Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
Pragma
X-Powered-By
CF-RAY
X-XSS-Protection
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
P3P
X-Xss-Protection
Alt-Svc
X-Served-By
X-Download-Options
CF-Ray
X-Timer
Access-Control-Allow-Headers
X-Request-Id
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Generator
X-Cache-Status
X-Check
X-Request-ID
X-Envoy-Upstream-Service-Time
X-Cacheable
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Dns-Prefetch-Control
X-FRAME-OPTIONS
X-Iinfo
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Content-Encoding
Access-Control-Expose-Headers
Upgrade
Status
X-CDN
X-AspNetMvc-Version
X-XSS-PROTECTION
Server-Timing
Access-Control-Max-Age
X-Amz-Request-Id
Request-Context
X-Amz-Id-2
X-Turbo-Charged-By
X-AH-Environment
X-Via
X-Robots-Tag
P3p
X-Backend
X-Cache-Group
Cf-Edge-Cache
Host-Header
Keep-Alive
X-Proxy-Cache
X-Hacker
X-Server
X-Rq
X-Age
X-Server-Powered-By
X-Vhost
Allow
X-UA-Device
X-Varnish-Cache
X-Ws-Request-Id
EagleId
X-Dispatcher
X-Amz-Version-Id
Grace
Cf-Apo-Via
X-LiteSpeed-Cache
Nel
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Page-Speed
X-Device
Cf-Railgun
X-Swift-SaveTime
X-Swift-CacheTime
EagleEye-TraceId
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-WebKit-CSP
X-Pingback
X-Node
X-Host
Accept-CH
X-Server-Id
X-OneAgent-JS-Injection
Surrogate-Control
X-Backend-Server
X-CST
X-Readtime
X-Nginx-Cache-Status
X-Akam-SW-Version
X-Content-Security-Policy-Report-Only
Request-Id
Permissions-Policy
X-Application-Context
X-Cache-Lookup
Accept-Ch-Lifetime
X-Nginx-Upstream-Cache-Status
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Cloud-Trace-Context
X-Trace
X-Response-Time
X-Edge
X-HW
X-Ruxit-JS-Agent
X-Litespeed-Cache
X-Mod-Pagespeed
X-Ua-Compatible
Content-Location
X-Url
X-Clacks-Overhead
X-Midtier
Accept-CH-Lifetime
X-Mcache
X-ECACHE
X-ESI
X-Amz-Server-Side-Encryption
X-Oneagent-Js-Injection
X-Country
Accept-Ch
Rating
X-Upstream
X-PC
X-TtlSet
X-Vname
X-Vcap-Request-Id
X-MS-InvokeApp
Cache-Tag
X-Rack-Cache
X-D2id
Xkey
X-Content-Type
Fastly-Restarts
X-Element-Page-Cache
Verso
X-Exp-Variant
X-Kinja-Build
X-Kinja-Revision
X-Kinja-Server
X-Use-Magma
X-Kinja
X-GoogleNews-Bot
X-Exp-Id
X-Cdn-Fetch
RTSS
Edge-Control
X-Cache-TTL
X-Powered-By-Plesk
X-WebKit-CSP-Report-Only
X-VARITI-CCR
Origin-Trial
X-Cached
X-Ac
X-Navigation-Version
X-Abt-Application-Version
X-Goog-Hash
Service-Worker-Allowed
X-Ua-Device
X-GitHub-Request-Id
X-Amz-Rid
X-Country-Code
Pagespeed
X-Middleton-Display
Display
X-Sol
X-Mg-S
X-Ttl
X-Dw-Request-Base-Id
SPRequestGuid
X-SharePointHealthScore
X-Browser-Type
X-Server-Name
X-Ruxit-Js-Agent
Arr-Disable-Session-Affinity
X-B3-TraceId
Cross-Origin-Opener-Policy
X-Varnish-TTL
X-Instrumentation
X-Server-Lifecycle-Phase
X-Erf-Bev-Bev-Is-Generated
X-Kraken-Loop-Name
X-Erf-Bev-Bev
X-Powered-CMS
AR-PoweredBy
AR-Request-ID
AR-SID
AR-ATIME
SPRequestDuration
SPIisLatency
Response
X-Middleton-Response
X-Amzn-Trace-Id
AR-CACHE
X-Cache-Key
X-Fastly-Request-ID
X-NF-Request-ID
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Cnection
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-Times
X-HP-Trace-Id
X-HP-Webp
X-Jurisdiction
X-Version
X-Accel-Expires
X-T
Front-End-Https
Cache-Status
X-Ser
Cache-Tags
Edge-Cache-Tag
X-Client-IP
X-Px
X-Webkit-Csp
X-MSEdge-Ref
X-Pinterest-Rid
Pinterest-Version
Pinterest-Generated-By
Public-Key-Pins
X-Fastcgi-Cache
X-Hits
X-Recruiting
Nginx-Cache
X-B3-TraceId-Primal
Mrf-Cache-Status
X-Shield-Request-Id
MRF-Tech
Access-Control-Request-Method
X-Request-Received
X-Request-Processing-Time
X-LLID
X-Frontend
X-Ua-Browser
X-B3-Traceid
Server-Node
Payment
X-NWS-LOG-UUID
TP-Cache
X-RateLimit-Remaining
X-DIS-Request-ID
X-FastCGI-Cache
X-HS-Cache-Config
X-HS-Hub-Id
X-HS-Combine-CSS
X-HS-Content-Id
TP-L2-Cache
S
MicrosoftSharePointTeamServices
X-Content-Digest
X-LB-Cache
X-Goog-Metageneration
X-Distributor
X-PressLabs-Stats
X-Correlation-Id
X-Ratelimit-Remaining
Content-MD5
Realpath
X-Forwarded-For
X-Request-Handler-Origin-Region
X-Microsite
X-Envoy-Decorator-Operation
X-Geo-Country
X-Ezoic-Cdn
Access-Control-Allow-Method
X-Page-Id
Fastcgi-Cache
X-FB-Debug
X-Cluster-Name
X-Ratelimit-Limit
Accept-Charset
X-Rid
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Hostname
X-GUploader-UploadID
X-Seen-By
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Protected-By
X-RateLimit-Limit
X-Amz-Apigw-Id
X-Amzn-RequestId
Cleartype
X-Kinja-CCPA
TCN
X-Origin-Server
X-Newrelic-App-Data
X-B3-Sampled
DC
X-Webkit-CSP
X-TTL
X-Webkit-CSP-Report-Only
X-Debug-Info
X-Origin-Cache
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Mobile
X-Goog-Stored-Content-Length
Referer-Policy
X-Logged-In
X-Git-Hash
X-Varnish-Backend
X-Edge-Location-Klb
X-Kinsta-Cache
Alternate-Protocol
X-Azure-Ref
X-XRDS-Location
Cross-Origin-Resource-Policy
Healthy
X-Contextid
X-Varnish-Grace
Surrogate-Key
X-App-Environment
X-Aspnet-Version
X-Revision
X-Fb-Rlafr
X-Is-Crawler
X-Providence-Cookie
X-Flags
X-Aspnet-Duration-Ms
X-Amz-Replication-Status
X-Request-Guid
X-Grace
X-Route-Name
X-Amz-Meta-S3cmd-Attrs
X-TT
Count-Hit
X-Server-ID
X-Wix-Request-Id
Filterid
X-Whom
X-Content-Options
X-Forwarded-Proto
MS-Author-Via
Viewport
Charset
X-Akamai-Edgescape
X-IPS-LoggedIn
X-Id
Frame-Options
WPO-Cache-Status
WPO-Cache-Message
Paypal-Debug-Id
X-App-Server
X-Cache-Age
X-Hosted-By
X-Kong-Proxy-Latency
X-B
X-Kong-Upstream-Latency
X-Trace-Id
X-AppVersion
X-Backend-Name
X-Activity-Id
X-Www-Served-By
X-Cache-Control
X-Az
X-Magnolia-Registration
X-Client-Ip
Retry-After
X-Daa-Tunnel
X-Upgrade-Enabled
Section-Io-Cache
Refresh
Server-Name
Version
X-Varnish-Server
X-Type
Amp-Access-Control-Allow-Source-Origin
X-Varnish-Ttl
X-Proxy
X-Proxy-Cache-Info
X-F-Cache
X-Original-Request-Id
Host
X-Response-Served-From
X-EdgeConnect-Cache-Status
X-Rule
Akamai-GRN
SD-X-WS
X-Http-Reason
X-ARC
X-Load-Cache
X-User-Agent
Front
X-Status
X-Rocket-Nginx-Serving-Static
X-Edge-Location
X-Akamai-Request-ID2
X-Varnish-Age
X-UUID
Protected
X-Cache-Rule
X-Framework
X-Environment-Context
X-Region
X-L-Path
X-Jobs
X-Is-Bot
X-Cache-Grace
X-Cacheable-TTL
X-Rendered-As
VIX-Pulpo-Upstream-Status
X-Instance
VIX-Pulpo-Node
X-N
X-Source
X-FW-Dynamic
X-Page-View
From-Origin
X-Unique-Id
Fastly-SWR
Fastly-SIE
Access-Control-Request-Headers
X-Oracle-Dms-Ecid
X-Cache-Time
X-FW-Serve
X-FW-Server
X-FW-Version
X-FW-Type
X-FW-Static
X-FW-Hash
X-Adobe-Loc
X-RemovedCookies
X-ProcessESI
X-Oracle-Dms-Rid
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Time
X-Tumblr-User
X-Adobe-Content
X-Tumblr-Pixel
X-App-Version
X-COUNTRY
Content-Disposition
ServerID
SRV
X-G
X-ECache
X-Drupal-Cache-Tags
Country
X-HTML-Minification-Powered-By
X-Datadog-Sampling-Priority
X-Datadog-Trace-Id
X-Datadog-Parent-Id
X-Language
X-Tt-Trace-Tag
X-Tt-Trace-Host
Accept-Language
X-CDN-Forward
Liferay-Portal
X-Vcache
Countrycode
X-DynaTrace
X-DataDome
X-Yottaa-Optimizations
X-Datadog-Sampled
X-Yottaa-Metrics
X-RateLimit-Reset
X-Amzn-Remapped-Content-Length
X-DynaTrace-JS-Agent
X-Debug-IsConnected
X-Debug-IsPreview
X-Mg-Request-UUID
X-XRDS-LOCATION
X-ID
X-Generated-By
X-Drupal-Cache-Contexts
Backend
Xet-Cookie
X-Ratelimit-Reset
X-Content-Powered-By
CF-IPCountry
X-B3-SpanId
X-Device-Type
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-NYM-Debug-Backend
X-Nginx-Cache
X-Mode
Webserver
X-Zen-Fury
X-Tt-Logid
X-B-Cache
X-Signature
GEO-INFO
X-Erf-Web-Scheduler
X-Httpd
X-Content-Age
Xserver
X-Storage
Meta-Geo
X-Rewrite-Enabled
X-LAGOON
Url
X-Varnish-Cache-Hits
X-ServerID
X-SaId
X-Urbn-Site-Id
X-JoinUs
X-Sucuri-Cache
X-Sucuri-ID
X-UPSTREAM-Address
X-Urbn-Context-Path
X-Cache-Action
X-Director
Azure-Version
Filters
Load-Balancing
Azure-SlotName
Azure-SiteName
X-Servername
Azure-InstanceId
Azure-RegionName
Onion-Location
Locale
S-Rt
X-Container-Uri
X-Varnish-Hostname
X-Cache-Operation
X-SayCDN-TTL
X-Soup
X-Proto
X-Say-TTL
X-Tb
X-Say-Cacheable
X-Git-Commit
X-Cache-Server
X-Labrador-Cache-Channel
X-Logging-Id
X-Ms-Request-Id
Uber-Trace-Id
X-Cluster-Node
X-Detected-As
X-Ms-Version
X-RM-Cache-TTL
X-VCT
X-PHP-Host
X-Generation-Time
X-Forwarded-Host
X-VC-Cache
X-Served-From
Web-Mar-Node
X-Xrds-Location
TWC-GeoIP-LatLong
TWC-GeoIP-Country
TWC-Locale-Group
TWC-Privacy
TWC-Device-Class
Property-Id
Fastcgi-Useragent
X-Uri
Mn-Server-Ip
Webcakes-App-Name
TWC-Connection-Speed
Webcakes-App-Version
X-GeoCode
X-Extlb
X-GeoCountry
X-Proxied
X-Origin-Hint
X-Routing-Service
X-Skip-Cache
Webcakes-Region
X-Adobe-Source
X-Sql-Duration-Ms
X-Sql-Count
X-Zipkin-Id
CDN-RequestId
X-Timing-Wait
X-Tumblr-Pixel-2
Selected-Fe
X-RCS-CacheZone
X-Nf-Request-Id
X-Debug
X-Proxy-Build
X-R9-Blue-Green-Version
X-FB-TRIP-ID
X-LSADC-Cache
X-Tumblr-Pixel-3
DB-Nickname
X-Via-JSL
X-NGENIX-Cache
X-Fetched-On
X-Format
X-Cache-Expired-At
Node
X-Origin-Date
X-MP-GENERATED-AT
X-Lambda-Id
Source
OT-Force-Account-Verify
X-Cache-Hit
X-Node-Name
Fastly-Drupal-HTML
Content-Secure-Policy
X-Varnish-Hits
X-MCACHE
X-AIR-PT
X-Cache-TTL-Remaining
X-UA-Device-Type
X-Tec-Api-Version
X-Tec-Api-Root
X-Tec-Api-Origin
X-Template
X-Pass-Why
X-Loop
X-Tncms
X-Ua
NGB
X-Pubstack
X-PHP-Backend
X-Srv
X-Endurance-Cache-Level
X-Server-W
Upgrade-Insecure-Requests
X-Redis-Cache
Cross-Origin-Window-Policy
X-Real-IP
Ms-Operation-Id
MS-CV
X-Origin-CC
X-RTag
Cache-Hits
X-Origin-TTL
X-Fastly-Request-Id
X-Cache-Host
X-CCDN-CacheTTL
X-CCDN-Origin-Time
Cache-Name
X-Hcs-Proxy-Type
X-GEO
X-Optimistic-Header
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
X-Reqid
X-Xfnlog-Site
Section-Origin-Responded
Section-Io-Id
X-Cms-Context
X-IPLB-Request-ID
X-IPLB-Instance
X-Restarts
Apigw-Requestid
Cache-Provider
X-CSRF-Token
X-Cache-Type
X-Akamai-Transformed
X-ProxyCache-Status
X-BYPASS-REASON
CDN-RequestPullCode
X-ProxyCache-Key
CDN-RequestPullSuccess
CDN-RequestCountryCode
CDN-Uid
CDN-CachedAt
CDN-Cache
CDN-EdgeStorageId
CDN-PullZone
X-No-Session
X-Hl-Ver
X-Cluster
X-Via-Fastly
X-AWS-Id
X-VWS-Id
X-LJ-Flow-ID
X-Aspnetmvc-Version
X-S
X-Datadome
X-Section
X-Access
X-Proxy-Cache-Status
X-Cache-Info
Canary
X-Bl-Debug
CPC-Age
X-Irp-Debug
We-Hiring
CPC-Cache
Web-Mar-Region
Candidate-Md5Url
X-A
X-A-Ccd
X-Orig-Expires
X-Origin-Time
T-Server
X-A-Dcw
X-Nyt-Route
DCR-Decision-By
X-D
X-Cache-NE
X-Mvc-Supplant-Cachable
X-BCube-Filmed-By
X-Csrf-Jwt
BehaviorPad-Version
X-Ec-Custom-Error
X-Ec-GeoHdr
X-Cache-Bucket
X-Epic-Correlation-Id
Redirect-Candidate
X-Debug-Cache-Store
Odigeo-Trace-Id
N-Cache
Ngx.Var.Host
X-Ec-Fail
Rendered-Blocks
X-Gdpr
Sslversion
X-Fastly-Backend
Surrogated-Key
X-FC-Vary-Parameters
X-Forwarded-Path
X-Eu-Site
X-External-Request-Id
Server-Host
X-Debug-Cache-Fetch
Meta-Geo-Continent
Gannett-Cam-Experience-Id
X-Policy
Gh-Request-Id
Ha-Gx-Prefs
Fastly-GeoIP-CountryCode
Fastly-Backend-Name
W
VNS-Cache
VNS-Age
HA-Ipaddr
X-Date
Magicmarker
Mail-Subject
MD5-Digest
X-GeoIP-Country-Code
X-GeoIP-Region-Code
L
L5d-Success-Class
Lang
DCR-Processing-Time-Ms
X-A-Dam
X-Web-Node
Xc-Version
X-Wikidot-Static-Cache
X-Slack-Backend
X-Slack-Shared-Secret-Outcome
X-Wikidot-Backend
X-CF-Lambda-Fn
X-Bc-Bl
X-Dispatcher-Number
X-S-Cookie
X-ScT
X-SD-PageType
X-Aed
X-Developer
X-We-Are-Hiring
X-Destination
X-TIM-N
X-Var-Ttl
X-CACHE-AGE
X-B-Cookie
X-Cdn-Diag
X-Vdms-Path
X-Vtex-Remote-Cache
X-SRCache-Key
X-Tenant
X-Application
X-Vdms-Version
X-CF-Lambda-Version
X-Shop-Environment
X-Conf
X-RateLimit-Limit-Second
X-Request-Host
X-A-Wwc
X-Rojux
X-CacheTTL
X-RateLimit-Remaining-Second
X-CGP
X-Accel-Expires-Debug
X-A-Dgt
X-Handled-By
WP-Super-Cache
X-Geo-Header
X-Test
X-PAYTM-SRV-ID
X-Owner
X-Thanos
X-Core-Mission
X-SVT-ORM-RULES
X-BBC-Edge-Cache-Status
X-WADP-Cache
X-Gzip
X-Storefront-Renderer-Rendered
Machine
Memcached
X-App-Name
X-Generated-On
X-SVT-ORM-VERSION
X-Viewer-Country
X-Auto-Login
Thinkindot-CacheControl-Type
Thinkindot-Control
X-Fmm-Version
Thinkindot-CacheControl
X-Pool
TDXMobile
X-Rn-Rsrv
X-Platform
X-Forwarded-Site
X-Newrelic-Synthetics
X-Thinkindot-L3
X-Cache-Debug
X-Esi-Check
Release
X-VG-WebCache
Req-Svc-Chain
X-Varnishpool
Origin
X-Has-Esi
X-Server-IP
X-Is-Gdpr
X-JWT-State
X-Origin-Response-Time
X-Alternate-Cache-Key
Cmsid
Host-ID
X-Cache-Id
X-Level-Front-Cache
Vix-Hermes-Req-Id
X-S-Maxage
X-Bip
X-Old-Content-Length
X-Core-Value
X-Mly-Id
AKAMAI
X-Org
X-Mid
Cmstype
X-ShardId
X-Worker
X-ShopId
Environment
X-Sorting-Hat-PodId
X-Accel-Buffering
X-Request-Time
X-Shopify-Stage
X-Hash
X-Human
X-INCAP-ABP
X-Wix-Viewer-Type
Datacenter
X-Clara-WADP
X-Vcl-Version
X-Node-Id
X-CMSURLCustom
X-Sorting-Hat-ShopId
X-Clientip
X-Cs
User-Cache-Control
X-TIME
X-DPWN-IS-SECURE
X-Dispatcher-Server
X-Azure-Ref-OriginShield
X-Device-Os
X-Mvc-Supplant-OutputCached
X-PERF
X-ApacheServer
X-DefHash
X-VG-TLSProxy
X-Qloud-Router
X-Origin
True-Client-Country-4JS
Fastly-SSL
X-Scale
X-Cdn-Srv
X-Varnish-Remaining-TTL
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
X-Up
X-Vmg-Version
X-Sn-Servicetimems
X-WA-Info
X-VServer
X-Block-Status
X-Nginx-Cache-Key
NM-Fastcgi-Cache
Server-Hostname
Sever-Int
X-Gen-Mode
X-DefElseHash
ServedBy
X-From
Producers
X-Nananana
X-Hnp-Log
CDCHOST
X-Loc
X-Cdn-Origin
CloudFront-Viewer-Country
Country-Code
Expect-Staple
Esi-Enabled
DSUID
Server-Ext
X-Air-Trace-Id
X-Air-Source
X-Air-Hostname
X-Parent-Response-Time
X-TA-CDN-Provider
X-Presslabs-Stats
X-Op-Id-All
X-NCache
X-App
X-Variation
Apple-News-Services-Handled
Apple-News-Services-Request-Url
X-NodeID
X-Cache-Status-Check
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
C-Via
Adler-Geo
Ssr
Platform
Wxu-Next-Commit
Wxu-Next-Hostname
X-Akamai-Device-Characteristics
Wxu-Next-Region
X-Instance-Name
Pics-Label
Is-Eu
Origin-EX
X-GeoIP
Origin-CC
X-Microcachable
X-LB-NoCache
X-Refresh
X-Amz-Meta-Cb-Modifiedtime
X-Site-Version
Cache-Host
X-Cache-Enabled
X-Locale
AMP-Access-Control-Allow-Source-Origin
XM
X-Platform-Router
X-Nitro-Cache
Server-Info
Memory
X-Platform-Processor
X-Platform-Cluster
X-Origin-Expires
Time
X-Tx-Id
X-HN
X-HA-Backend
X-Dc
Server-ID
PFcat
NGX
X-VarnishDD-TTL
X-TimeS
X-ZONE
Resin-Trace
X-API-Version
X-VHOST
X-Via-SSL
GeoIP-Latitude
Locid
X-Via-Edge
Edge-Copy-Time
X-CACHE-GROUP
A
Hostname
X-Via-CDN
X-FL-EDGE
X-Ad-Defer-Variation
Srvid
X-FL-QIT-DEBUG
X-Upstream-Ct
X-Upstream-Ht
X-Tb-Optimization-Total-Bytes-Saved
Origin-Agent-Cluster
YJS-ID
X-Varnish-Beresp-Grace
Cf-Device-Type
X-Correlation-ID
X-Wp-Cf-Super-Cache-Active
X-DC
X-FireWall-Port
X-Varnish-Beresp-Ttl
Sid
X-ATG-Version
X-Contensis-Viewer-Groups
X-Vgn-Hpd-Reason
X-Zone
Cache-Key
X-Webkit-Csp-Report-Only
X-Cache-ASPX
X-Varnish-Authentication
X-Internal-Host
X-Fpc
Cdn-Requestid
X-Moov-T
X-Moov-Xdn-Version
X-Github-Request-Id
X-Provided-By
X-WP-CF-Super-Cache-Active
Uri
X-Pod-Name
X-Cached-By
X-DataCenter
X-Micro-Cache
X-B3-Spanid
X-LiteSpeed-Cache-Control
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
State
X-Planisys-CDN-Cache
X-HS-Content-Campaign-Id
User-Agent
X-RN-RSRV
True-Client-Ip
X-Platform-Server
X-TraceId
X-Fastly-Cache
X-Info
X-URL
X-LiteSpeed-Tag
X-Cache-Remote
X-SIPLIST1
X-Sigma-Backend
X-Rocket-Build-Number
IsBot
GeoIp-Country-Code
X-B3-Parentspanid
X-Release
X-Sigma
X-Buckets
Location
GeoIP-Country-Code
X-Nitro-Cache-From
X-Nitro-Rev
Cache
XServer
X-AB
X-NGINX-Cache
X-Api-Version
X-VC
X-VCache
X-Backend-Instance
Cdn
X-Gamma-Serve
Tcn
X-MSEdge-Features
X-MSEdge-Flight
X-Datacenter
True-Client-IP
SID
X-Geo-Region
Cache-Tv-Group
Srv
Fastly-Drupal-Html
X-GeoIP-City
X-HostName
NtCoent-Length
X-Generated-In
X-CS
X-Cache-Ttl
Lb
X-Accel-Version
X-CSRF-TOKEN
CF-Ctrl
X-FPC
X-Vgn-Hpd-Cached
X-HS-Status
X-Vgn-Hpd-Variations-Key
X-Vgn-Hpd-Ssi
X-Geo
HostName
X-FTR-Request-ID
Kp-EeAlive
X-TRACE-ID
X-Rebelmouse-Cache-Control
Path
X-Rebelmouse-Surrogate-Control
X-Scheme
X-APP-VERSION
X-CACHE-KEY
X-SRV
X-Is-Tablet
X-Frame-Option
X-Location
X-Mobile-URL
X-Tcp-Rtt
X-Is-Desktop
X-Is-Mobile
X-Browser-Name
X-Is-Supported-Browser
X-TX-ID
X-NewRelic-App-Data
X-Aicache-OS
Ohc-File-Size
X-Developers
CacheControlHeader
Epwk-X-Cache
X-Hyper-Cache
On-Server
X-Men
X-Region-Sid
X-GoCache-CacheStatus
CountryCode
Cf-Ipcountry
Serverid
X-UA
X-CDN-Cache-Status
Tube-Got-Results
Cdncip
Tube-Got-Eval
Cdnsip
X-LB-ID
V-Age
X-Air-Pt
Tube-Return
X-V-Cache
X-AK-Request-ID
X-Cache-Tags
Click-Count-Error
RNT-Machine
X-Cache-FS-Status
X-Minions-Version
RNT-Time
X-SB
Mime-Version
X-Via-Popn
X-Via-Popv
X-Via-Poph
X-B3-Trace-ID
X-Service
X-Amz-Meta-Opti
Tube-Get-Contents
X-Acquia-Purge-Cdn-Unconfigured
X-Esi
Click-Count-Action-Start
X-Req
X-Guploader-Uploadid
WWW-Authenticate
X-EC-Lua
X-Traceid
RATING
Proxy-Connection
X-Pad
X-Webstats-RespID
XkeyRZ
X-Branch-Name
X-Proxy-CacheRZ
WebServer
X-Wp-Cf-Super-Cache
X-Wp-Cf-Super-Cache-Cache-Control
X-Cdn-Forward
X-Wp-Cf-Super-Cache-Cookies-Bypass
CDN
X-Vc
ENV
Env
X-Cdn-Cache-Status
WZWS-RAY
Yak-Timeinfo
X-Servedbyhost
X-Nc
X-Wa
Ohc-Cache-HIT
X-Edge-Pop
Server-Id
Geoip-Latitude
X-Check-Cacheable
X-VCL-Version
LB
X-Ha-Backend
Ngx
X-TT-LOGID
X-User
X-TH-Server
CF-Cached-On
X-Processor
X-Ckpd-Fst-Backend
X-NWS-UUID-VERIFY
X-Akamai-Pragma-Client-IP
X-Fastly-Country-Code
X-Lb-Cache
X-Vercel-Id
Content-Script-Type
X-Vercel-Cache
X-Render-Time
X-Lb-Nocache
X-CUA
Content-Style-Type
M-TraceId
X-Country-Code-Real
Req-ID
X-MiniProfiler-Ids
HIT
X-Acquia-Site
Cdn-Request-Time
Cdn-Host
PICS-Label
X-Acquia-Purge-Tags
X-Acquia-Application-UUID
X-Via-Ucdn
X-Edge-Server
X-Acquia-Application-Trace
X-Cache-Date
X-FTR-Backend
X-Edge-POP
X-NMSegId
Edge-Cache
X-IN-APIGATEWAY
X-Response-By
X-Snapshot-Date
X-IN-APIGATEWAYSSL
X-APP
X-WP-CF-Super-Cache-Cookies-Bypass
X-Dw-Trace-Id
X-FTR-Backend-Server
X-Litespeed-Cache-Control
X-FTR-Cache-Status
X-FTR-Balancer
X-FTR-Expires
X-Udemy-Cache-App-Namespace
Yjs-Id
X-WA
X-UP
X-Miniprofiler-Ids
X-Origin-Cache-Key
Cneonction
X-ElasticPress-Query
X-Serial
Inserted-Into-Cache-At
X-Fastly-Cache-Hits
X-Service-Response-Time
CACHE-MISS-TO-ORIGIN
X-Fastly-Backend-Reqs
X-Iauth-Set-Uid
X-NC
Vha6-Origin
X-ServedByHost
X-M-Log
X-M-Reqid
X-Varnish-Beresp-TTL
Hit
Log-Origin
X-Cached-Since
Sm-Log-Id
X-RAMCache