Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
Strict-Transport-Security
X-Frame-Options
X-Content-Type-Options
Last-Modified
Link
CF-Cache-Status
Cf-Request-Id
CF-RAY
Accept-Ranges
ETag
Expect-CT
Pragma
X-Powered-By
X-Cache
Via
X-XSS-Protection
Age
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Xss-Protection
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
X-FRAME-OPTIONS
X-Served-By
X-Download-Options
X-Timer
Access-Control-Allow-Headers
X-Request-Id
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
X-AspNet-Version
Alt-Svc
X-Runtime
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-DNS-Prefetch-Control
X-Cache-Status
X-Check
X-Generator
X-Cacheable
X-Request-ID
X-Iinfo
P3p
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
Feature-Policy
X-Content-Security-Policy
Status
X-Drupal-Dynamic-Cache
Content-Encoding
Access-Control-Expose-Headers
X-AspNetMvc-Version
Upgrade
X-CDN
X-Ua-Compatible
Access-Control-Max-Age
CF-Ray
X-Via
X-Robots-Tag
X-Cache-Group
Server-Timing
X-UA-Device
Request-Context
Keep-Alive
X-AH-Environment
X-Amz-Request-Id
X-Turbo-Charged-By
X-Proxy-Cache
X-Backend
X-Amz-Id-2
X-Age
X-Ws-Request-Id
Host-Header
X-Dns-Prefetch-Control
X-Hacker
X-Server-Powered-By
X-Server
X-Rq
X-Vhost
X-LiteSpeed-Cache
X-Varnish-Cache
X-Amz-Version-Id
Grace
X-Dispatcher
Cf-Edge-Cache
EagleId
Allow
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
X-Page-Speed
Accept-CH
X-Nginx-Cache-Status
X-WebKit-CSP
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Aws-Lambda-Call-Status
X-Host
X-Node
Cf-Railgun
X-Pingback
X-Cache-Spec
X-Server-Id
X-OneAgent-JS-Injection
X-Backend-Server
X-Akam-SW-Version
Surrogate-Control
Request-Id
EagleEye-TraceId
X-Response-Time
X-Cache-Lookup
Accept-CH-Lifetime
X-Akamai-Path-Stats
X-Readtime
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Content-Location
X-HW
X-Content-Security-Policy-Report-Only
Rating
X-Application-Context
X-Cloud-Trace-Context
X-Trace
Fastly-Restarts
X-Clacks-Overhead
X-WebKit-CSP-Report-Only
X-Nginx-Upstream-Cache-Status
X-Country
X-Url
X-Oneagent-Js-Injection
X-MS-InvokeApp
X-Amz-Server-Side-Encryption
X-Rack-Cache
X-Edge
X-CST
X-TtlSet
X-PC
X-Vname
Edge-Control
X-Ruxit-Js-Agent
X-Content-Type
X-Mod-Pagespeed
X-B3-TraceId
X-Vcap-Request-Id
Accept-Ch-Lifetime
X-ESI
X-FastCGI-Cache
X-D2id
Verso
X-Exp-Id
X-Exp-Variant
X-GoogleNews-Bot
Xkey
X-Cdn-Fetch
X-Use-Magma
X-Kinja-Server
X-Kinja
X-Kinja-Build
X-Kinja-Revision
X-GitHub-Request-Id
Cache-Tag
X-Mcache
Service-Worker-Allowed
X-Amz-Rid
X-Powered-By-Plesk
Cf-Apo-Via
X-Ruxit-JS-Agent
RTSS
X-Varnish-TTL
X-Ttl
X-Navigation-Version
X-VARITI-CCR
X-Abt-Application-Version
X-Server-Name
X-Upstream
X-Version
X-Client-IP
X-Cached
X-Ac
X-Cnection
X-ECACHE
X-Element-Page-Cache
Arr-Disable-Session-Affinity
X-Dw-Request-Base-Id
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-SharePointHealthScore
SPRequestGuid
Permissions-Policy
SPIisLatency
SPRequestDuration
X-Px
X-Middleton-Display
Display
Pagespeed
X-Sol
Public-Key-Pins
X-Country-Code
X-RateLimit-Remaining
X-Cache-TTL
X-NWS-LOG-UUID
X-Middleton-Response
Response
X-Ser
X-Midtier
X-Edge-Location-Klb
X-Cache-Key
X-Kinsta-Cache
X-Goog-Hash
X-Forwarded-For
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
Content-MD5
X-DataDome
X-Shield-Request-Id
X-MSEdge-Ref
Front-End-Https
Access-Control-Request-Method
X-NF-Request-ID
AR-PoweredBy
AR-SID
AR-Request-ID
AR-CACHE
AR-ATIME
X-Recruiting
X-T
TP-Cache
TP-L2-Cache
X-Jurisdiction
X-HP-Trace-Id
X-RateLimit-Limit
X-HP-Webp
X-Correlation-Id
Nginx-Cache
Edge-Cache-Tag
X-B3-TraceId-Primal
Mrf-Cache-Status
MicrosoftSharePointTeamServices
MRF-Tech
X-Accel-Expires
X-Daa-Tunnel
X-Mg-S
X-Powered-CMS
X-Grace
TCN
X-Content-Digest
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Erf-Bev-Bev
X-Hits
X-Amzn-Trace-Id
X-Request-Received
X-Request-Processing-Time
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
Filters
Server-Name
X-HS-Combine-CSS
X-HS-Content-Id
X-HS-Cache-Config
X-HS-Hub-Id
Server-Node
X-Id
MS-Author-Via
X-Geo-Country
Fastcgi-Cache
X-Fastly-Request-Id
X-Webkit-Csp
Accept-Ch
X-Frontend
Count-Hit
X-Distributor
X-PressLabs-Stats
X-Origin-Server
X-XRDS-Location
X-Ezoic-Cdn
X-Ua-Browser
Filterid
Cross-Origin-Opener-Policy
X-Protected-By
X-LLID
S
X-ASPNET-VERSION
X-F-Cache
X-Microsite
X-FB-Debug
X-Amz-Meta-S3cmd-Attrs
X-Language
X-Request-Handler-Origin-Region
Charset
X-Forwarded-Proto
X-LB-Cache
Host
X-Seen-By
X-Git-Hash
X-B3-Sampled
X-Ratelimit-Reset
Payment
X-Ab
Cache-Status
X-Page-Id
X-VCache
X-Cluster-Name
Surrogate-Key
X-Rid
Cache-Tags
X-Cdn
X-Www-Served-By
Realpath
X-Upgrade-Enabled
X-Logged-In
Access-Control-Allow-Method
Retry-After
X-Source
Alternate-Protocol
X-Origin-Cache
X-Cache-Age
Accept-Charset
X-Aspnet-Version
X-DIS-Request-ID
X-Varnish-Backend
X-NGENIX-Cache
X-Type
Paypal-Debug-Id
DC
X-AppVersion
X-Activity-Id
X-Az
Cleartype
X-Amz-Replication-Status
X-Wix-Request-Id
X-Template
X-Varnish-Grace
X-App-Environment
X-Is-Crawler
X-Providence-Cookie
X-Tb
X-Signature
X-Route-Name
X-Request-Guid
X-Flags
X-B-Cache
X-Aspnet-Duration-Ms
ServerID
X-Envoy-Decorator-Operation
X-TT
X-B
X-Hostname
X-Revision
X-DynaTrace
X-Fastcgi-Cache
Frame-Options
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Node-Name
X-Cache-Rule
X-Contextid
X-Drupal-Cache-Tags
X-Pinterest-Rid
Pinterest-Version
Pinterest-Generated-By
X-Proxy
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Goog-Stored-Content-Length
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Metageneration
X-Goog-Stored-Content-Encoding
X-GUploader-UploadID
X-Debug
Refresh
X-Content-Options
X-Fastly-Request-ID
X-Mobile
Amp-Access-Control-Allow-Source-Origin
Cross-Origin-Resource-Policy
X-Load-Cache
X-XRDS-LOCATION
Referer-Policy
X-N
X-TTL
Node
X-Cache-Control
X-Response-Served-From
Country
X-Original-Request-Id
X-EdgeConnect-Cache-Status
NGB
X-Varnish-Age
Akamai-GRN
X-Trace-Id
X-Varnish-Server
X-Magnolia-Registration
X-NYM-Debug-Backend
Viewport
X-Cache-Time
X-Status
X-Instance
X-Debug-IsPreview
X-Debug-IsConnected
X-Content-Powered-By
Url
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
Uber-Trace-Id
Access-Control-Request-Headers
Content-Disposition
X-Whom
X-Cache-Grace
X-Cacheable-TTL
X-Real-IP
X-Servername
X-L-Path
X-Jobs
X-Environment-Context
X-G
X-Cache-TTL-Remaining
X-Akamai-Request-ID2
X-COUNTRY
X-Yottaa-Optimizations
X-User-Agent
X-Is-Bot
X-Framework
X-Adobe-Loc
X-Rendered-As
X-Mid
X-Yottaa-Metrics
X-ProcessESI
X-RemovedCookies
X-Page-View
X-Adobe-Content
Srv
X-Unique-Id
X-Via-JSL
X-Cache-Expired-At
Countrycode
X-Cache-Hit
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Drupal-Cache-Contexts
X-Tumblr-Pixel
X-Tumblr-User
Version
X-APP-VERSION
X-Cache-Operation
X-CDN-Forward
Accept-Language
X-Rule
X-Litespeed-Cache
X-Mg-Request-UUID
Healthy
X-Http-Reason
X-Backend-Name
X-ECache
X-Akamai-Edgescape
X-Cache-Action
X-Api-Version
Protected
X-Server-ID
X-App-Server
X-Debug-Info
X-Content
Content-Secure-Policy
Section-Io-Cache
X-Azure-Ref
X-Tt-Logid
X-Hosted-By
X-Time
X-IPLB-Instance
X-IPLB-Request-ID
X-Generation-Time
X-VC-Cache
Server-Info
Backend
X-Ratelimit-Remaining
X-Restarts
Meta-Geo
X-URL
X-Generated-By
X-Mobile-URL
X-UPSTREAM-Address
X-RN-RSRV
Load-Balancing
X-FW-Dynamic
X-Amzn-RequestId
Xserver
X-HTML-Minification-Powered-By
CF-IPCountry
X-Amz-Apigw-Id
X-Storage
X-FW-Serve
X-FW-Server
X-FW-Static
X-FW-Type
X-FW-Hash
X-Device-Type
X-Oracle-Dms-Ecid
Onion-Location
GEO-INFO
Property-Id
X-Locale
TWC-Locale-Group
X-Format
X-Access
S-Rt
TWC-Device-Class
X-Oracle-Dms-Rid
TWC-GeoIP-LatLong
TWC-GeoIP-Country
X-FireWall-Port
X-Handled-By
X-SRV
X-Cms-Context
TWC-Connection-Speed
Webcakes-Region
Webcakes-App-Name
X-Cache-Status-Check
Azure-SiteName
Azure-SlotName
Webcakes-App-Version
Azure-Version
TWC-Privacy
X-Varnish-Cache-Hits
X-Origin-Hint
Azure-RegionName
X-PCL
X-OCL
X-Section
Azure-InstanceId
X-Urbn-Context-Path
X-Provided-By
Web-Mar-Node
X-Content-Age
X-Varnish-Hostname
X-Varnish-Beresp-Grace
Locale
X-Correlation-ID
Eomportal-Instance
X-JoinUs
X-Say-Cacheable
X-Proto
X-SaId
X-Skip-Cache
X-Cache-Server
X-Labrador-Cache-Channel
X-Say-TTL
X-Region
X-Site-Version
X-Forwarded-Host
X-Edge-Location
X-PHP-Host
X-Urbn-Site-Id
X-Redis-Cache
X-PHP-Backend
X-SayCDN-TTL
CDN-CachedAt
CDN-EdgeStorageId
Cache-Name
X-RTag
CDN-Uid
X-Server-W
CDN-RequestCountryCode
CDN-RequestId
CDN-PullZone
DB-Nickname
MS-CV
Ms-Operation-Id
CDN-Cache
X-GeoCountry
X-LJ-Flow-ID
X-VWS-Id
X-Web-Node
X-Nginx-Cache-Key
Liferay-Portal
X-Sql-Count
X-Via-Fastly
X-Sql-Duration-Ms
X-Proxy-Cache-Status
X-Varnishpool
X-GeoCode
X-AWS-Id
X-Adobe-Source
X-FB-TRIP-ID
X-R9-Blue-Green-Version
X-Cache-Type
X-Cache-Host
X-Xfnlog-Site
X-ProxyCache-Key
Apigw-Requestid
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-No-Session
X-ShardId
X-Hl-Ver
X-Detected-As
X-BYPASS-REASON
X-Alternate-Cache-Key
X-Request-Time
X-Mode
X-ProxyCache-Status
X-Shopify-Stage
Mn-Server-Ip
X-ShopId
WP-Super-Cache
X-Ms-Version
X-UA-Device-Type
X-Ms-Request-Id
X-Cache-Enabled
X-Storefront-Renderer-Rendered
X-DynaTrace-JS-Agent
X-Proxy-Build
X-Extlb
X-Routing-Service
X-ServerID
X-Zipkin-Id
X-Timing-Wait
Selected-Fe
X-Proxied
X-WP-CF-Super-Cache
X-Varnish-Ttl
X-Tid
X-WP-CF-Super-Cache-Cache-Control
X-Uri
X-Loop
X-TNCMS
X-Amzn-Remapped-Content-Length
X-B3-Traceid
X-Ua
X-Vgn-Hpd-Reason
X-Nginx-Cache
X-Cache-NGX
X-Dc
X-TIME
X-Pubstack
X-Reqid
X-Origin-Date
Fastcgi-Useragent
Xet-Cookie
X-Tumblr-Pixel-2
X-Soup
X-Zen-Fury
X-Aspnetmvc-Version
X-LSADC-Cache
X-Ratelimit-Limit
X-Webkit-CSP
X-UUID
X-Service
X-Newrelic-Synthetics
ServedBy
X-MP-GENERATED-AT
X-TA-CDN-Provider
From-Origin
X-Origin-CC
X-GEO
Origin
X-Origin-TTL
X-Varnish-Hits
Source
X-Cache-Debug
X-Human
X-App-Version
Cache
X-NewRelic-App-Data
X-Cached-By
X-Cache-Tags
Cross-Origin-Window-Policy
X-Tec-Api-Version
X-Tec-Api-Root
X-Tec-Api-Origin
X-Datadome
X-RCS-CacheZone
X-Varnish-Beresp-Ttl
Rip
MD5-Digest
BehaviorPad-Version
WPO-Cache-Status
WPO-Cache-Message
Rendered-Blocks
Fastly-Drupal-HTML
X-ScT
Host-ID
Upgrade-Insecure-Requests
X-Rewrite-Enabled
X-Request-Host
X-Debug-Cache
X-Ec-Fail
VNS-Age
CPC-Age
X-Orig-Expires
CPC-Cache
X-Ec-GeoHdr
X-User
X-TIM-N
X-PBS-Appsvrname
X-Developer
VNS-Cache
X-Parent-Response-Time
X-Tenant
X-External-Request-Id
X-NAPM-TraceId
Ngx.Var.Host
X-Vdms-Version
X-VG-WebCache
Sslversion
SD-X-WS
X-Vdms-Path
X-Forwarded-Path
DCR-Processing-Time-Ms
DCR-Decision-By
T-Server
Surrogated-Key
Expiry
Cdnsip
X-Destination
X-B-Cookie
X-ARC
X-Bc-Bl
A
X-A-Wwc
X-Shop-Environment
X-Aed
X-Application
X-S
X-S-Cookie
Meta-Geo-Continent
X-Rojux
Lang
X-A-Dgt
X-BCube-Filmed-By
X-SRCache-Key
X-A
Cdncip
X-D
X-AK-Request-ID
X-A-Ccd
X-A-Dam
Xc-Version
X-A-Dcw
X-Cache-NE
X-Connection-Hash
X-Processor
Odigeo-Trace-Id
OT-Force-Account-Verify
LB
Redirect-Candidate
X-Dispatcher-Number
Webserver
X-Nyt-Route
X-FW-Version
X-AOL-HN
X-Gdpr
X-Accel-Buffering
X-Origin-Time
X-Served-From
X-Cluster
Mime-Version
Environment
X-Aicache-OS
X-Owner
X-Cdn-Srv
X-CMSURLCustom
Thinkindot-CacheControl
Fastly-Backend-Name
AKAMAI
Server-Host
TDXMobile
Thinkindot-CacheControl-Type
Thinkindot-Control
X-Geo-Header
X-Sucuri-Cache
X-Level-Front-Cache
X-Sucuri-ID
X-Thinkindot-L3
X-Worker
X-JWT-State
X-Is-Gdpr
WebServer
X-Generated-On
X-Has-Esi
X-HS-Content-Campaign-Id
X-INCAP-ABP
X-Developers
X-WP-CF-Super-Cache-Active
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
Release
Svr
X-Varnish-CookieHashed-On
Tube-Got-Eval
Tube-Get-Contents
Producers
Platform
Memcached
Machine
X-Wix-Viewer-Type
X-VServer
Mobile-Detection-Method
NM-Fastcgi-Cache
X-Viewer-Country
X-Ad-Defer-Variation
Tube-Got-Results
X-SplitTest
X-SVT-ORM-VERSION
Vix-Hermes-Req-Id
Web-Mar-Region
Wxu-Next-Commit
Wxu-Next-Region
Wxu-Next-Hostname
V-Age
X-V-Cache
Tube-Return
X-Varnish-Beresp-Status
X-Sigma
X-Sigma-Backend
X-Slack-Backend
X-Variation
X-Sn-Servicetimems
X-SVT-ORM-RULES
X-S-Maxage
X-Origin
X-Epic-Correlation-Id
X-Esi-Check
X-NCache
X-Origin-Response-Time
X-Ec-Custom-Error
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-Device-Os
X-DPWN-IS-SECURE
X-Fastly-Backend
X-Loc
X-Gamma-Serve
X-Gateway-Cache-Key
X-Gateway-Cache-Status
X-Gateway-Request-Id
X-GeoIP
X-GeoIP-City
X-Fetched-On
X-Hash
X-Gzip
L
X-DefHash
X-DefElseHash
X-Region-Sid
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-Branch-Name
X-Request-URI
X-Azure-Ref-OriginShield
X-Gateway-Skip-Cache
X-Rocket-Nginx-Serving-Static
X-Rocket-Build-Number
X-ATG-Version
X-Cache-Bucket
X-Cache-Id
X-Proxy-Cache-Info
X-Pool
X-Core-Mission
X-Planisys-CDN-TTL
X-Cluster-Node
X-Ckpd-Fst-Backend
X-Cache-Info
X-Qloud-Router
X-Cdn-Origin
X-Scheme
X-NodeID
Cmstype
Cmsid
Cluster
Datacenter
Decoy-Debug-Key
Fastly-GeoIP-CountryCode
Decoy-Debug-TTL
Decoy-Debug-Status
CloudFront-Viewer-Country
Click-Count-Error
Apple-News-Services-Handled
Adler-Geo
Kp-EeAlive
Apple-News-Services-Host
Apple-News-Services-Request-Url
Click-Count-Action-Start
Candidate-Md5Url
Fastly-SSL
Apple-News-Services-Parsed-Url
Gh-Request-Id
Is-Eu
X-Auto-Login
X-Core-Value
X-Bip
X-BBC-Edge-Cache-Status
X-Udemy-Cache-App-Namespace
We-Hiring
X-Clara-WADP
X-CGP
X-SB
Fastly-SWR
X-Fmm-Version
Mail-Subject
X-WADP-Cache
IsBot
X-SIPLIST1
X-Clientip
X-Policy
X-Optimistic-Header
L5d-Success-Class
X-Eu-Site
X-Mvc-Supplant-Cachable
X-Minions-Version
X-FC-Vary-Parameters
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-Platform-Server
X-Forwarded-Site
X-Csrf-Jwt
X-CacheTTL
X-Datadog-Parent-Id
HA-Ipaddr
X-Scale
Origin-CC
Country-Code
DSUID
Traceparent
X-Var-Ttl
X-VG-TLSProxy
Servername
State
X-Irp-Debug
Canary
NGX
Req-Svc-Chain
Ha-Gx-Prefs
Cache-Host
Fastly-SIE
X-Thanos
Origin-EX
X-Cache-Remote
X-IPS-LoggedIn
X-Tx-Id
CDCHOST
Sever-Int
Ec-Rule-Version
User-Cache-Control
Server-Ext
X-Mvc-Supplant-OutputCached
X-Hnp-Log
X-Tumblr-Pixel-3
HostName
Sid
X-Gen-Mode
Server-Hostname
X-CSRF-Token
X-Block-Status
X-Nf-Request-Id
X-Pass-Why
X-ND-Cache
Memory
X-Up
X-LB-NoCache
Time
X-Tb-Optimization-Total-Bytes-Saved
X-Dispatch
X-B3-SpanId
Request-ID
Pics-Label
X-VC
X-Presslabs-Stats
X-Via-NSCOPI
Ssr
X-GG-Cache-Date
X-Trace-ID
AMP-Access-Control-Allow-Source-Origin
X-WA-Info
Cache-Tv-Group
X-Edge-Pop
My-App
X-ZONE
Fastcgi-Cache-TTL
X-Refresh
X-Cs
X-Lambda-Id
X-Session-Fingerprint
X-Via-Popn
X-Via-Poph
Env
X-Via-Popv
Cache-Hits
X-Newrelic-App-Data
X-Akamai-Transformed
X-Servedbyhost
X-Pod-Name
X-Rebelmouse-Cache-Control
X-Rebelmouse-Surrogate-Control
X-Release
X-Origin-Expires
X-Req
X-Fastly-Cache
Server-ID
X-Generated-In
X-Esi
X-B3-Spanid
SID
GeoIp-Country-Code
X-Wa
X-Zone
X-PX
X-Vc
X-CACHE-AGE
X-LB-ID
CacheControlHeader
X-ID
X-Fpc
True-Client-IP
X-NGINX-Cache
X-EC-Lua
X-Xrds-Location
X-CSRF-TOKEN
X-MCACHE
X-DC
True-Client-Country-4JS
Hostname
X-NWS-UUID-VERIFY
X-CLOUD-TRACE-CONTEXT
X-Op-Id-All
X-Cache-Date
X-TX-ID
X-MSEdge-Features
X-MSEdge-Flight
X-Ig-Push-State
X-Webkit-CSP-Report-Only
X-Buckets
X-Conf
X-Endurance-Cache-Level
X-TH-Server
X-NC
X-VCL-Version
X-CACHE-KEY
X-Microcachable
X-GeoIP-Country-Code
CDN
X-GeoIP-Region-Code
X-TRACE-ID
X-HS-Status
X-Dmc
WWW-Authenticate
X-Srv
X-CS
Resin-Trace
Fastly-Drupal-Html
X-Date
X-Accel-Expires-Debug
X-RAMCache
X-Vcl-Version
X-Varnish-Beresp-TTL
X-RateLimit-Reset
Path
Magicmarker
Tcn
X-Wikidot-Backend
X-Wikidot-Static-Cache
Powered-By
X-Check-Cacheable
X-Old-Content-Length
X-Be
X-FPC
X-Akamai-Pragma-Client-IP
Section-Origin-Responded
Section-Io-Origin-Time-Seconds
True-Client-Ip
Section-Io-Id
X-Vercel-Cache
X-Vercel-Id
Section-Io-Origin-Status
X-Alfa-Service
X-Cache-Ttl
Yjs-Id
X-LiteSpeed-Cache-Control
GeoIP-Country-Code
Pramga
X-Micro-Cache
Proxy-Connection
X-Datacenter
X-Location
X-WA
X-Webstats-RespID
X-Hyper-Cache
X-Contensis-Viewer-Groups
X-Cache-ASPX
X-API-Version
X-Varnish-Authentication
X-Director
X-Mly-Id
Server-Id
X-Via-CDN
FSS-Cache
X-Lb-Id
Lb
X-M-Reqid
X-CF-Lambda-Version
X-CF-Lambda-Fn
X-Geo
X-M-Log
X-DataCenter
X-App
User-Agent
X-Qnm-Cache
X-ServedByHost
ENV
X-Response-By
Tracecode
X-Air-Hostname
X-Edge-POP
X-Dw-Trace-Id
X-Air-Trace-Id
X-Air-Source
X-Cdn-Forward
YJS-ID
HIT
X-Via-PopH
X-Test
X-Via-PopN
Cdn
X-Server-IP
N-Cache
X-Via-PopV
C-Via
X-Client-Ip
X-Akamai-ERPolicy
X-Akamai-ERRuleID
Sm-Log-Id
X-Air-Pt
XServer
X-AIR-PT
X-Service-Response-Time
X-Platform-Cluster
X-Traceid
X-Platform-Processor
Locid
X-TT-LOGID
X-UA
X-Instance-Name
Srvid
X-LI-UUID
X-Platform-Router
Esi-Enabled
X-Platform
Location
X-From
X-Li-Fabric
X-FL-EDGE
X-Li-Pop
X-LI-Proto
X-Cache-Expires
X-TrackingId
X-LiteSpeed-Tag
X-Cache-Backend
Swift-Performance
Dnion-Transfer-Encoding
M-TraceId
X-HA-Backend
Geoip-Latitude
X-Cc-Via
X-DSS
X-DI
X-Fastly-Backend-Reqs
X-DB
NtCoent-Length
Hit
Uri
X-We-Are-Hiring
Fastcgi-X-Cache-Version
X-RSL
X-RPM
X-RPS
X-DW
On-Server
PICS-Label
X-PAYTM-SRV-ID
Nginx-CQVIP
CountryCode
Ohc-File-Size
X-Wp-Cf-Super-Cache
X-Wp-Cf-Super-Cache-Cache-Control
XM
X-CUA
X-HostName
Vha6-Origin
X-PERF
X-Cache-Proxy
X-Slack-Shared-Secret-Outcome
X-Fastly-Country-Code
X-Request-Url
X-Fastly-Cache-Hits
Wpo-Cache-Message
X-Cdn-Request-ID
X-CF-Powered-By
Wpo-Cache-Status
X-Lb-Nocache
X-Conten-Type-Options
X-B3-ParentSpanId
X-ApacheServer
Warning
X-Ips-Loggedin
Wp-Super-Cache
X-Edge-Origin-Shield-Region
X-Litespeed-Cache-Control
X-Edge-Origin-Shield-Bytes
X-Cache-Ngx
X-MTS-Cache
X-Ittl
X-N-OperationId
X-Nerd
X-Matome-Cached
X-Matched-Rule
X-Newegg-Flow
X-Keep
X-LbNode
X-OVcl-Cache
X-Kebab
X-Loadbalancer
X-Kebabable
X-NS-Authorization
X-Okws-Version
X-Odoo-Frontend
X-Onedio-Env
X-Origin-Ops
X-OVcl
X-Nyt-Data-Last-Modified
X-NXG
X-NFL-Dma
X-NFL-Geo
X-Is-SSL
X-Ntj-Investigation-Id
X-Newegg-Index
X-GG-Cache-Status
X-ETag
X-Doge
X-Eventloop-Lag
X-Delivery
X-DT-Node
X-Eid
X-Ee-Request-Id
X-Ee-Generated-By
X-Developed-By
X-Ee-Origin
X-Ee-Request-Date
X-F-Status
X-Farm
X-GoCache-CacheStatus
X-Global-Transaction-ID
X-Group
X-Header-Sub
X-IBD-Cache
X-Git-Commit
X-Edge-IP
X-Fastly-Is-Edge
X-Frame-Option
X-Fstrz
X-Full-Ttl
X-IBD-SID
X-YSpaceId
X-Vary-Devices
X-V2-Infrastructure
X-Ver
X-Wag-Acs
X-Waitingroom
X-Utime
X-User-Auth
X-Tried-To-Kebabify
X-Toujours-Debout-Location
X-True-Client-Ip
X-U-Cache
X-Upstream-State
X-Web-Hosting
X-WP-Bypass
X-Info
X-B3-Parentspanid
PFcat
X-HN
X-VarnishDD-TTL
Timeexpire
XV-H
X-WSR2
X-Xms-Page-Cache-Actions
X-Dehri-Date
XV-Cache
X-Toujours-Debout-Branch
X-Timestamp
X-Render-Time
X-Render-Method
X-Request-Origin
X-Route
X-Route-Akamai
X-Redis
X-Reboot
X-PG-ACCESS
X-Paywall
X-PGF-Deflate
X-Pver
X-R-Cache
X-Ruby
X-Save-Cache
X-Stack-Name
X-SSLProxy
X-SVR-IIS
X-Svr-Proxy
X-Test-Nginx-Ingress
X-Square
X-SMP-JWT
X-Server-L
X-ServiceName
X-Sh
X-Site
X-PageType
Store-Cloud-Cache
NB-ESI
Joe-X
Nikkei-App-Version
NLCacheNote
Npm-Cost
Is-Https
HTTPProtocol
Deeplink
CMS-200
Ec-Policy-Id
H1
HServer
Npm-Remaining
Ns
Region
RawURL
Request-Uuid
Rt-Proxy-Cache
Scheme
Proxy-Cache
Panzer-Cache-Control
Ok-Cache-Status
Ns-Ua
OK-Edge-Date
Ok-Edge-Key
Origin-Site
Cluster-Host
Cf-Wrk
DynaTrace
SRV
WZWS-RAY
X-Mg-Cache
GeoIP-Latitude
Fastcgi-Cache-Ttl
Req-ID
X-Request-Start
X-Vtex-Processado-Em
X-Node-Id
X-Moov-Xdn-Version
X-Moov-T
X-ElasticPress-Query
X-Yottaa-OS
Cachekey
Cache-Stat
Cdn-Country-Code
Cf-Device-Type
Cf-Locale
Akamai-X-Url
X-Th-Server
X-IN-APIGATEWAY
CF-Cached-On
X-IN-APIGATEWAYSSL
Cneonction
X-Serial
Selected-Route
Served
X-Backside-Transport
X-Backend-TTL
X-BeanStalkRole
X-BeanStalkStage
X-Cache-Cookie
X-AspNetWebPages-Version
X-ASF-Cache
X-Apache-Server
X-Amz-Meta-Cb-Modifiedtime
X-Ar-Stats
X-Arena-Request-Id
X-ARRRG1
X-Cache-IsMobileDevice
X-Cache-Length
X-Cms-Device
X-Cf-Node-Idx
X-Coindesk-Cache
X-Colour
X-Container-Uri
X-CDN-Pop-IP
X-CDN-Pop
X-Cache-Reason
X-Cache-NPR
X-Cache-ReqUri
X-Cache-Response
X-CacheVersion
X-Akamai-Native
X-Akamai-DeviceType
Time-Cloud-Cache
Technodrome
Ttl
TWC-AK-Req-ID
TWC-PATH-LOCALE
T-Request-Id
Sw
SFRVia
Service-Uuid
Shieldsquare-Response
SII
X-Vtex-Remote-Cache
TWC-Subs
TWC-Unit
X-Accor-Asset
X-Accepted-Language
X-AEO-Platform
X-Akamai-CacheKeyMod
X-Akamai-DeviceOS
X-Accepted-Fulllang
X-Accel-Version
Userver
Uniqueid
Vttl
X-77-NZT
X-77-NZT-Ray
X-Dcm-Pdtf