Threat Level: green Handler on Duty: Russ McRee

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
Accept-Ranges
Link
ETag
Pragma
Expect-CT
X-Powered-By
X-XSS-Protection
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
P3P
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Timer
X-Download-Options
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Adblock-Key
X-Runtime
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Check
X-Request-ID
X-Cache-Status
P3p
X-Generator
X-Cacheable
Timing-Allow-Origin
X-DNS-Prefetch-Control
X-Content-Security-Policy
X-Iinfo
X-Ua-Compatible
Status
Feature-Policy
Content-Encoding
X-AspNetMvc-Version
X-CDN
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
Upgrade
X-Dns-Prefetch-Control
Access-Control-Max-Age
X-Drupal-Dynamic-Cache
X-Via
Keep-Alive
X-Ws-Request-Id
Request-Context
Server-Timing
X-Robots-Tag
X-AH-Environment
X-Hacker
X-Server
X-Age
X-Turbo-Charged-By
X-Proxy-Cache
X-Cache-Group
X-Server-Powered-By
X-Backend
X-Amz-Request-Id
Host-Header
X-Amz-Id-2
EagleId
X-Nginx-Cache-Status
Report-To
X-LiteSpeed-Cache
X-Rq
X-Varnish-Cache
X-UA-Device
Grace
X-Page-Speed
X-Pingback
X-Swift-CacheTime
X-Swift-SaveTime
EagleEye-TraceId
Ali-Swift-Global-Savetime
X-Device
X-Vhost
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Amz-Version-Id
NEL
X-Dispatcher
X-OneAgent-JS-Injection
Cf-Railgun
X-Host
X-WebKit-CSP
X-Cache-Spec
X-Server-Id
X-CST
X-Node
X-Backend-Server
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
Allow
Request-Id
Surrogate-Control
X-Readtime
Accept-CH
X-Akam-SW-Version
X-Response-Time
Accept-Ch-Lifetime
Xkey
X-HW
X-Language
X-Template
X-Application-Context
X-Country
X-Ac
X-Ruxit-JS-Agent
Content-Location
X-Cache-Lookup
X-Webkit-CSP
X-Cloud-Trace-Context
Rating
MS-Author-Via
X-Url
Edge-Control
X-Vname
X-TtlSet
X-PC
X-Mod-Pagespeed
X-Clacks-Overhead
X-Varnish-TTL
X-B3-TraceId
X-Trace
Fastly-Restarts
X-Content-Type
X-MS-InvokeApp
X-Rack-Cache
X-Origin-Cache
X-ESI
X-Buckets
X-GitHub-Request-Id
Accept-Ch
X-Cnection
X-Country-Code
X-Goog-Hash
Verso
X-D2id
X-VARITI-CCR
X-Exp-Variant
X-GoogleNews-Bot
X-Kinja-Revision
X-Kinja-Server
X-Cdn-Fetch
X-Use-Magma
X-Kinja-Build
X-Exp-Id
X-Kinja
Arr-Disable-Session-Affinity
X-FastCGI-Cache
X-ORACLE-DMS-ECID
Cache-Tag
X-Vcap-Request-Id
Service-Worker-Allowed
X-Server-Name
X-Cached
X-Abt-Application-Version
X-Amz-Rid
X-Client-IP
X-Server-ID
Accept-CH-Lifetime
X-Navigation-Version
X-Px
RTSS
X-Powered-By-Plesk
X-Cache-TTL
X-Fastly-Request-ID
Public-Key-Pins
X-SRCache-Fetch-Status
X-SRCache-Store-Status
Access-Control-Request-Method
X-Element-Page-Cache
X-MSEdge-Ref
X-Powered-CMS
X-Dw-Request-Base-Id
X-NF-Request-ID
X-Upstream
X-TTL
X-Version
X-Middleton-Display
X-Middleton-Response
X-Sol
Pagespeed
Display
Response
S
X-Edge-Location-Klb
X-Kinsta-Cache
X-Edge
X-LLID
X-Kraken-Loop-Name
X-B3-TraceId-Primal
MRF-Tech
X-Server-Lifecycle-Phase
X-Kraken-Routeconfig-Destination
X-Instrumentation
Mrf-Cache-Status
X-Ttl
X-Cache-Key
X-ECACHE
X-Accel-Expires
Realpath
X-Jurisdiction
X-HP-Webp
X-Shield-Request-Id
X-Correlation-Id
Pinterest-Generated-By
Pinterest-Version
X-Pinterest-Rid
X-T
X-DynaTrace
X-SharePointHealthScore
SPRequestGuid
X-Litespeed-Cache
X-Mid
X-XRDS-Location
X-MCACHE
X-PressLabs-Stats
X-ORACLE-DMS-RID
SPIisLatency
SPRequestDuration
X-Content-Security-Policy-Report-Only
Edge-Cache-Tag
Fastcgi-Cache
X-Mg-S
X-Amz-Server-Side-Encryption
X-Forwarded-Proto
X-Content-Digest
Nginx-Cache
TP-Cache
TP-L2-Cache
X-Recruiting
Charset
X-Oneagent-Js-Injection
Front-End-Https
X-Request-Processing-Time
X-Request-Received
TCN
Alternate-Protocol
Server-Node
X-Ruxit-Js-Agent
X-Id
X-Logged-In
Filters
X-Forwarded-For
Content-MD5
X-Geo-Country
X-Ezoic-Cdn
Fusion-Content-Id
Fusion-Source
Fusion-Deployment-Id
Fusion-Content-Source
Fusion-Template-Id
Fusion-Component-Id
X-Protected-By
X-ASPNET-VERSION
Cache-Tags
X-Hostname
X-Amzn-Trace-Id
X-Origin-Upstream-Status
X-Grace
X-NWS-LOG-UUID
X-Goog-Storage-Class
X-Goog-Metageneration
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-GUploader-UploadID
X-F-Cache
Cleartype
X-Origin-Server
X-Debug-Info
X-Www-Served-By
X-Amz-Replication-Status
X-Rid
X-HS-Cache-Config
X-HS-Content-Id
X-HS-Hub-Id
X-LB-Cache
X-HS-Combine-CSS
Host
X-AppVersion
X-Activity-Id
X-Az
X-Contextid
X-RateLimit-Remaining
X-Daa-Tunnel
X-Ab
X-Release
X-Git-Hash
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
Section-Io-Cache
X-Browser-Type
X-Page-Id
Server-Name
X-Frontend
X-Ser
X-VCache
X-Aspnetmvc-Version
MicrosoftSharePointTeamServices
X-Cache-Age
X-Content-Options
Accept-Charset
X-Upgrade-Enabled
Access-Control-Allow-Method
X-Respond-Thread
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Hits
X-Mobile-URL
ServerID
X-Source
X-DIS-Request-ID
X-Flags
X-CACHE-GROUP
X-Aspnet-Duration-Ms
X-B-Cache
X-Signature
X-Route-Name
X-Request-Guid
X-Providence-Cookie
X-Is-Crawler
X-WebKit-CSP-Report-Only
X-Cache-Action
Viewport
X-Varnish-Age
X-Whom
X-FB-Debug
Healthy
X-Varnish-Backend
X-Varnish-Grace
Payment
Paypal-Debug-Id
X-TT
DynaTrace
X-B3-Sampled
X-App-Environment
X-Fastcgi-Cache
Node
X-AOL-HN
Fastcgi-Useragent
X-Yandex-Sdch-Disable
X-Mobile
X-Load-Cache
Version
X-Seen-By
DC
X-N
X-Tt-Trace-Tag
X-Tt-Trace-Host
Filterid
X-Distributor
X-HTML-Minification-Powered-By
SRV
X-Type
Retry-After
X-Cache-Control
X-User-Agent
Frame-Options
MS-CV
X-Jobs
X-Tec-Api-Origin
X-Tec-Api-Root
X-Tec-Api-Version
Refresh
X-Cache-Expired-At
X-Original-Request-Id
X-XRDS-LOCATION
X-Response-Served-From
X-FW-Static
X-FW-Type
X-UUID
X-FW-Server
X-FW-Serve
X-FW-Hash
X-FW-Dynamic
X-Adobe-Loc
Amp-Access-Control-Allow-Source-Origin
X-Page-View
X-Adobe-Content
X-Proxy-Cache-Status
NGB
X-Debug-IsConnected
X-Region
X-Varnish-Server
X-Debug-IsPreview
X-Instance
X-Real-IP
X-G
X-ProcessESI
X-Proxy
X-Tumblr-Pixel-0
X-RemovedCookies
X-Cacheable-TTL
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-IPLB-Instance
X-Vgn-Hpd-Reason
X-B
X-Tumblr-Pixel
X-NGENIX-Cache
X-Cluster-Name
X-Tumblr-User
X-Tumblr-Pixel-1
X-Content-Powered-By
Access-Control-Request-Headers
X-Azure-Ref
X-Cache-Time
X-CDN-Forward
X-Device-Type
X-Framework
X-Node-Name
X-RTag
Ms-Operation-Id
X-IPS-LoggedIn
X-Zen-Fury
Uber-Trace-Id
X-HP-Trace-Id
X-Cache-Hit
X-Aws-Lambda-Call-Status
X-Cache-Rule
Cache-Status
SD-X-WS
X-Wix-Request-Id
Referer-Policy
X-Is-Bot
Liferay-Portal
X-Rendered-As
X-Ms-Request-Id
X-Ms-Version
X-Drupal-Cache-Tags
X-Time
X-Oracle-Dms-Rid
Section-Origin-Responded
Section-Io-Id
Section-Io-Origin-Status
X-RateLimit-Limit
X-Parallel-Accel
Section-Io-Origin-Time-Seconds
X-Mg-Request-UUID
Countrycode
AR-Request-ID
Ar-Sid
AR-PoweredBy
AR-ATIME
AR-CACHE
X-Request-Handler-Origin-Region
X-Microsite
X-Debug
X-EdgeConnect-Cache-Status
X-Accel-Buffering
S-Cnection
X-L-Path
X-Revision
X-Environment-Context
X-App-Server
Country
CF-IPCountry
X-Nginx-Cache
X-Yottaa-Optimizations
X-Yottaa-Metrics
Cache
X-Cache-Operation
Count-Hit
X-APP-VERSION
X-Drupal-Cache-Contexts
X-GG-Cache-Date
X-TNCMS
X-UPSTREAM-Address
X-FW-Version
X-ES-SERVER
X-JoinUs
X-Loop
X-RN-RSRV
Meta-Geo
Surrogate-Key
X-TA-CDN-Provider
X-SaId
X-Endurance-Cache-Level
X-Cache-TTL-Remaining
Akamai-GRN
X-App-Version
X-LAGOON
From-Origin
X-Cache-Type
X-Say-TTL
X-SayCDN-TTL
X-Say-Cacheable
X-Adobe-Source
X-Human
X-Sql-Duration-Ms
X-Varnish-Beresp-Grace
Azure-SlotName
X-Sql-Count
X-Request-Time
X-S-Maxage
GEO-INFO
Azure-InstanceId
Azure-Version
Azure-RegionName
Protected
Azure-SiteName
Country-Code
X-Xfnlog-Site
X-NYM-Debug-Backend
ServedBy
Decoy-Debug-TTL
X-Alternate-Cache-Key
Apigw-Requestid
Cache-Tv-Group
Cache-Name
X-AWS-Id
X-Be
Decoy-Debug-Key
X-BYPASS-REASON
Decoy-Debug-Status
X-ShardId
X-PCL
X-OCL
X-R9-Blue-Green-Version
X-FireWall-Port
X-ProxyCache-Status
X-Storefront-Renderer-Rendered
X-PHP-Host
Fastly-SSL
X-Varnishpool
X-VWS-Id
X-Varnish-Hostname
Eomportal-Instance
X-Proto
X-Origin-Date
X-ProxyCache-Key
X-RCS-CacheZone
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-No-Session
X-LJ-Flow-ID
X-Pubstack
X-Shopify-Stage
X-Labrador-Cache-Channel
X-Status
X-Handled-By
X-ShopId
X-Hosted-By
Selected-Fe
X-Web-Node
X-Proxy-Build
X-Via-Fastly
X-Redis-Cache
TWC-Connection-Speed
TWC-Device-Class
X-Section
X-Timing-Wait
X-Tumblr-Pixel-2
X-Access
X-Server-W
X-Akamai-Edgescape
X-Hyper-Cache
X-Cache-Server
Webcakes-Region
X-UA-Device-Type
Webcakes-App-Name
TWC-Privacy
TWC-GeoIP-LatLong
X-Uri
X-Format
Webcakes-App-Version
X-Origin-Hint
TWC-GeoIP-Country
TWC-Locale-Group
Property-Id
X-Backend-Host
Nel
X-ApacheServer
X-B3-SpanId
X-PHP-Backend
Mn-Server-Ip
X-PERF
X-Cluster-Node
X-FB-TRIP-ID
X-Time-Microsecs
X-Ua-Device
X-Backend-Name
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-Hl-Ver
X-Servername
X-B3-Traceid
OT-Force-Account-Verify
X-ATG-Version
X-ServerID
Cross-Origin-Opener-Policy
X-Tumblr-Pixel-3
X-Detected-As
X-Cache-PHP
X-Azure-Ref-OriginShield
Web-Mar-Node
X-Cache-Host
X-Content-Age
X-Trace-Id
X-Varnish-Cache-Hits
Backend
Cross-Origin-Window-Policy
X-Generation-Time
X-Ua
X-Datadome
X-Varnish-Hits
X-MP-GENERATED-AT
Content-Secure-Policy
X-TT-LOGID
X-CS
Ec-Rule-Version
X-CSRF-Token
Xserver
X-SRV
X-WA-Info
X-Via-JSL
X-Soup
Source
X-Akamai-Transformed
X-Cdn
X-Edge-Location
X-Cache-Enabled
X-Cache-Grace
X-Mode
X-Microcachable
X-Amzn-RequestId
X-Amzn-Remapped-Content-Length
X-Amz-Apigw-Id
X-Rule
Upgrade-Insecure-Requests
S-Rt
X-Air-Source
X-Air-Hostname
X-Bc-Bl
X-Info
X-NWS-UUID-VERIFY
X-Air-Trace-Id
X-Locale
Url
X-Forwarded-Host
X-Origin-TTL
X-Origin-CC
X-Unique-Id
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
X-Cached-By
SID
X-Site-Version
X-GEO
X-Ratelimit-Limit
X-Magnolia-Registration
X-Tb
Content-Disposition
X-Connection-Hash
X-Conf
X-CF-Lambda-Version
X-Vtex-Remote-Cache
X-CF-Lambda-Fn
X-VG-WebServer
X-NAPM-TraceId
X-A
M-TraceId
Rendered-Blocks
X-Cache-NE
Req-Svc-Chain
X-Zipkin-Id
X-D
X-Cache-Bucket
Apple-News-Services-Host
X-Extlb
X-External-Request-Id
Expiry
DCR-Processing-Time-Ms
DCR-Decision-By
X-Forwarded-Path
X-Debug-Cache
X-Epic-Correlation-Id
Fastcgi-X-Cache-Version
X-Developer
Host-ID
X-Destination
Mobile-Detection-Method
Meta-Geo-Continent
Fastly-SIE
Fastly-SWR
CDN-Uid
CDN-RequestId
Apple-News-Services-Request-Url
BehaviorPad-Version
X-Ftr-Request-Id
Apple-News-Services-Parsed-Url
X-NU-AKA-ACS-Version
Path
Apple-News-Services-Handled
X-From
Odigeo-Trace-Id
CDN-PullZone
CDN-RequestCountryCode
CDN-EdgeStorageId
CDN-CachedAt
CDCHOST
CDN-Cache
A
X-Vtex-Processado-Em
X-Vdms-Version
X-BBC-Edge-Cache-Status
X-Request-URI
T-Server
X-Rewrite-Enabled
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-AIR-PT
X-Ratelimit-Reset
X-SRCache-Key
X-A-Wwc
MD5-Digest
X-Rojux
X-ARC
X-ScT
X-Session-Fingerprint
X-Shop-Environment
X-Application
X-Aicache-OS
X-Aed
X-Routing-Service
X-S
X-S-Cookie
X-B-Cookie
State
Surrogated-Key
X-A-Dam
User-Cache-Control
X-Platform-Server
X-VG-WebCache
X-PBS-Appsvrname
X-PAYTM-SRV-ID
X-Orig-Expires
X-BCube-Filmed-By
X-A-Ccd
X-A-Dcw
X-Processor
X-Proxied
X-Storage
X-A-Dgt
X-Tenant
X-DataDome
X-Cache-NGX
X-EC-Lua
X-SVT-ORM-RULES
X-Cms-Context
Is-Eu
NGX
X-DC
UCS
Cmstype
X-Fastly-Cache
X-Fastly-Backend
X-DPWN-IS-SECURE
Fastly-Drupal-HTML
X-SVT-ORM-VERSION
X-TrackingId
Cmsid
X-Envoy-Decorator-Operation
X-Accel-Expires-Debug
Fastly-Backend-Name
X-Backend-State
X-LI-UUID
X-Loc
X-Li-Pop
X-Li-Fabric
X-JWT-State
X-Proxy-Upstream
X-Cache-Info
X-Men
X-Origin-Expires
X-Core-Value
X-VServer
L
X-Cache-Debug
X-Service
X-VG-TLSProxy
X-Date
Adler-Geo
Origin
Cache-Host
Cache-Key
X-Request-UUID
X-Variation
Platform
X-Dc
X-Is-Gdpr
Pics-Label
X-Has-Esi
X-Ratelimit-Remaining
AMP-Access-Control-Allow-Source-Origin
X-Cache-Id
X-Branch-Name
X-Block-Status
X-Bip
X-Worker
X-Ckpd-Fst-Backend
X-Clientip
X-Clara-WADP
X-Cluster
X-Gzip
X-VC-Cache
X-Rocket-Build-Number
X-Scheme
X-Served-From
X-Req
X-RateLimit-Remaining-Second
X-Nginx-Cache-Key
X-Old-Content-Length
X-Origin
X-RateLimit-Limit-Second
X-Sigma
X-Sigma-Backend
X-Thanos
X-Thinkindot-L3
X-Varnish-CookieHashed-On
X-Var-Ttl
X-Slack-Backend
X-SIPLIST1
X-VarnishDD-TTL
X-Varnish-Remaining-TTL
X-Varnish-CookieINHashed-On
X-Via-NSCOPI
X-Viewer-Country
X-Gamma-Serve
X-Gen-Mode
X-Generated-By
X-Generated-On
X-Forwarded-Site
X-Fmm-Version
X-DefHash
X-Developers
X-Device-Os
X-Esi-Check
X-Geo-Header
X-GoCache-CacheStatus
X-Wikidot-Backend
X-Location
X-WADP-Cache
X-Micro-Cache
X-Wikidot-Static-Cache
X-Level-Front-Cache
X-Hash
X-HN
X-Hnp-Log
X-DefElseHash
X-Cache-Tags
PB-PID
Locid
Location
PB-RID
Server-Ext
Server-Hostname
Server-Host
IsBot
Arc-Version
CPC-Age
CPC-Cache
Esi-Enabled
Fastcgi-Cache-TTL
C-Via
Cf-Device-Type
Sever-Int
PFcat
Thinkindot-Control
Vix-Hermes-Req-Id
X-Ua-Browser
X-Tx-Id
True-Client-Country-4JS
Thinkindot-CacheControl-Type
X-Content
Thinkindot-CacheControl
TDXMobile
VNS-Age
VNS-Cache
X-Amz-Meta-S3cmd-Attrs
X-Platform
XServer
Server-Info
CacheControlHeader
Wxu-Next-Region
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
Arc-Country
X-Fetched-On
X-FC-Vary-Parameters
X-Skip-Cache
X-Sucuri-ID
X-Policy
X-Request-Host
X-Planisys-CDN-Cache
AKAMAI
X-Vdms-Path
X-Auto-Login
X-M-Reqid
X-Irp-Debug
X-M-Log
X-Goog-Meta-Goog-Reserved-File-Mtime
X-NCache
X-Generated-In
X-Owner
DSUID
X-GeoIP
X-Mvc-Supplant-Cachable
X-GeoIP-City
We-Hiring
L5d-Success-Class
X-CGP
V-Age
Release
Mail-Subject
Memcached
X-Csrf-Jwt
Svr
HA-Ipaddr
Wxu-Next-Hostname
Pagetype
X-Eu-Site
Ha-Gx-Prefs
Wxu-Next-Commit
NM-Fastcgi-Cache
Gh-Request-Id
X-Qnm-Cache
Webserver
NtCoent-Length
X-V-Cache
X-HS-Content-Campaign-Id
Kp-EeAlive
X-Qloud-Router
X-Unique-ID
X-Render-Time
Cache-Hits
X-Mvc-Supplant-OutputCached
X-Via-Popv
X-Via-Poph
X-Via-Popn
X-LSADC-Cache
X-Platform-Router
DataCenter
X-Platform-Processor
X-Platform-Cluster
MIME-Version
X-Rocket-Nginx-Serving-Static
X-Servedbyhost
X-SD-PageType
X-User
X-Cache-Ttl
X-Srv
Who
X-Cache-Remote
X-PF-Uncompressing
Environment
X-NC
X-Cache-Var
X-ID
X-Zone
X-Cache-Var-Map
X-PJAX-URL
X-Datadog-Sampling-Priority
X-BBC-Origin-Response-Status
X-Datadog-Trace-Id
X-Minions-Version
X-Datadog-Parent-Id
X-Vc
X-Varnish-Url
X-Wa
X-Gdpr
X-NodeID
X-Traceid
X-API-Version
X-Origin-Time
X-Nyt-Route
X-Varnish-Ttl
WebServer
X-Refresh
X-App
Cluster
Server-ID
X-Via-Ucdn
Powered-By-ChinaCache
X-TIME
X-Cache-Config
X-VCL-Version
Time
X-LB-ID
My-App
Memory
X-Webkit-Csp
X-Pod-Name
Candidate-Md5Url
X-Server-IP
X-Internal-Host
X-ZONE
X-CACHE-KEY
HostName
X-Webkit-CSP-Report-Only
Datacenter
X-Pass-Why
Geoip-Latitude
X-Newrelic-Synthetics
X-Esi
X-NewRelic-App-Data
N-Cache
X-CLOUD-TRACE-CONTEXT
GeoIp-Country-Code
Web-Mar-Region
X-LI-Proto
Onion-Location
Resin-Trace
X-Edge-Pop
X-OVcl
X-Tb-Optimization-Total-Bytes-Saved
X-ElasticPress-Query
X-TX-ID
Geo-Info
X-OVcl-Cache
X-VHOST
Cf-Bgj
X-Akamai-Pragma-Client-IP
Hostname
Servername
Tcn
Ohc-File-Size
X-Backend-TTL
X-TraceId
X-Varnish-Cacheable
X-HITS
X-CACHE-AGE
X-Origin-Response-Time
Magicmarker
X-Dynatrace
X-Tt-Logid
X-Geo
WWW-Authenticate
CDN
X-EIG-Tracking-Id
LB
X-Dispatcher-Server
X-Varnish-Beresp-TTL
X-NODE
X-Fpc
X-Method
X-Li-Proto
X-Correlation-ID
X-AB
Proxy-Connection
GeoIP-Country-Code
X-Dynatrace-Js-Agent
X-Wix-Viewer-Type
X-Tid
X-TIM-N
X-MSEdge-Features
Redirect-Candidate
X-MSEdge-Flight
X-HostName
DB-Nickname
Cdn
Tracecode
Ssr
GeoIP-Latitude
X-Up
X-IP
Cf-Ipcountry
X-Cache-Date
X-Vcl-Version
X-Fastly-Backend-Reqs
X-NGINX-Cache
X-Request-Start
Is-Us
X-HS-Status
Pramga
X-CSRF-TOKEN
X-Cs
CF-Cached-On
X-Sn-Servicetimems
X-APP
X-Amz-Meta-Cb-Modifiedtime
X-Node-Id
Server-Id
X-COUNTRY
Sid
X-Cdn-Origin
Lb
X-MG-S
X-Provided-By
X-Core-Mission
W
X-WA
X-Trv-Group
X-Lb-Id
X-ServerName
X-Webkit-Csp-Report-Only
X-ND-Cache
Cteonnt-Length
X-Nc
X-FORWARDED-FOR
X-UnsetCookies
URI
X-Via-CDN
WZWS-RAY
X-Check-Cacheable
CloudFront-Viewer-Country
Env
X-Pjax-Url
X-VC
X-Cache-Expires
X-Reqid
X-DynaTrace-JS-Agent
CountryCode
Ohc-Cache-HIT
X-SERVER-NAME
X-Fastly-Request-Id
WP-Super-Cache
X-Cache-Backend
X-Via-PopN
X-Via-PopV
X-Via-PopH
X-CCDN-Origin-Time
X-Cache-Status-Check
X-Hcs-Proxy-Type
Shield-Pop
X-CCDN-CacheTTL
X-ServedByHost
X-Region-Sid
X-Sucuri-Cache
X-SN
Mime-Version
X-Pf-Uncompressing
X-IN-APIGATEWAY
X-IN-APIGATEWAYSSL
X-Acquia-Site
Server-Ttl
VivaBuild
Viewtype
X-Acquia-Application-UUID
CACHE
X-Acquia-Application-Trace
X-Acquia-Purge-Tags
X-Fastly-Cache-Hits
X-Moov-T
X-Pad
X-Moov-Xdn-Version
Xc-Version
X-LiteSpeed-Cache-Control
X-RAMCache
X-Cache-ASPX
X-Contensis-Viewer-Groups
X-Edge-POP
X-Varnish-Authentication
X-CUA
Rt-Fastcgi-Cache
X-Ig-Push-State
User-Agent
X-Cdn-Request-ID
EpKe-Alive
X-RPM
Ohc-Response-Time
X-Action
X-DB
X-DI
X-Dw-Trace-Id
X-Yottaa-OS
X-Webstats-RespID
X-SB
X-Swift-Error
X-DSS
Vha6-Origin
X-DW
Xet-Cookie
X-StackifyID
X-RSL
X-RPS
X-Cdn-Forward
X-Amz-Meta-Opti
Content-Script-Type
Hit
Content-Style-Type
FSS-Cache
X-ElasticPress-Search
Machine
Req-ID
ServerName
X-CF-Powered-By
X-TH-Server
X-MiniProfiler-Ids