Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-Cache-Status
X-XSS-Protection
Accept-Ranges
CF-RAY
Link
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
P3P
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Request-Id
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Cache-Status
X-Generator
X-Cacheable
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Content-Security-Policy
X-Iinfo
X-Request-ID
Content-Encoding
X-CDN
X-Ua-Compatible
Feature-Policy
X-AspNetMvc-Version
Status
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
CF-Ray
Upgrade
X-Via
Access-Control-Max-Age
Keep-Alive
X-Ws-Request-Id
X-Age
X-Robots-Tag
X-AH-Environment
X-Turbo-Charged-By
Request-Context
EagleId
X-Proxy-Cache
X-Cache-Group
Server-Timing
X-Backend
X-Server
X-Hacker
X-Dns-Prefetch-Control
Host-Header
Report-To
X-Server-Powered-By
X-Amz-Request-Id
X-Nginx-Cache-Status
Grace
X-Amz-Id-2
X-UA-Device
P3p
X-Rq
X-Varnish-Cache
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
X-Page-Speed
Cf-Railgun
X-Pingback
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-OneAgent-JS-Injection
X-Amz-Version-Id
NEL
X-Device
X-Cache-Spec
X-CST
Allow
X-Vhost
X-WebKit-CSP
X-Host
X-Backend-Server
Xkey
X-Server-Id
EagleEye-TraceId
X-Dispatcher
Surrogate-Control
X-Node
Request-Id
Content-Location
X-Response-Time
X-Akam-SW-Version
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-ASPNET-VERSION
X-Ruxit-JS-Agent
X-Cache-Lookup
X-Application-Context
X-Ac
X-Country
Accept-Ch
X-Template
X-Mod-Pagespeed
Accept-CH
Accept-Ch-Lifetime
X-Language
X-Readtime
X-Cloud-Trace-Context
Accept-CH-Lifetime
X-B3-TraceId
MS-Author-Via
Rating
X-HW
X-Url
X-Origin-Cache
X-Cnection
X-MS-InvokeApp
X-Vname
X-TtlSet
X-PC
Edge-Control
X-Clacks-Overhead
X-ESI
X-GitHub-Request-Id
X-Trace
X-ORACLE-DMS-RID
X-Middleton-Response
Display
X-Middleton-Display
Response
Pagespeed
X-Sol
X-Varnish-TTL
X-Content-Type
X-ORACLE-DMS-ECID
X-D2id
Verso
Arr-Disable-Session-Affinity
X-Exp-Variant
X-Cdn-Fetch
X-GoogleNews-Bot
X-Exp-Id
X-Kinja-Build
X-Use-Magma
X-Kinja
X-Kinja-Server
X-Kinja-Revision
X-Vcap-Request-Id
X-Country-Code
X-Rack-Cache
X-Goog-Hash
X-Powered-By-Plesk
X-TTL
X-Navigation-Version
X-Oneagent-Js-Injection
X-VARITI-CCR
Service-Worker-Allowed
X-Server-Name
X-Amz-Rid
X-Abt-Application-Version
X-Buckets
X-Fastly-Request-ID
X-Client-IP
Fastly-Restarts
X-Cache-TTL
X-FastCGI-Cache
X-Cached
X-Release
X-MSEdge-Ref
X-Element-Page-Cache
X-Dw-Request-Base-Id
X-SharePointHealthScore
SPRequestGuid
X-NF-Request-ID
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
SPIisLatency
SPRequestDuration
MRF-Tech
X-B3-TraceId-Primal
Mrf-Cache-Status
Public-Key-Pins
X-Webkit-CSP
Access-Control-Request-Method
RTSS
AR-CACHE
Ar-Sid
AR-PoweredBy
AR-ATIME
AR-Request-ID
Cache-Tag
X-Edge
X-LLID
X-Powered-CMS
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Ezoic-Cdn
X-Upstream
Content-MD5
X-Version
X-HP-Webp
X-Jurisdiction
S
X-Origin-Upstream-Status
X-Recruiting
X-Mid
X-MCACHE
X-ECACHE
Fusion-Component-Id
Charset
X-Mg-S
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Source
Fusion-Content-Id
Fusion-Content-Source
X-Px
X-Ruxit-Js-Agent
X-DynaTrace
X-PressLabs-Stats
X-Content-Digest
X-Kinsta-Cache
X-T
Fastcgi-Cache
Cache-Tags
X-Litespeed-Cache
X-Fastcgi-Cache
X-Id
X-Amz-Server-Side-Encryption
X-Logged-In
X-Accel-Expires
Filters
X-Forwarded-Proto
Server-Node
X-Content-Security-Policy-Report-Only
X-Ttl
Edge-Cache-Tag
MicrosoftSharePointTeamServices
Front-End-Https
TP-Cache
TP-L2-Cache
Server-Name
X-Grace
X-Forwarded-For
TCN
Nginx-Cache
X-Hits
X-Debug
X-Request-Received
X-Correlation-Id
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Request-Processing-Time
X-Amzn-Trace-Id
X-XRDS-LOCATION
X-B3-Sampled
X-Shield-Request-Id
X-Microsite
X-Request-Handler-Origin-Region
X-Varnish-Age
X-Yandex-Sdch-Disable
X-Activity-Id
X-AppVersion
Surrogate-Key
X-Az
X-F-Cache
X-Amz-Replication-Status
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Content-Id
X-HS-Hub-Id
X-Ser
Alternate-Protocol
X-Origin-Server
X-Goog-Metageneration
X-Goog-Generation
X-GUploader-UploadID
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-DIS-Request-ID
Accept-Charset
Nel
X-Geo-Country
X-XRDS-Location
X-Rid
X-Frontend
X-NWS-LOG-UUID
X-Git-Hash
Section-Io-Cache
Host
X-Respond-Thread
X-Cache-Age
X-Pinterest-Direct
X-Cache-Key
X-Upgrade-Enabled
X-Time
Access-Control-Allow-Method
X-VCache
X-Hostname
X-DataDome
X-LB-Cache
X-Mobile-URL
X-Seen-By
Cache
X-Server-ID
MS-CV
X-Type
Paypal-Debug-Id
ServerID
X-TT
X-Daa-Tunnel
X-AOL-HN
X-Source
X-IPLB-Instance
X-RateLimit-Remaining
X-Varnish-Backend
X-Content-Options
Healthy
Payment
X-Is-Crawler
X-Providence-Cookie
X-Route-Name
X-Aspnet-Duration-Ms
X-App-Environment
X-Request-Guid
X-Flags
X-Whom
X-Signature
X-FTR-Request-ID
X-B-Cache
X-Cache-Action
Cleartype
X-Debug-Info
X-Page-Id
Fastcgi-Useragent
X-Jobs
X-WebKit-CSP-Report-Only
X-Load-Cache
X-N
X-FB-Debug
X-Contextid
Realpath
Powered-By-ChinaCache
X-Webkit-Csp
X-Erf-Bev-Bev-Is-Generated
X-Mobile
X-Erf-Bev-Bev
X-Browser-Type
Node
Refresh
X-Rule
X-Accel-Buffering
X-Drupal-Cache-Tags
X-Wix-Request-Id
X-Response-Served-From
X-Cache-Expired-At
X-Original-Request-Id
X-Proxy
Version
DC
X-RTag
X-Zen-Fury
Ms-Operation-Id
X-Framework
X-Cacheable-TTL
Referer-Policy
X-Via-JSL
X-ProcessESI
X-Real-IP
X-B
X-Cache-Control
X-Distributor
X-HTML-Minification-Powered-By
X-Instance
X-RemovedCookies
X-Content-Powered-By
X-Cluster-Name
Access-Control-Request-Headers
X-Cache-Time
X-UUID
Eomportal-Instance
X-Drupal-Cache-Contexts
Viewport
X-Region
VIX-Pulpo-Upstream-Status
X-Page-View
VIX-Pulpo-Node
X-Tt-Trace-Host
X-Tt-Trace-Tag
X-FW-Type
X-FW-Static
X-IPS-LoggedIn
X-FW-Dynamic
X-FW-Server
X-FW-Serve
X-FW-Hash
X-Akamai-Edgescape
X-TEC-API-ORIGIN
X-TEC-API-ROOT
Countrycode
X-TEC-API-VERSION
X-Cached-By
X-FireWall-Port
Liferay-Portal
X-Cache-Operation
X-Cache-Rule
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-Cache-Hit
X-G
X-Tumblr-User
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Pass-Why
X-L-Path
X-Environment-Context
X-App-Server
Xserver
Server-Info
X-Nginx-Cache
SRV
DynaTrace
CF-IPCountry
Section-Io-Id
Section-Origin-Responded
X-Debug-IsPreview
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
X-Debug-IsConnected
X-Tec-Api-Root
X-Tec-Api-Origin
X-Tec-Api-Version
X-Www-Served-By
X-Protected-By
X-User-Agent
From-Origin
Ec-Rule-Version
X-Tumblr-Pixel-2
Webserver
GEO-INFO
X-Device-Type
X-Ratelimit-Limit
X-Mode
X-Varnish-Grace
X-Adobe-Loc
X-Adobe-Content
X-UPSTREAM-Address
X-ES-SERVER
X-Endurance-Cache-Level
X-Handled-By
X-RN-RSRV
X-Hl-Ver
Meta-Geo
X-Backend-Name
Retry-After
X-MP-GENERATED-AT
X-Uri
Cache-Tv-Group
X-FB-TRIP-ID
Decoy-Debug-Status
X-Varnishpool
Property-Id
Cache-Status
Decoy-Debug-TTL
Decoy-Debug-Key
TWC-Connection-Speed
Fastly-SSL
Webcakes-Region
X-Origin-Hint
X-Section
X-PHP-Host
X-Access
X-Labrador-Cache-Channel
X-Be
X-Pubstack
X-Storage
X-Cache-Server
TWC-Device-Class
X-PCL
X-NYM-Debug-Backend
TWC-GeoIP-Country
X-OCL
TWC-GeoIP-LatLong
TWC-Locale-Group
Webcakes-App-Version
Webcakes-App-Name
TWC-Privacy
X-Format
X-PERF
X-Proto
X-Redis-Cache
X-Site-Version
X-Human
X-VWS-Id
X-Via-Fastly
X-R9-Blue-Green-Version
X-Server-W
X-Proxy-Build
X-Sql-Count
X-ApacheServer
X-AWS-Id
Frame-Options
X-Web-Node
Selected-Fe
Mn-Server-Ip
X-Timing-Wait
X-UA-Device-Type
X-Locale
X-No-Session
X-LJ-Flow-ID
X-LAGOON
Cache-Name
X-Sql-Duration-Ms
X-Origin-Date
X-WA-Info
X-ProxyCache-Key
X-ProxyCache-Status
Country
Protected
X-Soup
X-BYPASS-REASON
Apigw-Requestid
X-Request-Time
X-TNCMS
X-Status
X-Cache-TTL-Remaining
X-SayCDN-TTL
X-AIR-PT
X-Routing-Service
X-Proxied
X-Say-TTL
X-Xfnlog-Site
X-Say-Cacheable
X-Hyper-Cache
X-Hosted-By
Azure-RegionName
Azure-InstanceId
X-FW-Version
X-Varnish-Server
X-Zipkin-Id
Azure-SiteName
X-Loop
X-S-Maxage
Azure-SlotName
Azure-Version
X-Shopify-Stage
X-ShardId
X-Alternate-Cache-Key
X-Sorting-Hat-ShopId
X-Storefront-Renderer-Rendered
X-ShopId
X-Sorting-Hat-PodId
X-Node-Name
X-Cache-Grace
X-CCM
X-Forwarded-Host
X-Cluster
X-Info
X-GG-Cache-Date
X-TT-LOGID
X-Is-Bot
X-Rendered-As
X-TA-CDN-Provider
X-Dc
X-Revision
S-Cnection
X-Microcachable
X-Qloud-Router
X-Cache-Enabled
AMP-Access-Control-Allow-Source-Origin
Uber-Trace-Id
X-Content-Age
X-Proxy-Cache-Status
X-NWS-UUID-VERIFY
X-SRV
X-Azure-Ref
X-Via-CDN
X-Platform
X-Backend-Host
Cache-Hits
X-CSRF-Token
X-Varnish-Ttl
Amp-Access-Control-Allow-Source-Origin
X-Correlation-ID
X-Country-Code-Real
X-FTR-Backend
X-Aspnetmvc-Version
X-FTR-DC
X-Ratelimit-Remaining
X-FTR-Cache-Status
X-FTR-Realm
X-FTR-Balancer
X-FTR-Backend-Server
X-Cache-Host
X-Detected-As
Akamai-GRN
X-Amz-Meta-S3cmd-Attrs
X-Amz-Apigw-Id
X-App-Version
X-Amzn-Remapped-Content-Length
X-Amzn-RequestId
ServedBy
X-EdgeConnect-Cache-Status
X-ATG-Version
X-B3-SpanId
X-Cache-PHP
X-Trace-Id
X-Cache-NGX
X-Oss-Server-Time
X-Oss-Storage-Class
X-RCS-CacheZone
X-Oss-Request-Id
X-Oss-Object-Type
X-Oss-Hash-Crc64ecma
X-Debug-Cache
X-FTR-Expires
X-Varnish-Hostname
SD-X-WS
HostName
Tracecode
X-Time-Microsecs
X-Air-Hostname
DB-Nickname
X-BCube-Filmed-By
X-CS
X-Nc
X-DynaTrace-JS-Agent
X-ServerID
X-Ms-Request-Id
X-Backend-TTL
X-Ms-Version
X-Akamai-Transformed
X-NewRelic-App-Data
Backend
X-Tb
X-Adobe-Source
X-From
X-CF-Lambda-Fn
X-Processor
X-CF-Lambda-Version
BehaviorPad-Version
X-B-Cookie
X-Request-UUID
X-ScT
X-Session-Fingerprint
X-Magnolia-Registration
X-S
X-Rewrite-Enabled
X-Rojux
X-PBS-Appsvrname
X-Origin-TTL
Meta-Geo-Continent
X-TX-ID
X-NAPM-TraceId
X-Location
MD5-Digest
X-Level-Front-Cache
Machine
Mobile-Detection-Method
X-Cache-NE
Fastcgi-X-Cache-Version
X-Generated-On
X-Owner
X-ARC
X-Generation-Time
Odigeo-Trace-Id
X-Origin-CC
X-PAYTM-SRV-ID
X-S-Cookie
X-A-Dam
X-A-Ccd
X-External-Request-Id
X-A-Dcw
X-A
X-A-Wwc
X-A-Dgt
X-Vdms-Path
X-Vdms-Version
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
X-Destination
X-VG-WebServer
T-Server
X-VG-WebCache
DCR-Decision-By
Xc-Version
Expiry
DCR-Processing-Time-Ms
X-Application
Rendered-Blocks
X-SRCache-Key
X-Trv-Group
X-D
X-Connection-Hash
X-Aed
X-Cache-Var-Map
X-Unique-Id
X-Cache-Var
Locid
X-Core-Value
X-HS-Content-Campaign-Id
X-Has-Esi
Content-Disposition
Fastly-Backend-Name
X-GeoIP-City
Wxu-Next-Commit
X-Generated-In
Gh-Request-Id
X-Cms-Context
X-Fastly-Cache
X-Irp-Debug
CacheControlHeader
Host-ID
X-Device-Os
X-Developers
AKAMAI
X-Varnish-Beresp-Grace
Cf-Device-Type
X-Fetched-On
Arc-Version
X-FC-Vary-Parameters
X-Geo-Header
X-OVcl
X-Thanos
X-Thinkindot-L3
X-TrackingId
X-Tumblr-Pixel-3
Release
X-CACHE-KEY
X-Bip
X-B3-Traceid
X-Azure-Ref-OriginShield
Server-Host
X-Unique-ID
V-Age
Wxu-Next-Region
Wxu-Next-Hostname
UCS
X-Sucuri-ID
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Thinkindot-Control
PB-RID
X-Reqid
X-Cache-Bucket
On-Server
X-Varnish-Cache-Hits
PB-PID
X-Mvc-Supplant-Cachable
X-Micro-Cache
X-Is-Gdpr
X-JWT-State
Magicmarker
X-OVcl-Cache
Pagetype
X-Policy
Path
X-GEO
User-Cache-Control
Who
X-Backend-State
X-Clara-WADP
X-Csrf-Jwt
X-Cache-Debug
X-Cache-Id
X-Block-Status
X-Branch-Name
X-Cache-Tags
X-Clientip
X-CGP
X-Hnp-Log
X-SVT-ORM-RULES
X-Skip-Cache
X-SVT-ORM-VERSION
X-User
X-Var-Ttl
X-SIPLIST1
X-Scheme
X-Rebelmouse-Cache-Control
X-Ratelimit-Reset
X-Rebelmouse-Surrogate-Control
X-Request-Host
X-Request-URI
X-Variation
X-Varnish-CookieHashed-On
Cache-Host
X-Wikidot-Static-Cache
Ssr
X-Cache-Info
X-Swa-Ws
X-Wikidot-Backend
X-WADP-Cache
X-Varnish-Remaining-TTL
X-Varnish-CookieINHashed-On
X-VarnishDD-TTL
X-VG-TLSProxy
X-VServer
X-Platform-Server
X-Origin-Response-Time
X-Fastly-Backend
X-Eu-Site
X-Fmm-Version
X-Gen-Mode
X-Generated-By
X-Esi-Check
X-Envoy-Decorator-Operation
X-DefHash
X-DefElseHash
X-Developer
X-Dispatcher-Server
X-DPWN-IS-SECURE
X-GeoIP
X-GoCache-CacheStatus
X-NU-AKA-ACS-Version
X-Node-Id
X-Old-Content-Length
X-Origin
X-Origin-Expires
X-Nginx-Cache-Key
X-Method
X-IP
X-HN
X-Li-Fabric
X-Li-Pop
X-LI-UUID
X-CUA
X-Gzip
Esi-Enabled
Fastly-SIE
DSUID
Cf-Bgj
CDN-Uid
Fastly-SWR
Ha-Gx-Prefs
IsBot
L5d-Success-Class
Web-Mar-Node
Is-Eu
Instruction
CDN-RequestId
CDN-RequestCountryCode
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Apple-News-Services-Handled
Adler-Geo
Country-Code
Apple-News-Services-Request-Url
C-Via
CDN-EdgeStorageId
CDN-PullZone
CDN-CachedAt
CDN-Cache
CDCHOST
Location
HA-Ipaddr
Server-Ext
PFcat
NM-Fastcgi-Cache
Server-Hostname
Sever-Int
Vix-Hermes-Req-Id
True-Client-Country-4JS
SR-User-Adfree
NGX
Platform
X-Cdn-Forward
X-APP-VERSION
X-EC-Lua
X-ID
X-Aicache-OS
X-LB-ID
X-Varnish-Hits
Rt-Fastcgi-Cache
X-Slack-Backend
X-Gamma-Serve
Origin
L
X-Varnish-Beresp-Status
X-Hash
X-CLOUD-TRACE-CONTEXT
X-Varnish-Beresp-Ttl
X-Mvc-Supplant-OutputCached
Fastly-Drupal-HTML
X-Varnish-Url
Sid
X-Cache-Backend
Lfy
X-Matched-Rule
X-Loc
X-Goog-Meta-Goog-Reserved-File-Mtime
Filterid
X-RateLimit-Limit
Geo-Info
X-NCache
X-PF-Uncompressing
CloudFront-Viewer-Country
X-Epic-Correlation-Id
Pics-Label
X-Refresh
X-Cache-Expires
X-Sn-Servicetimems
X-Via-Popv
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-Via-Popn
X-Via-Poph
X-Cdn-Origin
Pramga
X-Cache-Date
X-Core-Mission
X-Servername
Cmstype
X-TraceId
X-Tb-Optimization-Total-Bytes-Saved
Url
Req-Svc-Chain
Cmsid
X-Request-Start
X-Served-From
Kp-EeAlive
Tcn
Svr
NGB
X-Srv
Cache-Key
X-Error
A
VivaBuild
Viewtype
X-FireWall-Protection
Source
MIME-Version
M-TraceId
X-Varnish-Cacheable
X-Webkit-CSP-Report-Only
X-DC
X-Response-By
X-Vgn-Hpd-Reason
Arc-Country
Cross-Origin-Opener-Policy
Geoip-Latitude
GeoIp-Country-Code
X-NC
Xkeyi7
X-Servedbyhost
X-Air-Source
X-HS-Status
X-Proxy-Cachei7
Server-ID
X-Wa
TDXMobile
NtCoent-Length
HitType
X-Vc
X-Vcl-Version
Server-Ttl
X-B3-Spanid
X-SaId
X-JoinUs
X-CDN-Forward
Content-Secure-Policy
X-NGENIX-Cache
N-Cache
X-PHP-Backend
X-BBXSRF
DataCenter
X-Geo
X-Cache-Remote
X-Edge-Location
X-Erf-Stays-Bingo-Pdp-Web
S-Rt
X-Cache-2
X-LiteSpeed-Cache-Control
Resin-Trace
X-Esi
X-Li-Proto
X-Service
X-Internal-Host
CACHE
SID
X-CCDN-Origin-Time
X-Contensis-Viewer-Groups
D-Cc-Upstream
X-Varnish-Authentication
X-Hcs-Proxy-Type
X-LI-Proto
X-Cache-ASPX
X-Cc-Req-Id
X-Cc-Via
X-CCDN-CacheTTL
Cteonnt-Length
X-Extlb
X-HOST
Ohc-File-Size
X-Viewer-Country
X-Forwarded-Site
X-VCL-Version
X-Sucuri-Cache
FSS-Cache
X-Svr
Request-ID
Cross-Origin-Window-Policy
X-RAMCache
X-HostName
X-UA
X-Cs
X-Host-Name
X-DSS
X-DI
X-DB
X-DW
X-RPS
X-TIM-N
X-Newrelic-Synthetics
X-RSL
X-Server-IP
X-RPM
X-ServedByHost
X-Bc-Bl
X-WA
X-Via-NSCOPI
Hostname
GeoIP-Country-Code
GeoIP-Latitude
X-Proxy-Upstream
X-API-Version
X-App
Surrogated-Key
LB
Mail-Subject
We-Hiring
X-Req
X-Date
X-Accel-Expires-Debug
Memcached
X-PJAX-URL
X-Cache-Config
X-FPC
X-VC-Cache
X-Origin-Time
CF-Cached-On
X-Nyt-Route
X-Gdpr
XServer
X-Instrumentation
X-Action
X-VC
X-ZONE
X-SN
X-Check-Cacheable
X-Kraken-Routeconfig-Destination
ProcessTime
X-Kraken-Loop-Name
X-NodeID
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
Server-Id
Env
Cache-Provider
X-Server-Lifecycle-Phase
X-Swift-Error
Ohc-Cache-HIT
X-TIME
Mime-Version
X-Men
X-Air-Trace-Id
X-Oss-Cdn-Auth
X-SB
X-Fpc
X-Edge-Location-Klb
Upgrade-Insecure-Requests
X-Webstats-RespID
X-CF-Powered-By
X-Region-Sid
X-Sigma-Backend
X-APP
X-Sigma
X-Rocket-Build-Number
X-Provided-By
X-Dynatrace-Js-Agent
X-URL
X-MSEdge-Flight
CPC-Cache
X-MSEdge-Features
VNS-Cache
VNS-Age
CPC-Age
X-FORWARDED-FOR
Time
W
X-SD-PageType
Memory
X-Depends-On
X-Cdn-Request-ID
Srv
X-UnsetCookies
Cdn
X-CSRF-TOKEN
X-BACKEND-TTL
X-Dw-Trace-Id
X-Ftr-Cache-Host
CDN
X-Render-Time
X-BBC-Edge-Cache-Status
X-Client-Ip
X-Zone
X-Fastly-Request-Id
X-Flog
X-ABtesting
EpKe-Alive
Dnion-Transfer-Encoding
X-Parent-Response-Time
X-Hello
X-NGINX-Cache
X-Fastly-Backend-Reqs
X-Akamai-Pragma-Client-IP
X-Dynatrace
X-Via-PopH
Fastcgi-Cache-TTL
X-Via-PopN
My-App
X-Pad
State
Media-Length
X-Via-PopV
X-ServerName
X-FTR-Cache-Host
X-Auto-Login
Processtime
X-Cache-Tag
X-Acquia-Site
X-Acquia-Application-UUID
X-Presslabs-Stats
X-Oracle-DMS-ECID
X-Worker
X-Acquia-Application-Trace
Proxy-Connection
X-Acquia-Purge-Tags
X-Pf-Uncompressing
Vha6-Origin
X-Varnish-Beresp-TTL
X-Ua
PICS-Label
X-Snapshot-Date
X-BBC-Origin-Response-Status
X-LiteSpeed-Tag
X-Minions-Version
Epwk-X-Cache
X-Cluster-Node
X-CACHE-AGE
Cf-Ipcountry
Xet-Cookie
X-Lb-Id
X-ElasticPress-Search
Datacenter
X-Varnish-URL
X-Akamai-ERRuleID
X-Ms-Meta-Staticbatchstarttime
X-Vcache
X-Akamai-ERPolicy
X-IN-APIGATEWAYSSL
X-MiniProfiler-Ids
X-ElasticPress-Query
X-Request-URL
X-IN-APIGATEWAY
X-Mg-Request-Id
X-Ms-Meta-Originalurl
CountryCode
X-Tx-Id
X-Apw-Hits
Warning
X-Cache-Status-Check
X-Apw-Access-Object
Content-Script-Type
X-Litespeed-Cache-Control
X-Apw-Access-Action
Content-Style-Type
X-Apw-Access-Token
Inserted-Into-Cache-At
X-Redis-Count
Environment
X-Storefront-Renderer-Verified
X-Redis-Duration-Ms
URI
X-Traceid
OT-Force-Account-Verify
X-Debug-Cache-Fetch
X-Debug-Cache-Store
Ohc-Response-Time
X-Tid
X-C
Phost
NnCoection
X-B3-Parentspanid
X-Amz-Meta-Cb-Modifiedtime