
Locid
X-LiteSpeed-Tag
X-TH-Server
Edge-Copy-Time
A
X-Via-CDN
Srvid
X-FL-QIT-DEBUG
X-Via-Edge
X-FL-EDGE
X-MSEdge-Features
X-Via-SSL
X-APP-VERSION
Cf-Ipcountry
CountryCode
X-Cdn-Request-ID
X-Api-Version
X-CS
X-Wa
X-Via-Popv
X-Via-Popn
Tube-Return
Tube-Got-Eval
Tube-Got-Results
Tube-Get-Contents
Click-Count-Error
Edge-Cache
Click-Count-Action-Start
X-Acquia-Purge-Cdn-Unconfigured
X-Aicache-OS
X-Servedbyhost
X-V-Cache
X-Nc
X-Cache-FS-Status
X-Amz-Meta-Opti
X-B3-Trace-ID
X-Via-Poph
Cdnsip
Cdncip
X-NWS-UUID-VERIFY
X-Webkit-Csp-Report-Only
X-Esi
X-AK-Request-ID
X-FireWall-Port
X-LB-ID
X-Moov-T
V-Age
X-Moov-Xdn-Version
Path
X-Contensis-Viewer-Groups
X-Req
X-Vary
X-Cache-ASPX
X-Varnish-Authentication
X-Men
On-Server
X-SB
X-ATG-Version
MIME-Version
X-Branch-Name
X-Wp-Cf-Super-Cache-Cookies-Bypass
Priority
X-VCL-Version
Yak-Timeinfo
X-Proxy-CacheRZ
Cache-Key
Ngx-Var-Key
XkeyRZ
X-CACHE-KEY
X-UA
CDN
Wpo-Cache-Status
X-Fastly-Backend-Reqs
X-Acquia-Application-Trace
Proxy-Connection
My-App
Srv
Wpo-Cache-Message
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Render-Time
Geoip-Latitude
X-Tim-N
X-Akamai-Pragma-Client-IP
X-Cdn-Forward
X-Acquia-Site
X-Rebelmouse-Surrogate-Control
X-Lb-Cache
X-Rebelmouse-Cache-Control
X-Ha-Backend
X-Provided-By
Lb
Server-Id
X-Generated-In
X-Air-Pt
X-Varnish-Director
X-Fastly-Country-Code
X-User
X-TRACE-ID
X-TT-LOGID
X-Platform-Server
X-Dw-Trace-Id
X-HS-Content-Campaign-Id
X-Planisys-CDN-Rules
Ohc-File-Size
Type
Ohc-Cache-HIT
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
State
X-Via-Ucdn
X-Lb-Nocache
X-CUA
X-Wp-Cf-Super-Cache
PICS-Label
X-Wp-Cf-Super-Cache-Cache-Control
CF-Cached-On
X-EC-Lua
X-Iplb-Instance
Yjs-Id
X-Iplb-Request-Id
Vha6-Origin
Cache
Warning
X-Vgn-Hpd-Variations-Key
Fusion-Content-Id
X-Cdn-Cache-Status
Cross-Origin-Embedder-Policy-Report-Only
X-CDN-Cache-Status
X-Lb-Id
X-Vgn-Hpd-Cached
Fusion-Template-Id
X-Cached-Since
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Source
Fusion-Component-Id
X-Miniprofiler-Ids
Inserted-Into-Cache-At
Log-Origin
X-CF-Cache-Header-Vary
X-Snapshot-Date
X-Udemy-Cache-App-Namespace
X-Fastly-Cache-Hits
X-HS-Status
X-CF-Cache-Header-Cache-Control
X-Vgn-Hpd-Ssi
X-Fastly-Cache
X-Litespeed-Cache-Control
Cneonction
X-RAMCache
X-Cache-Remote
X-Release
Ngx
X-ElasticPress-Query