Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
CF-RAY
Accept-Ranges
Expect-CT
X-XSS-Protection
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Xss-Protection
X-Cache-Hits
P3P
X-Served-By
X-UA-Compatible
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Request-Id
X-Varnish
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
Access-Control-Allow-Credentials
Accept-CH
X-AspNet-Version
Content-Security-Policy-Report-Only
X-Runtime
Accept-CH-Lifetime
X-DNS-Prefetch-Control
X-Ua-Compatible
X-Drupal-Cache
X-Check
X-Cache-Status
X-Generator
Server-Timing
X-Cacheable
X-Request-ID
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Iinfo
X-Drupal-Dynamic-Cache
X-Content-Security-Policy
Access-Control-Expose-Headers
Feature-Policy
X-CDN
Content-Encoding
Status
X-AspNetMvc-Version
Upgrade
Access-Control-Max-Age
CF-Ray
X-Via
X-Amz-Request-Id
X-Amz-Id-2
Cf-Edge-Cache
Host-Header
EagleId
Keep-Alive
Request-Context
X-Backend
X-UA-Device
X-Cache-Group
X-AH-Environment
X-Robots-Tag
X-Server
X-Hacker
X-Turbo-Charged-By
X-Proxy-Cache
X-Ws-Request-Id
Xkey
X-Rq
Permissions-Policy
X-Age
X-Vhost
X-Amz-Version-Id
Allow
X-Dispatcher
Cf-Apo-Via
X-Dns-Prefetch-Control
X-Swift-CacheTime
X-Swift-SaveTime
X-Server-Powered-By
Grace
Ali-Swift-Global-Savetime
X-Varnish-Cache
X-LiteSpeed-Cache
P3p
X-Page-Speed
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Cache-Lookup
X-Device
X-OneAgent-JS-Injection
Cf-Railgun
X-Backend-Server
EagleEye-TraceId
X-Server-Id
X-Host
X-WebKit-CSP
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Response-Time
X-Readtime
X-Akam-SW-Version
Surrogate-Control
X-HW
Request-Id
X-Cloud-Trace-Context
X-Ruxit-JS-Agent
Content-Location
X-Application-Context
X-Node
X-Litespeed-Cache
X-Nginx-Cache-Status
X-Nginx-Upstream-Cache-Status
X-CST
X-NWS-LOG-UUID
X-Country
Service-Worker-Allowed
X-Country-Code
X-Content-Type
X-Url
X-Clacks-Overhead
Cache-Tag
X-Trace
Rating
X-Rack-Cache
X-Oneagent-Js-Injection
X-Amz-Server-Side-Encryption
Nginx-Cache
X-Server-Name
X-Times
X-FTR-Request-ID
X-PC
X-Vname
X-TtlSet
X-Daa-Tunnel
Cross-Origin-Opener-Policy
X-Mcache
X-Edge
X-Midtier
X-Browser-Type
X-Webkit-Csp
X-Powered-By-Plesk
X-ESI
X-Cnection
X-ECACHE
X-Upstream
X-MS-InvokeApp
Edge-Control
X-GitHub-Request-Id
X-D2id
X-Element-Page-Cache
Verso
X-Ac
X-Kinja-Server
X-Kinja-Revision
X-Kinja
X-Cdn-Fetch
X-Exp-Id
X-Exp-Variant
X-GoogleNews-Bot
X-Kinja-Build
AR-PoweredBy
AR-SID
AR-Request-ID
AR-ATIME
X-FastCGI-Cache
X-Aws-Lambda-Call-Status
X-Ser
X-Vcap-Request-Id
Accept-Ch-Lifetime
X-Cache-TTL
X-Navigation-Version
X-Abt-Application-Version
X-Mod-Pagespeed
AR-CACHE
SPIisLatency
SPRequestDuration
X-Dw-Request-Base-Id
X-B3-TraceId
SPRequestGuid
X-SharePointHealthScore
X-Ruxit-Js-Agent
Fastly-Restarts
X-NF-Request-ID
X-Amz-Rid
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Instrumentation
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Middleton-Display
X-Sol
Display
Pagespeed
X-Client-IP
Edge-Cache-Tag
X-Mg-S
S
X-Kinsta-Cache
X-Edge-Location-Klb
X-Powered-CMS
X-Middleton-Response
Response
X-Amzn-Trace-Id
Cache-Status
X-Cache-Key
Access-Control-Request-Method
X-Version
X-Goog-Hash
X-VARITI-CCR
X-RateLimit-Remaining
X-Fastly-Request-ID
X-ARC
RTSS
X-Content-Digest
X-TraceId
X-Forwarded-For
Cross-Origin-Resource-Policy
X-Recruiting
X-T
Realpath
X-Correlation-Id
X-Ratelimit-Limit
X-MSEdge-Ref
X-Varnish-TTL
Front-End-Https
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
MS-Author-Via
Fastcgi-Cache
X-Cached
Content-MD5
X-HS-Content-Id
X-HS-Cache-Config
X-Ttl
X-HS-Hub-Id
X-PDP-UNCACHING-HASH
X-Ua-Browser
X-FTR-Balancer
X-FTR-Backend-Server
X-FTR-Backend
X-Country-Code-Real
Server-Node
Payment
X-FTR-Cache-Status
X-Request-Received
X-Shield-Request-Id
MicrosoftSharePointTeamServices
X-Protected-By
Public-Key-Pins
X-Request-Processing-Time
X-Forwarded-Proto
Arr-Disable-Session-Affinity
X-HS-Combine-CSS
X-SRCache-Store-Status
TP-Cache
X-Frontend
X-SRCache-Fetch-Status
X-LLID
X-Distributor
X-Accel-Expires
X-FTR-Expires
X-HP-Webp
X-Ratelimit-Remaining
X-Jurisdiction
X-HP-Trace-Id
X-Kong-Proxy-Latency
X-Origin-Cache-Key
X-Kong-Upstream-Latency
X-TTL
Count-Hit
X-Server-ID
X-Origin-Server
X-LB-Cache
X-NODE
X-ORACLE-DMS-RID
X-Ezoic-Cdn
X-Hits
X-GUploader-UploadID
X-Request-Handler-Origin-Region
X-Microsite
X-Content-Security-Policy-Report-Only
X-PressLabs-Stats
X-AppVersion
X-Az
X-Activity-Id
Host
X-Www-Served-By
X-Varnish-Backend
Mrf-Cache-Status
MRF-Tech
X-Cluster-Name
X-B3-TraceId-Primal
X-Varnish-Server
Cache-Tags
Retry-After
X-App-Server
Accept-Charset
X-Amz-Meta-S3cmd-Attrs
X-TEC-API-ROOT
X-TEC-API-VERSION
X-Ua-Device
X-TEC-API-ORIGIN
Server-Name
X-Hostname
X-Webkit-CSP
X-Geo-Country
Cleartype
X-NGENIX-Cache
X-Newrelic-App-Data
X-Id
X-Envoy-Decorator-Operation
X-Goog-Metageneration
Referer-Policy
X-DIS-Request-ID
X-Oracle-Dms-Ecid
TP-L2-Cache
X-Upgrade-Enabled
X-Seen-By
X-CSRF-Token
Access-Control-Allow-Method
X-Azure-Ref
TCN
X-Git-Hash
X-Hcs-Proxy-Type
X-CCDN-Origin-Time
X-F-Cache
X-Load-Cache
X-Amzn-RequestId
X-Amz-Apigw-Id
X-CCDN-CacheTTL
X-Tt-Trace-Host
X-Tt-Trace-Tag
X-Unique-Id
X-Proxy
Filterid
Healthy
X-Revision
X-RateLimit-Limit
X-Grace
X-Request-Guid
X-Trace-Id
X-Cache-Control
Section-Io-Cache
X-Debug-Info
X-Px
X-TT
X-FB-Debug
DC
X-B
X-B3-Sampled
Paypal-Debug-Id
X-Fb-Rlafr
X-Type
X-Contextid
X-Page-Id
X-ORACLE-DMS-ECID
X-Varnish-Ttl
X-Logged-In
X-N
X-Mobile
X-Oracle-Dms-Rid
Viewport
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-Debug
X-Whom
X-Language
X-Template
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Goog-Storage-Class
X-XRDS-LOCATION
X-Goog-Stored-Content-Length
Charset
Fastly-SIE
X-Datadog-Trace-Id
Fastly-SWR
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-Content-Options
X-Cache-Grace
Version
X-Time
Content-Disposition
X-Via-JSL
X-Magnolia-Registration
X-Wix-Request-Id
X-Varnish-Grace
X-EdgeConnect-Cache-Status
X-B-Cache
X-Signature
X-App-Environment
X-RateLimit-Reset
X-Node-Name
X-Rid
X-Origin-Cache
X-ProcessESI
VIX-Pulpo-Node
X-RemovedCookies
SRV
VIX-Pulpo-Upstream-Status
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-User
X-Rule
X-Yottaa-Optimizations
X-Debug-IsPreview
X-Yottaa-Metrics
X-Debug-IsConnected
X-Datadog-Sampled
X-Amz-Replication-Status
X-G
Ms-Operation-Id
SD-X-WS
X-RTag
X-UUID
X-Hl-Ver
X-Amzn-Remapped-Content-Length
MS-CV
X-Backend-Name
X-FW-Server
X-FW-Dynamic
X-FW-Hash
X-Device-Type
X-Adobe-Content
X-Storage
X-Adobe-Loc
X-FW-Serve
X-Proxy-Cache-Info
X-FW-Version
GEO-INFO
X-FW-Type
ServerID
X-FW-Static
X-Instance
NGB
X-NYM-Debug-Backend
Liferay-Portal
X-Cacheable-TTL
X-B3-SpanId
Country
X-Is-Bot
X-Rendered-As
X-Environment-Context
X-Region
X-Status
X-Cache-Hit
X-User-Agent
X-IPS-LoggedIn
X-L-Path
X-Real-IP
X-Source
X-Cache-Age
Surrogate-Key
Countrycode
X-ServerID
X-NWS-UUID-VERIFY
Amp-Access-Control-Allow-Source-Origin
Akamai-GRN
X-Sucuri-ID
X-Servername
X-Sucuri-Cache
X-WP-CF-Super-Cache-Active
OT-Force-Account-Verify
Cross-Origin-Window-Policy
From-Origin
X-VC-Cache
X-UA
X-WebKit-CSP-Report-Only
X-Xrds-Location
X-RM-Cache-TTL
Upgrade-Insecure-Requests
Front
Backend
X-INCAP-ABP
X-Framework
X-Air-Pt
X-Mode
Refresh
X-AB
X-Air-Hostname
X-Content-Powered-By
X-Cache-Time
X-Air-Trace-Id
Frame-Options
X-DataDome
X-Air-Source
X-HTML-Minification-Powered-By
Xet-Cookie
X-Akamai-Request-ID2
X-Nginx-Cache
X-Handled-By
X-Wormhole-Sdk
X-Edge-Location
Url
X-Buckets
X-B3-Traceid
X-Vcache
X-Endurance-Cache-Level
Filters
X-UPSTREAM-Address
X-Rewrite-Enabled
X-Webstats-RespID
X-Reqid
X-No-Session
X-RCS-CacheZone
Access-Control-Request-Headers
X-SaId
X-Timing-Wait
Webserver
X-Cluster
X-Rn-Rsrv
Meta-Geo
X-Proxy-Build
X-Origin-Date
Selected-Fe
X-Xfnlog-Site
X-JoinUs
X-Akamai-Edgescape
X-Cache-Rule
X-AWS-Id
X-VWS-Id
Webcakes-Region
Webcakes-App-Version
X-VCT
X-Logging-Id
X-Cache-Operation
Webcakes-App-Name
Property-Id
X-Origin-Hint
X-Azure-Ref-OriginShield
X-Drupal-Cache-Tags
X-LJ-Flow-ID
X-Provided-By
X-Git-Commit
X-Origin-CC
X-Origin-TTL
Atl-Traceid
X-R9-Blue-Green-Version
X-Served-From
X-Container-Uri
ServedBy
TWC-GeoIP-LatLong
TWC-Locale-Group
TWC-Privacy
TWC-GeoIP-Country
TWC-Device-Class
X-Origin
WPO-Cache-Status
WPO-Cache-Message
TWC-Connection-Speed
X-Tumblr-Pixel-2
X-Extlb
Thinkindot-CacheControl
TDXMobile
Section-Io-Id
Thinkindot-CacheControl-Type
Thinkindot-Control
X-Adobe-Source
X-Accel-Version
Web-Mar-Node
X-BYPASS-REASON
X-Cache-Debug
X-Fetched-On
X-Generation-Time
X-Httpd
X-Drupal-Cache-Contexts
X-CMSURLCustom
Mn-Server-Ip
X-Cloudmap
X-Cms-Context
Cache
X-Restarts
X-Proxied
X-ProxyCache-Key
X-PHP-Host
X-Thinkindot-L3
X-Ms-Version
X-ProxyCache-Status
X-Redis-Cache
X-Routing-Service
X-Scope-Id
X-Shield-Cache-Expires
X-Site-Version
X-Ms-Request-Id
X-CDN-Forward
X-Cache-Status-Check
X-Locale
X-Varnish-Cache-Hits
X-VC
X-Labrador-Cache-Channel
X-Web-Node
X-Zipkin-Id
X-Director
X-Say-Cacheable
X-Say-TTL
X-Is-Mobile
X-Upstream-Ht
X-Soup
X-Format
X-Tcp-Rtt
X-Upstream-Ct
X-Tb
X-Browser-Name
X-Tncms
X-Skip-Cache
X-SayCDN-TTL
Apigw-Requestid
X-Forwarded-Host
X-Is-Desktop
Accept-Language
X-Hosted-By
X-Varnish-Age
X-Loop
X-Lambda-Id
X-Frame-Option
X-Geo-Region
X-Is-Supported-Browser
X-S
X-Is-Tablet
X-Alternate-Cache-Key
X-IPLB-Request-ID
Xserver
X-SRV
Cache-Hits
X-Varnish-Beresp-Grace
X-IPLB-Instance
X-Shopify-Stage
X-Cdn-Origin
X-ShopId
X-ShardId
X-GeoCode
X-Detected-As
X-Cache-Host
X-GeoCountry
X-Sorting-Hat-PodId
X-Storefront-Renderer-Rendered
X-Sorting-Hat-ShopId
X-Generated-By
X-Erf-Stays-Pdp-Viaduct-Migration-Web-V2
X-RID
X-Rocket-Nginx-Serving-Static
X-Optimistic-Header
X-Worker
X-Vercel-Cache
X-Vercel-Id
Source
Azure-Version
X-XRDS-Location
Azure-RegionName
Azure-InstanceId
Azure-SlotName
Azure-SiteName
LB
Node
X-Lagoon
X-WP-CF-Super-Cache-Cookies-Bypass
X-Request-URI
X-Tec-Api-Root
CDN-EdgeStorageId
CDN-Cache
X-App-Version
X-Tec-Api-Origin
X-Tec-Api-Version
CDN-PullZone
CDN-CachedAt
Fastcgi-Useragent
CDN-Uid
Protected
CDN-RequestPullCode
CDN-RequestPullSuccess
CDN-RequestCountryCode
X-Pass-Why
Cross-Origin-Embedder-Policy
X-Ratelimit-Reset
CDN-RequestId
X-Connection-Hash
X-Tumblr-Pixel-3
X-URL
X-GEO
Expiry
Alternate-Protocol
X-Vcl-Version
Onion-Location
X-Cache-Expired-At
X-Cache-Server
X-Jobs
DB-Nickname
X-Server-W
Priority
AMP-Access-Control-Allow-Source-Origin
X-TA-CDN-Provider
CF-IPCountry
Environment
X-Api-Version
X-PHP-Backend
Sid
Uber-Trace-Id
X-DC
X-Proxy-Cache-Status
X-Fastly-Request-Id
X-LSADC-Cache
X-Cluster-Node
X-Cache-Action
X-Urbn-Site-Id
X-Fastcgi-Cache
X-Response-Served-From
X-Urbn-Context-Path
X-MP-GENERATED-AT
Locale
User-Cache-Control
X-Uri
X-Original-Request-Id
X-Tx-Id
X-Mg-Request-UUID
HostName
X-TT-LOGID
X-FB-TRIP-ID
X-Ig-Origin-Region
Content-Secure-Policy
X-Ec-Fail
DCR-Processing-Time-Ms
DCR-Decision-By
X-Jungle-Id
X-Gen-Mode
A
X-Generated-On
X-GeoIP-City
X-Dispatcher-Server
X-Forwarded-Site
X-FC-Vary-Parameters
X-Epic-Correlation-Id
Candidate-Md5Url
Cache-Tv-Group
X-Ec-GeoHdr
MD5-Digest
Server-Host
Sslversion
Surrogated-Key
T-Server
X-Bc-Bl
X-BCube-Filmed-By
Req-ID
X-Block-Status
X-Bl-Debug
X-Bip
X-Aed
Vix-Hermes-Req-Id
X-A-Dam
X-A-Dcw
X-A-Dgt
X-A-Wwc
X-A-Ccd
X-A
Wxu-Next-Commit
Wxu-Next-Hostname
Wxu-Next-Region
Rendered-Blocks
X-Cache-NE
Fusion-Deployment-Id
Fusion-Source
Fusion-Template-Id
Gannett-Cam-Experience-Id
Fusion-Content-Source
Fusion-Content-Id
X-Device-Os
X-Developer
Fusion-Component-Id
X-D
X-Content-Age
X-Clientip
Ngx.Var.Host
Origin
Origin-Agent-Cluster
X-Conf
Meta-Geo-Continent
Lang
Magicmarker
X-Level-Front-Cache
Edge-Cache
X-Hnp-Log
X-Org
X-Nf-Request-Id
X-Origin-Expires
X-Varnish-Hostname
X-TIM-N
X-Request-Start
X-Vtex-Remote-Cache
X-SRCache-Key
X-VTEX-Cache-Server
X-Proto
X-UA-Device-Type
Cdn-Requestid
X-Powered-By-VTEX-Cache
X-Thanos
X-Tt-Logid
X-Platform
X-Node-Id
X-Op-Id-All
X-Varnish-Beresp-Ttl
X-NCache
X-ScT
X-Viewer-Country
X-Mvc-Supplant-Cachable
X-Vdms-Path
X-SB
X-Rojux
X-Vdms-Version
X-ND-Cache
X-VTEX-Cache-Time
X-Origin-Response-Time
WP-Super-Cache
X-Core-Value
Ha-Gx-Prefs
HA-Ipaddr
X-CUA
X-Csrf-Jwt
Host-ID
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-AK-Request-ID
Fastly-SSL
X-Amz-Storage-Class
Fastly-Backend-Name
X-App-Name
X-Via-Fastly
X-Test
X-Auto-Login
X-Varnishpool
X-Cache-Info
PFcat
Origin-EX
Origin-CC
Powered-By
X-Cache-Id
Release
X-WA-Info
X-Backend-Instance
X-Cache-Bucket
X-VarnishDD-TTL
X-Cache-TTL-Remaining
X-LiteSpeed-Cache-Control
X-Var-Ttl
X-V-Cache
Mail-Subject
X-Auth-Group-Type
X-SD-PageType
X-CGP
X-VG-WebCache
NM-Fastcgi-Cache
X-Varnish-Director
X-Cdn-Srv
L5d-Success-Class
We-Hiring
X-Service
X-Client-Ip
X-GeoIP-Country-Code
X-Nyt-Route
X-GeoIP-Region-Code
X-Origin-Time
X-PAYTM-SRV-ID
X-Gdpr
Yak-Timeinfo
X-Geo-Header
X-GeoIP
X-Policy
X-NMSegId
X-Mvc-Supplant-OutputCached
X-Loc
Ssr
Sever-Int
Server-Hostname
X-HS-Content-Campaign-Id
X-Gzip
X-Nginx-Cache-Key
X-HN
X-Pubstack
AKAMAI
XM
X-Esi-Check
X-Edge-Server
X-Eu-Site
Cdnsip
Cdncip
X-Req
Content-Script-Type
DSUID
X-Request-Time
W
Content-Style-Type
Cdn-Request-Time
Cdn-Host
C-Via
X-Fastly-Cache
X-RateLimit-Limit-Second
X-Fmm-Version
Server-Ext
Cache-Provider
CDCHOST
X-Region-Sid
Canary
X-RateLimit-Remaining-Second
X-Scheme
X-Wikidot-Backend
X-Varnish-Beresp-Status
X-Ig-Push-State
X-Acquia-Purge-Cdn-Unconfigured
Gh-Request-Id
X-Wikidot-Static-Cache
X-ApacheServer
X-We-Are-Hiring
X-Ad-Load-Variation
X-B3-Trace-ID
X-Sn-Servicetimems
X-From
X-Pool
X-Fastly-Backend
X-Render-Time
X-Request-Host
X-PERF
X-GoCache-CacheStatus
X-Location
X-Men
X-Mly-Id
X-Human
X-Access
X-Ec-Custom-Error
X-DPWN-IS-SECURE
X-CacheTTL
X-Varnish-Authentication
X-Cache-Backend
X-Cache-Aspx
X-VG-TLSProxy
X-Contensis-Viewer-Groups
X-SVT-ORM-VERSION
X-Section
X-Server-IP
X-Micro-Cache
X-SVT-ORM-RULES
X-BBC-Edge-Cache-Status
X-Aicache-OS
Cluster
Redirect-Candidate
Country-Code
Click-Count-Error
RNT-Machine
Click-Count-Action-Start
RNT-Time
Producers
Pramga
Is-Eu
Adler-Geo
L
X-ECache
Esi-Enabled
Platform
On-Server
True-Client-Country-4JS
Req-Svc-Chain
Apple-News-Services-Parsed-Url
Tube-Return
X-ID
X-Zone
Apple-News-Services-Handled
Web-Mar-Region
V-Age
Tube-Got-Results
Apple-News-Services-Host
X-Ismobilevalue
Cache-Key
Apple-News-Services-Request-Url
Tube-Got-Eval
Tube-Get-Contents
X-Newrelic-Synthetics
NGX
X-Hash
Machine
X-Up
X-Tb-Optimization-Total-Bytes-Saved
X-Proxied-Request
X-Date
Odigeo-Trace-Id
X-Slack-Shared-Secret-Outcome
X-Accel-Expires-Debug
Fastly-GeoIP-CountryCode
X-Slack-Backend
X-AIR-PT
X-NGINX-Cache
X-LB-ID
X-NodeID
X-Custom-Header
X-Varnish-Hits
Proxy-Firewall
Fastly-Drupal-HTML
X-Cs
Datacenter
X-COUNTRY
X-Nananana
Debug
X-Dc
SID
X-Pad
X-DefHash
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
Locid
X-Via-Popv
X-Varnish-Remaining-TTL
X-DefElseHash
X-Refresh
X-HA-Backend
Pics-Label
CloudFront-Viewer-Country
X-Via-Poph
X-Via-Popn
X-CACHE-GROUP
X-Platform-Processor
X-Depends
X-Amz-Meta-Cb-Modifiedtime
X-Servedbyhost
X-Akamai-Transformed
X-Platform-Router
X-Platform-Cluster
Mime-Version
X-LiteSpeed-Tag
X-VHOST
X-VC-TTL
X-CACHE-AGE
GeoIP-Latitude
X-TIME
X-Datadome
X-Old-Content-Length
Ngx-Var-Key
X-LB-NoCache
X-Cached-By
X-M-Log
X-Parent-Response-Time
X-Cache-FS-Status
X-M-Reqid
X-B3-Parentspanid
X-Moov-T
X-TH-Server
X-CS
X-Moov-Xdn-Version
Server-ID
X-DynaTrace-JS-Agent
Cross-Origin-Embedder-Policy-Report-Only
Cdn
X-Nc
X-CDN-Cache-Status
Server-Info
Resin-Trace
X-Wa
Fastly-Drupal-Html
Cf-Ipcountry
GeoIp-Country-Code
NtCoent-Length
BehaviorPad-Version
X-Litespeed-Tag
X-ZONE
X-Presslabs-Stats
Cf-Device-Type
X-S-Cookie
X-External-Request-Id
X-User
X-HITS
X-Vgn-Hpd-Reason
X-B-Cookie
X-Application
X-Destination
X-VCache
X-Fpc
X-IAuth-Set-Uid
X-APP
Uri
X-NewRelic-App-Data
X-Zen-Fury
FSS-Cache
X-Vc
X-Srv
X-Providence-Cookie
X-Flags
X-Route-Name
X-Aspnet-Duration-Ms
X-Is-Crawler
X-Esi
X-Sigma
True-Client-IP
X-Rocket-Build-Number
X-Content-Length
X-Sigma-Backend
X-Cache-Date
X-Instance-Name
True-Client-Ip
X-TX-ID
X-HostName
CDN
X-Dynatrace-Js-Agent
X-API-Version
X-VServer
Serverhost
X-Varnish-Beresp-TTL
X-DynaTrace
Tcn
Load-Balancing
GeoIP-Country-Code
S-Rt
X-Segment-20210421
X-Branch-Name
X-Oracle-DMS-ECID
X-Page-View
X-Dispatcher-Number
X-Cdn-Cache-Status
X-HOST
X-Cdn-Forward
Hostname
X-B3-Spanid
Srv
Vc-Max-Age
Ohc-File-Size
Request-ID
Product
X-DataCenter
X-RequestId
X-FPC
X-NC
X-Dispatch
X-WA
Type
X-Http-Reason
X-APP-VERSION
X-Sql-Count
ServerName
X-Sql-Duration-Ms
Geoip-Latitude
Srvid
X-Webkit-Csp-Report-Only
X-FL-QIT-DEBUG
Server-Id
X-Irp-Debug
X-VCL-Version
Cl-Cache
X-Geo
X-Lb-Nocache
X-Bug-Bounty
X-Ckpd-Fst-Backend
Edge-Copy-Time
X-CSRF-TOKEN
WZWS-RAY
X-Owner
X-ServedByHost
IsBot
X-Via-SSL
X-Via-Edge
CacheControlHeader
DataCenter
X-SIPLIST1
X-Via-CDN
X-Proxy-CacheRZ
Cloudfront-Viewer-Country
X-App
Epwk-X-Cache
MIME-Version
Cross-Origin-Opener-Policy-Report-Only
X-Core-Mission
Ohc-Cache-HIT
Origin-Trial
XkeyRZ
X-CACHE-KEY
X-Cache-Ttl
X-Hit
CountryCode
X-Correlation-ID
N-Cache
X-Ha-Backend
X-Qloud-Router
X-Ua
X-Via-PopH
PICS-Label
X-Via-PopN
X-Via-PopV
Rtss
X-Srcache-Fetch-Status
X-Srcache-Store-Status
X-Guploader-Uploadid
X-Amz-Meta-Opti
X-Lb-Id
X-MiniProfiler-Ids
X-MSEdge-Features
X-MSEdge-Flight
X-Fastly-Country-Code
ServerHost
X-LAGOON
Lb
X-Akamai-Device-Characteristics
X-Limited
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Web-Server
Warning
X-Sqd-Ctime
X-Service-Response-Time
Sm-Log-Id
X-Sqd-Stime
Cneonction
User-Agent
X-Acquia-Purge-Tags
X-Acquia-Site
X-Vmg-Version
X-Datacenter
X-Iplb-Instance
X-Litespeed-Cache-Control
X-Iplb-Request-Id
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
X-Dw-Trace-Id
X-Gamma-Serve
X-Amz-Meta-Sha256
X-Amz-Meta-S3b-Last-Modified
X-Udemy-Cache-App-Namespace
X-CF-Lambda-Fn
Expect-Staple
X-Proxy-Cache-La3
Xkey-La3
Xkeylog
X-Shop-Environment
X-Orig-Expires
X-Forwarded-Path
X-Cache-Type
X-Tenant
X-Cdn-Request-ID
Akamai-Cache-Status
X-Serial
X-Th-Server
X-Ramcache
X-Snapshot-Date
X-Check-Cacheable
X-RAMCache
X-CF-Lambda-Version
X-Requestid
X-Akamai-Pragma-Client-IP
Ngx