Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
CF-RAY
Cf-Request-Id
CF-Cache-Status
X-XSS-Protection
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
X-Request-Id
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Cache-Status
X-Generator
X-DNS-Prefetch-Control
X-Cacheable
X-Request-ID
Timing-Allow-Origin
X-Content-Security-Policy
X-Iinfo
Content-Encoding
X-CDN
X-Ua-Compatible
Feature-Policy
X-AspNetMvc-Version
Status
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
X-Via
Access-Control-Max-Age
Keep-Alive
X-Ws-Request-Id
X-Age
X-AH-Environment
X-Robots-Tag
X-Turbo-Charged-By
EagleId
Request-Context
X-Proxy-Cache
X-Cache-Group
Server-Timing
X-Backend
X-Hacker
X-Server
Report-To
Host-Header
X-Server-Powered-By
X-Amz-Request-Id
X-Amz-Id-2
Grace
X-Nginx-Cache-Status
X-UA-Device
X-Dns-Prefetch-Control
X-Rq
X-Varnish-Cache
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
X-Page-Speed
Cf-Railgun
X-Pingback
X-OneAgent-JS-Injection
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
NEL
X-Cache-Spec
X-Amz-Version-Id
X-Device
X-CST
Allow
X-Vhost
X-Host
X-Backend-Server
Xkey
X-Server-Id
X-WebKit-CSP
EagleEye-TraceId
X-Dispatcher
Surrogate-Control
X-Node
Request-Id
Content-Location
X-Response-Time
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Akam-SW-Version
P3p
X-ASPNET-VERSION
X-Ruxit-JS-Agent
Accept-Ch
X-Application-Context
X-Cache-Lookup
X-Ac
X-Country
X-Template
Accept-Ch-Lifetime
X-Mod-Pagespeed
X-Language
Accept-CH
X-Readtime
X-Cloud-Trace-Context
Accept-CH-Lifetime
MS-Author-Via
X-B3-TraceId
Rating
X-HW
X-Cnection
X-Origin-Cache
X-MS-InvokeApp
X-Url
X-Vname
X-PC
X-TtlSet
X-Clacks-Overhead
Edge-Control
X-GitHub-Request-Id
X-ORACLE-DMS-RID
X-Trace
X-ESI
X-ORACLE-DMS-ECID
X-Middleton-Response
X-Sol
X-Middleton-Display
X-Content-Type
Display
Pagespeed
Response
X-Varnish-TTL
X-D2id
Arr-Disable-Session-Affinity
X-GoogleNews-Bot
X-Kinja-Revision
X-Use-Magma
X-Exp-Variant
X-Kinja
X-Cdn-Fetch
X-Kinja-Server
X-Exp-Id
X-Kinja-Build
Verso
X-Vcap-Request-Id
X-Goog-Hash
X-Country-Code
X-Rack-Cache
X-TTL
X-Powered-By-Plesk
X-Navigation-Version
Service-Worker-Allowed
X-Server-Name
X-Buckets
X-VARITI-CCR
X-Abt-Application-Version
X-Amz-Rid
X-Fastly-Request-ID
X-FastCGI-Cache
X-Webkit-CSP
X-Client-IP
Fastly-Restarts
X-Cache-TTL
X-Release
X-MSEdge-Ref
X-Cached
X-Dw-Request-Base-Id
X-Element-Page-Cache
X-Pinterest-Rid
Pinterest-Version
Pinterest-Generated-By
X-Oneagent-Js-Injection
X-SharePointHealthScore
SPRequestGuid
X-NF-Request-ID
SPIisLatency
SPRequestDuration
Mrf-Cache-Status
X-B3-TraceId-Primal
MRF-Tech
Public-Key-Pins
RTSS
Access-Control-Request-Method
AR-ATIME
AR-CACHE
AR-PoweredBy
AR-Request-ID
Ar-Sid
X-Edge
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-LLID
Cache-Tag
X-Powered-CMS
X-Ezoic-Cdn
X-Litespeed-Cache
X-Upstream
Content-MD5
X-HP-Webp
X-Jurisdiction
X-Origin-Upstream-Status
X-Version
Fusion-Template-Id
Fusion-Source
S
Fusion-Content-Id
Fusion-Deployment-Id
Fusion-Component-Id
Fusion-Content-Source
X-Px
X-Mid
X-ECACHE
X-MCACHE
X-Recruiting
X-Mg-S
X-Ruxit-Js-Agent
Charset
X-Content-Digest
X-PressLabs-Stats
X-Kinsta-Cache
X-DynaTrace
Fastcgi-Cache
X-T
Cache-Tags
X-Amz-Server-Side-Encryption
Filters
X-Logged-In
MicrosoftSharePointTeamServices
X-Accel-Expires
X-Forwarded-Proto
X-Ttl
X-Content-Security-Policy-Report-Only
Server-Node
Edge-Cache-Tag
X-Id
Front-End-Https
X-Correlation-Id
TP-Cache
TP-L2-Cache
X-Grace
Server-Name
X-Debug
X-Fastcgi-Cache
Nginx-Cache
X-Hits
X-Forwarded-For
X-Amzn-Trace-Id
X-Request-Received
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Request-Processing-Time
TCN
X-B3-Sampled
X-Shield-Request-Id
X-Yandex-Sdch-Disable
X-Request-Handler-Origin-Region
X-Microsite
X-Varnish-Age
Surrogate-Key
X-Az
X-Activity-Id
X-AppVersion
X-Ser
X-Amz-Replication-Status
X-F-Cache
X-HS-Combine-CSS
X-HS-Hub-Id
X-HS-Content-Id
X-XRDS-LOCATION
X-HS-Cache-Config
X-XRDS-Location
X-Origin-Server
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-DIS-Request-ID
X-Goog-Generation
X-Goog-Metageneration
Alternate-Protocol
X-Pinterest-Direct
Accept-Charset
X-Geo-Country
X-Git-Hash
X-Rid
X-Cache-Key
X-Frontend
X-Respond-Thread
Section-Io-Cache
Host
X-NWS-LOG-UUID
Cache
X-Time
X-LB-Cache
X-DataDome
X-Upgrade-Enabled
X-VCache
Access-Control-Allow-Method
X-Mobile-URL
X-Seen-By
X-FTR-Request-ID
X-Cache-Age
X-Server-ID
MS-CV
ServerID
Paypal-Debug-Id
X-TT
X-AOL-HN
Healthy
X-Type
X-Hostname
X-Source
X-Route-Name
X-Request-Guid
X-Varnish-Backend
X-IPLB-Instance
X-Flags
X-Is-Crawler
X-Aspnet-Duration-Ms
X-Whom
X-Content-Options
X-Providence-Cookie
X-B-Cache
Payment
X-Signature
Cleartype
X-Cache-Action
X-App-Environment
X-Page-Id
X-Daa-Tunnel
Fastcgi-Useragent
X-Debug-Info
X-Jobs
X-RateLimit-Remaining
X-N
X-WebKit-CSP-Report-Only
X-Load-Cache
Powered-By-ChinaCache
X-FB-Debug
Nel
X-Mobile
X-Webkit-Csp
X-Contextid
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Browser-Type
Realpath
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-Via-JSL
Node
Refresh
X-Rule
X-Drupal-Cache-Tags
X-Response-Served-From
X-Original-Request-Id
X-Accel-Buffering
X-Zen-Fury
Version
X-Wix-Request-Id
X-Proxy
X-RTag
DC
X-Cache-Expired-At
X-Cacheable-TTL
Ms-Operation-Id
X-Framework
X-RemovedCookies
X-ProcessESI
Referer-Policy
Access-Control-Request-Headers
X-Drupal-Cache-Contexts
X-Distributor
X-Real-IP
X-Instance
X-B
X-Region
X-FW-Hash
X-FW-Serve
X-FW-Server
X-FW-Dynamic
X-Cluster-Name
X-Cache-Time
X-Tt-Trace-Tag
X-FW-Static
X-UUID
X-FW-Type
Viewport
X-Page-View
X-Tt-Trace-Host
Eomportal-Instance
X-Cached-By
X-HTML-Minification-Powered-By
X-Cache-Control
X-Content-Powered-By
X-Akamai-Edgescape
X-Cache-Rule
VIX-Pulpo-Node
X-Cache-Operation
VIX-Pulpo-Upstream-Status
Liferay-Portal
X-IPS-LoggedIn
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Cache-Hit
X-FireWall-Port
Countrycode
X-G
X-Tumblr-Pixel
X-Tumblr-User
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Pass-Why
X-Environment-Context
X-L-Path
X-App-Server
Server-Info
DynaTrace
SRV
CF-IPCountry
Section-Origin-Responded
X-Nginx-Cache
Section-Io-Origin-Time-Seconds
Section-Io-Id
Section-Io-Origin-Status
X-Protected-By
X-Debug-IsPreview
Ec-Rule-Version
From-Origin
X-User-Agent
Xserver
X-Debug-IsConnected
X-Tumblr-Pixel-2
X-Www-Served-By
Webserver
GEO-INFO
X-Ratelimit-Limit
X-Mode
X-Device-Type
X-ES-SERVER
X-Handled-By
X-Endurance-Cache-Level
X-Adobe-Content
X-UPSTREAM-Address
Meta-Geo
X-Adobe-Loc
X-RN-RSRV
Protected
X-FB-TRIP-ID
Cache-Tv-Group
X-Site-Version
X-Locale
X-Uri
X-Hl-Ver
X-Node-Name
X-Storage
Webcakes-App-Name
TWC-Privacy
X-Web-Node
X-Varnishpool
Property-Id
Cache-Status
Retry-After
TWC-Connection-Speed
TWC-Device-Class
TWC-GeoIP-LatLong
TWC-GeoIP-Country
Webcakes-Region
X-Origin-Hint
TWC-Locale-Group
Webcakes-App-Version
X-NYM-Debug-Backend
X-PHP-Host
X-Cache-Server
X-MP-GENERATED-AT
X-Soup
X-Backend-Name
X-Labrador-Cache-Channel
X-Human
Decoy-Debug-Key
X-Sql-Count
X-FW-Version
X-WA-Info
X-Via-Fastly
Cache-Name
Country
X-Timing-Wait
X-Proxy-Build
X-Format
Decoy-Debug-Status
Selected-Fe
X-UA-Device-Type
X-R9-Blue-Green-Version
X-Access
X-Request-Time
X-Section
Frame-Options
Fastly-SSL
X-PCL
Decoy-Debug-TTL
X-Pubstack
X-Sql-Duration-Ms
X-Redis-Cache
X-OCL
X-Be
X-Say-Cacheable
Mn-Server-Ip
X-S-Maxage
X-ApacheServer
X-TNCMS
Azure-Version
X-Proto
X-Varnish-Grace
X-ProxyCache-Key
Azure-SlotName
Azure-SiteName
X-Routing-Service
X-No-Session
Azure-InstanceId
Azure-RegionName
X-Origin-Date
X-SayCDN-TTL
X-Tec-Api-Origin
X-Hyper-Cache
X-Cache-TTL-Remaining
X-Xfnlog-Site
X-Tec-Api-Root
X-Hosted-By
X-Tec-Api-Version
X-Zipkin-Id
X-ProxyCache-Status
X-LJ-Flow-ID
X-AWS-Id
X-PERF
X-Proxied
X-Say-TTL
X-Server-W
X-BYPASS-REASON
X-Loop
X-Status
X-VWS-Id
X-LAGOON
X-Alternate-Cache-Key
X-Storefront-Renderer-Rendered
X-CCM
X-ShardId
X-Shopify-Stage
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-ShopId
X-Cluster
X-Forwarded-Host
Apigw-Requestid
X-Cache-Grace
X-TT-LOGID
X-Varnish-Server
X-AIR-PT
X-GG-Cache-Date
X-Revision
X-Is-Bot
X-SRV
X-Rendered-As
X-Info
X-Qloud-Router
S-Cnection
X-Ratelimit-Remaining
X-Cache-Enabled
AMP-Access-Control-Allow-Source-Origin
X-Microcachable
X-Cdn
X-Proxy-Cache-Status
X-Content-Age
Uber-Trace-Id
X-Dc
X-Via-CDN
Cache-Hits
X-Country-Code-Real
X-FTR-DC
X-Azure-Ref
X-FTR-Cache-Status
X-FTR-Balancer
X-App-Version
X-FTR-Backend
X-FTR-Backend-Server
X-FTR-Realm
X-Platform
X-NWS-UUID-VERIFY
X-Varnish-Ttl
X-TA-CDN-Provider
Amp-Access-Control-Allow-Source-Origin
X-Backend-Host
X-Aspnetmvc-Version
X-Detected-As
X-Cache-Host
X-CSRF-Token
X-Amz-Apigw-Id
X-Amzn-RequestId
X-FTR-Expires
X-Amz-Meta-S3cmd-Attrs
X-Amzn-Remapped-Content-Length
X-EdgeConnect-Cache-Status
Akamai-GRN
X-ATG-Version
X-B3-SpanId
X-Oss-Object-Type
X-Oss-Request-Id
X-Oss-Hash-Crc64ecma
X-Oss-Server-Time
X-CS
X-Trace-Id
X-Air-Hostname
X-Oss-Storage-Class
SD-X-WS
Tracecode
X-Debug-Cache
ServedBy
X-RCS-CacheZone
X-Time-Microsecs
X-Cache-PHP
X-Cache-NGX
X-ID
X-Backend-TTL
X-Varnish-Hostname
X-BCube-Filmed-By
X-Akamai-Transformed
X-Correlation-ID
DB-Nickname
X-Tb
X-Cache-Var-Map
X-Unique-Id
HostName
X-Cache-Var
X-ServerID
X-NewRelic-App-Data
Backend
X-Ms-Version
X-B-Cookie
X-Cache-NE
X-Ms-Request-Id
X-Application
X-A-Wwc
X-Aed
X-CF-Lambda-Fn
X-ARC
X-Destination
X-From
X-Generated-On
X-Generation-Time
X-GeoIP-City
X-Fetched-On
X-Device-Os
X-Connection-Hash
X-D
X-A-Dgt
X-CF-Lambda-Version
X-A-Ccd
BehaviorPad-Version
MD5-Digest
Meta-Geo-Continent
Mobile-Detection-Method
Machine
Fastcgi-X-Cache-Version
DCR-Decision-By
DCR-Processing-Time-Ms
Expiry
Odigeo-Trace-Id
X-Adobe-Source
Thinkindot-Control
X-A
X-Level-Front-Cache
X-A-Dam
Thinkindot-CacheControl-Type
Thinkindot-CacheControl
Release
Rendered-Blocks
T-Server
X-A-Dcw
X-External-Request-Id
X-Rojux
X-S
X-S-Cookie
X-DynaTrace-JS-Agent
X-Rewrite-Enabled
X-Request-UUID
X-EC-Lua
X-PBS-Appsvrname
X-Processor
X-ScT
X-Session-Fingerprint
X-VG-WebServer
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
Xc-Version
X-VG-WebCache
X-Vdms-Version
X-Thinkindot-L3
X-Trv-Group
X-Vdms-Path
X-PAYTM-SRV-ID
X-SRCache-Key
X-Magnolia-Registration
X-Location
X-Origin-TTL
X-Origin-CC
X-Owner
X-NAPM-TraceId
DSUID
X-Nc
X-TX-ID
X-GEO
X-Sucuri-ID
X-Geo-Header
On-Server
X-Micro-Cache
Path
PB-PID
Content-Disposition
X-JWT-State
PB-RID
NGX
X-Is-Gdpr
X-Tumblr-Pixel-3
Host-ID
Locid
Gh-Request-Id
Fastly-Backend-Name
X-VServer
X-HS-Content-Campaign-Id
Magicmarker
Instruction
Server-Host
X-Developers
X-OVcl
Cf-Device-Type
X-Fastly-Cache
X-Node-Id
X-OVcl-Cache
X-Core-Value
X-Cache-Bucket
X-Bip
X-Policy
X-Azure-Ref-OriginShield
X-Skip-Cache
Wxu-Next-Region
SR-User-Adfree
Sever-Int
Server-Hostname
X-Cms-Context
X-Nginx-Cache-Key
X-Thanos
Wxu-Next-Hostname
Wxu-Next-Commit
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
Server-Ext
X-Has-Esi
AKAMAI
X-Varnish-Cache-Hits
X-B3-Traceid
Arc-Version
C-Via
User-Cache-Control
X-Varnish-Beresp-Grace
X-Cdn-Forward
X-DefHash
X-Scheme
X-SIPLIST1
X-Li-Pop
Cf-Bgj
X-Clara-WADP
X-Request-Host
X-DefElseHash
X-Cache-Info
X-Clientip
X-Reqid
X-Cache-Id
X-VarnishDD-TTL
X-Varnish-Remaining-TTL
Web-Mar-Node
UCS
X-LI-UUID
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
X-Block-Status
X-Cache-Debug
X-Swa-Ws
X-TrackingId
X-Variation
X-Rebelmouse-Surrogate-Control
X-Li-Fabric
X-Gzip
X-Origin-Expires
X-GoCache-CacheStatus
X-Origin-Response-Time
X-GeoIP
X-HN
X-Hnp-Log
X-IP
X-Irp-Debug
X-NU-AKA-ACS-Version
X-Old-Content-Length
X-Origin
X-Generated-By
X-Gen-Mode
X-Rebelmouse-Cache-Control
X-DPWN-IS-SECURE
Ssr
X-Method
X-Mvc-Supplant-Cachable
X-Envoy-Decorator-Operation
X-Esi-Check
X-Fmm-Version
X-Platform-Server
X-FC-Vary-Parameters
X-Fastly-Backend
X-Ratelimit-Reset
X-Developer
X-Backend-State
Is-Eu
IsBot
CDCHOST
X-User
Fastly-SIE
Fastly-SWR
Location
Cache-Host
Pagetype
V-Age
PFcat
Platform
Adler-Geo
CDN-Cache
CacheControlHeader
CDN-RequestId
X-Wikidot-Static-Cache
X-WADP-Cache
CDN-RequestCountryCode
CDN-PullZone
CDN-Uid
CDN-EdgeStorageId
CDN-CachedAt
X-Wikidot-Backend
X-Cache-Backend
X-Varnish-Beresp-Ttl
X-Csrf-Jwt
X-Unique-ID
X-CUA
X-Matched-Rule
Who
X-CGP
Vix-Hermes-Req-Id
Origin
X-VG-TLSProxy
X-Gamma-Serve
True-Client-Country-4JS
HA-Ipaddr
Ha-Gx-Prefs
X-Request-URI
L
X-Eu-Site
X-LB-ID
X-Dispatcher-Server
Lfy
L5d-Success-Class
X-Generated-In
NM-Fastcgi-Cache
Rt-Fastcgi-Cache
Apple-News-Services-Request-Url
X-Branch-Name
Apple-News-Services-Host
X-Varnish-Hits
X-Varnish-Beresp-Status
Apple-News-Services-Handled
X-Var-Ttl
X-Slack-Backend
Apple-News-Services-Parsed-Url
X-Cache-Tags
Country-Code
X-CLOUD-TRACE-CONTEXT
Esi-Enabled
Fastly-Drupal-HTML
CloudFront-Viewer-Country
X-Loc
X-Hash
X-Aicache-OS
X-Goog-Meta-Goog-Reserved-File-Mtime
X-CACHE-KEY
Sid
X-RateLimit-Limit
X-APP-VERSION
Geo-Info
X-Cdn-Origin
Tcn
Pics-Label
X-NCache
X-Via-Popn
X-Mvc-Supplant-OutputCached
X-Sn-Servicetimems
Pramga
X-Via-Popv
X-Via-Poph
X-Cache-Expires
X-Varnish-Url
X-Core-Mission
X-Cache-Date
X-Epic-Correlation-Id
X-Servername
X-PF-Uncompressing
X-Planisys-CDN-TTL
Filterid
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Refresh
X-Tb-Optimization-Total-Bytes-Saved
X-Request-Start
Url
X-TraceId
Req-Svc-Chain
Cmsid
Cmstype
X-Esi
X-FireWall-Protection
X-DC
X-Served-From
Svr
X-Varnish-Cacheable
X-Error
X-Response-By
MIME-Version
Kp-EeAlive
NGB
Viewtype
Cache-Key
VivaBuild
A
Source
X-NC
X-Erf-Stays-Bingo-Pdp-Web
X-Webkit-CSP-Report-Only
M-TraceId
X-Srv
Xkeyi7
X-Proxy-Cachei7
X-Cache-Remote
HitType
Cross-Origin-Opener-Policy
X-Air-Source
Content-Secure-Policy
Arc-Country
X-Servedbyhost
N-Cache
GeoIp-Country-Code
X-HS-Status
Server-Ttl
X-Wa
S-Rt
TDXMobile
X-BBXSRF
Server-ID
Geoip-Latitude
X-URL
X-Vgn-Hpd-Reason
X-Cache-2
X-B3-Spanid
X-Vcl-Version
X-HostName
X-CDN-Forward
X-LiteSpeed-Cache-Control
X-Cc-Via
X-LI-Proto
X-Cache-ASPX
D-Cc-Upstream
X-Contensis-Viewer-Groups
X-Cc-Req-Id
X-Varnish-Authentication
Resin-Trace
CACHE
Ohc-File-Size
X-JoinUs
X-NGENIX-Cache
X-SaId
Cross-Origin-Window-Policy
X-Sucuri-Cache
Cteonnt-Length
X-Host-Name
SID
NtCoent-Length
X-Vc
X-Internal-Host
X-RAMCache
X-Geo
X-Service
X-Edge-Location
X-PHP-Backend
X-Svr
X-Li-Proto
X-HOST
X-VCL-Version
Request-ID
Hostname
XServer
X-Server-IP
DataCenter
X-Extlb
X-UA
X-Nyt-Route
X-WA
X-Cache-Config
X-RPS
X-RPM
X-DI
X-DB
X-Via-NSCOPI
X-Forwarded-Site
X-CCDN-Origin-Time
FSS-Cache
X-DW
X-Viewer-Country
X-ServedByHost
X-API-Version
X-Newrelic-Synthetics
X-TIM-N
X-FPC
X-CCDN-CacheTTL
X-Origin-Time
X-Hcs-Proxy-Type
X-DSS
X-Gdpr
X-RSL
X-FORWARDED-FOR
X-Bc-Bl
GeoIP-Country-Code
GeoIP-Latitude
Cache-Provider
X-Cs
X-SN
X-App
X-Check-Cacheable
CF-Cached-On
X-Dynatrace
X-VC
Ohc-Cache-HIT
X-Accel-Expires-Debug
X-Date
X-Action
X-VC-Cache
X-Proxy-Upstream
X-Req
ProcessTime
X-PJAX-URL
LB
Surrogated-Key
X-Region-Sid
X-SB
Server-Id
X-Webstats-RespID
X-NodeID
X-ZONE
X-TIME
X-Dynatrace-Js-Agent
Env
Mime-Version
X-Server-Lifecycle-Phase
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-SD-PageType
We-Hiring
X-Fpc
X-Kraken-Loop-Name
X-Oss-Cdn-Auth
X-Kraken-Routeconfig-Destination
X-CF-Powered-By
X-Instrumentation
Memcached
Mail-Subject
X-CSRF-TOKEN
X-Provided-By
X-BBC-Edge-Cache-Status
X-Render-Time
W
X-Depends-On
X-Men
X-APP
X-Air-Trace-Id
Srv
X-NGINX-Cache
X-Cdn-Request-ID
X-Swift-Error
CPC-Age
VNS-Age
VNS-Cache
X-Sigma-Backend
CPC-Cache
CDN
X-UnsetCookies
EpKe-Alive
Upgrade-Insecure-Requests
X-MSEdge-Flight
X-Rocket-Build-Number
X-Sigma
X-MSEdge-Features
X-BACKEND-TTL
X-Dw-Trace-Id
Cdn
X-Ftr-Cache-Host
X-Client-Ip
X-FTR-Cache-Host
X-CACHE-AGE
X-Hello
X-Flog
X-ABtesting
X-Parent-Response-Time
X-Worker
X-Fastly-Backend-Reqs
Dnion-Transfer-Encoding
X-Fastly-Request-Id
Processtime
Time
Memory
X-Cache-Tag
X-Auto-Login
X-Akamai-Pragma-Client-IP
X-Ua
X-Pad
X-Cluster-Node
X-Presslabs-Stats
X-Pf-Uncompressing
Media-Length
Datacenter
X-Oracle-DMS-ECID
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Acquia-Site
Vha6-Origin
X-BBC-Origin-Response-Status
X-Zone
X-Acquia-Application-Trace
Proxy-Connection
X-Snapshot-Date
PICS-Label
X-Via-PopN
X-Via-PopH
X-LiteSpeed-Tag
X-IN-APIGATEWAYSSL
X-ServerName
X-IN-APIGATEWAY
My-App
State
X-Via-PopV
Fastcgi-Cache-TTL
Epwk-X-Cache
Cf-Ipcountry
X-Minions-Version
X-Cache-Status-Check
X-Ms-Meta-Originalurl
X-Ms-Meta-Staticbatchstarttime
X-Varnish-Beresp-TTL
X-Lb-Id
X-Edge-Location-Klb
X-ElasticPress-Query
X-Varnish-URL
Xet-Cookie
X-Request-URL
X-Akamai-ERPolicy
X-MiniProfiler-Ids
X-Akamai-ERRuleID
X-ElasticPress-Search
X-Vcache
CountryCode
X-Tx-Id
Ohc-Response-Time
X-Litespeed-Cache-Control
Content-Script-Type
Content-Style-Type
X-Apw-Access-Object
X-B3-Parentspanid
X-Nananana
X-Apw-Hits
X-Apw-Access-Token
X-Request-Url
X-Apw-Access-Action
URI
X-C
X-Debug-Cache-Store
X-Storefront-Renderer-Verified
Inserted-Into-Cache-At
Phost
NnCoection
X-Debug-Cache-Fetch
X-Tid
X-Redis-Duration-Ms
Environment
X-Amz-Meta-Cb-Modifiedtime
OT-Force-Account-Verify
X-Redis-Count
X-Traceid