Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
X-Frame-Options
Strict-Transport-Security
X-Content-Type-Options
Accept-Ranges
Last-Modified
X-XSS-Protection
X-Powered-By
Pragma
CF-Cache-Status
CF-RAY
Link
ETag
Expect-CT
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
X-UA-Compatible
X-Cache-Hits
X-Amz-Cf-Pop
X-Amz-Cf-Id
Referrer-Policy
X-Served-By
X-Varnish
Alt-Svc
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Download-Options
X-Request-Id
X-AspNet-Version
Access-Control-Allow-Credentials
X-Runtime
X-Drupal-Cache
X-Adblock-Key
X-Check
X-Cache-Status
X-Generator
Content-Security-Policy-Report-Only
X-Permitted-Cross-Domain-Policies
X-Request-ID
X-Cacheable
X-Template
X-Language
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-AspNetMvc-Version
X-FRAME-OPTIONS
X-Buckets
Status
X-Content-Security-Policy
Upgrade
X-CDN
Content-Encoding
Access-Control-Expose-Headers
Access-Control-Max-Age
X-Xss-Protection
X-Kinja-Server-Push
Keep-Alive
X-Turbo-Charged-By
X-Drupal-Dynamic-Cache
P3p
Xkey
X-Pass-Why
X-Cache-Group
X-AH-Environment
X-Envoy-Upstream-Service-Time
CF-Ray
X-Backend
X-Via
X-Ua-Compatible
X-Age
X-Server
X-Amz-Request-Id
X-Amz-Id-2
X-Robots-Tag
X-Server-Powered-By
X-Page-Speed
X-Pingback
X-Ws-Request-Id
EagleId
X-Proxy-Cache
X-Nginx-Cache-Status
X-Hacker
X-UA-Device
Request-Context
X-Varnish-Cache
Feature-Policy
Server-Timing
Cf-Railgun
Grace
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-Amz-Version-Id
Report-To
X-LiteSpeed-Cache
X-Rq
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-WebKit-CSP
X-Server-Id
X-Host
X-OneAgent-JS-Injection
X-Device
X-Dns-Prefetch-Control
EagleEye-TraceId
X-Origin-Cache
X-Response-Time
Content-Location
X-Node
X-Ac
Surrogate-Control
X-Vhost
X-Readtime
X-Cloud-Trace-Context
Request-Id
X-Backend-Server
X-Dispatcher
X-Origin-Upstream-Status
X-Cnection
X-HW
X-Application-Context
X-ORACLE-DMS-ECID
Fusion-Source
Fusion-Template-Id
Fusion-Component-Id
Fusion-Content-Id
Fusion-Content-Source
X-Cache-Lookup
X-DataDome
X-ORACLE-DMS-RID
X-Mod-Pagespeed
NEL
X-Ruxit-JS-Agent
Rating
X-Rack-Cache
Edge-Control
X-Country
X-Akam-SW-Version
X-Clacks-Overhead
Pinterest-Generated-By
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Allow
X-Country-Code
X-DynaTrace
X-Instart-Request-ID
Accept-Ch
X-Varnish-TTL
X-TTL
X-Goog-Hash
X-FTR-Request-ID
X-Vname
X-PC
X-TtlSet
Verso
Accept-Ch-Lifetime
X-ESI
X-Powered-By-Plesk
Service-Worker-Allowed
Content-MD5
X-Url
X-Forwarded-Proto
X-Version
X-MS-InvokeApp
X-B3-TraceId
X-Kinja-Build
X-Kinja
X-Kinja-Server
X-GoogleNews-Bot
X-Exp-Id
X-Cdn-Fetch
X-Use-Magma
X-Exp-Variant
X-Kinja-Revision
X-GitHub-Request-Id
Edge-Cache-Tag
RTSS
AR-Request-ID
Ar-Sid
AR-ATIME
AR-PoweredBy
AR-CACHE
X-D2id
X-Px
X-Debug
X-Abt-Application-Version
X-Server-Name
SPRequestGuid
X-Amz-Server-Side-Encryption
X-Vcache
Charset
X-NF-Request-ID
X-Cached
X-Accel-Expires
Display
X-Middleton-Response
X-Middleton-Display
X-Sol
Pagespeed
Response
X-MSEdge-Ref
X-TEC-API-VERSION
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-Amz-Rid
X-Vcap-Request-Id
Arr-Disable-Session-Affinity
TCN
X-Navigation-Version
X-Powered-CMS
X-SharePointHealthScore
X-Pinterest-Rid
Pinterest-Version
X-Trace
X-Fastcgi-Cache
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Cdn
X-VARITI-CCR
Realpath
Public-Key-Pins
X-Client-IP
Cache-Tag
Access-Control-Request-Method
X-Fastly-Request-ID
X-Ser
MS-Author-Via
S
X-DynaTrace-JS-Agent
Nginx-Cache
X-Shard
SPIisLatency
SPRequestDuration
X-Upstream
X-Id
X-B3-TraceId-Primal
X-Mrf-Item-Lastmod
X-Mrf-Section-Lastmod
Mrf-Cache-Status
MRF-Tech
X-Ezoic-Cdn
X-Hp-Webp
X-Content-Type
X-Forwarded-For
X-Amzn-Trace-Id
X-Grace
X-T
X-Amz-Meta-S3cmd-Attrs
X-Edge-O15-RID
Nel
X-Recruiting
Front-End-Https
DynaTrace
X-Hits
Fastcgi-Cache
X-Aspnet-Version
X-Varnish-Age
ServerID
X-Server-ID
X-Dw-Request-Base-Id
MicrosoftSharePointTeamServices
X-Node-Name
X-Element-Page-Cache
X-Cache-TTL
X-DIS-Request-ID
X-Mobile-URL
NR-ENABLED
X-FTR-Cache-Status
X-Jurisdiction
X-Content-Digest
X-Country-Code-Real
X-FTR-Expires
X-HS-Hub-Id
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Content-Id
X-Frontend
Powered
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-Goog-Stored-Content-Encoding
X-GUploader-UploadID
X-FTR-Backend-Server
X-FTR-Balancer
X-FTR-Realm
X-FTR-Backend
X-FTR-DC
Server-Node
Alternate-Protocol
TP-Cache
TP-L2-Cache
Server-Name
X-Logged-In
X-Correlation-Id
X-XRDS-Location
X-Request-Received
AMP-Access-Control-Allow-Source-Origin
X-Request-Processing-Time
X-Microsite
X-Request-Handler-Origin-Region
Upgrade-Insecure-Requests
Backend-Timing
X-ATS-Timestamp
X-Cache-Hit
X-Amzn-RequestId
X-Amz-Apigw-Id
X-Page-Id
X-Content-Options
Refresh
X-Origin-Server
X-Content-Security-Policy-Report-Only
X-User-Agent
X-F-Cache
X-Rid
X-Akamai-Edgescape
X-Revision
X-Type
X-Varnish-Grace
X-CST
X-Zen-Fury
Fastly-Restarts
X-Content-Powered-By
X-XRDS-LOCATION
X-LB-Cache
X-Geo-Country
X-B3-Sampled
X-B
X-Shield-Request-Id
X-URL
X-Activity-Id
X-Az
X-AppVersion
X-FTR-Cache-Host
X-N
PB-PID
PB-RID
X-Mobile-Rewrite
Arc-Version
Cache-Status
X-Kinsta-Cache
X-Webapp-Samesite-None-Activated-N
X-Pad
X-Cache-Age
X-TT
X-Debug-Info
X-WebKit-CSP-Report-Only
X-AOL-HN
X-Instance
X-Time
X-Framework
Paypal-Debug-Id
X-App-Environment
Actual-Object-TTL
X-Jobs
X-Request-Guid
X-Signature
X-B-Cache
X-Tumblr-User
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Webkit-Csp
X-Cache-Action
Access-Control-Allow-Method
X-PHP-Backend
DC
X-FB-Debug
X-RateLimit-Remaining
X-Analytics
X-Load-Cache
X-Cached-By
X-Git-Hash
X-Tt-Trace-Tag
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Varnish-Backend
Surrogate-Key
Fastcgi-Useragent
X-Tt-Trace-Host
Host-Header
X-Amz-Replication-Status
X-Contextid
X-IPLB-Instance
MS-CV
X-ATG-Version
X-SS-Set-Cookie
FilterID
X-WA-Info
X-FastCGI-Cache
X-Cache-Key
Tracecode
X-Cluster
X-Response-Served-From
X-Accel-Buffering
Host
NGB
X-Host-Name
WPE-Backend
X-Mobile
X-B3-Traceid
X-Kong-Upstream-Latency
X-Varnish-Server
X-Cache-NE
Payment
X-Kong-Proxy-Latency
Source
X-Cache-Rule
X-FW-Serve
X-Hostname
X-FW-Type
X-Region
Xserver
Eomportal-Instance
X-Via-JSL
X-FW-Server
Frame-Options
X-Cache-Operation
X-FW-Static
X-Cache-2
X-Srv
X-FW-Hash
X-Rendered-As
X-Cacheable-TTL
Cache-Tv-Group
X-Varnish-Hostname
X-Tumblr-Pixel-2
X-ORACLE-APMCS-REQUEST-ID
X-ORACLE-APMCS-TAG
X-Cache-Enabled
X-GeoIP
X-Is-Bot
X-IPS-LoggedIn
X-Tumblr-Pixel-1
Filters
X-Ttl
X-Adobe-Loc
X-Adobe-Content
X-NewRelic-App-Data
X-TX-ID
X-Origin-Response-Time
X-RequestSource
X-Presslabs-Stats
X-NWS-LOG-UUID
X-EdgeConnect-Cache-Status
X-Seen-By
Retry-After
Cleartype
X-Ruxit-Js-Agent
X-VCache
X-Cache-TTL-Remaining
Server-Info
Accept-CH
X-ProcessESI
Cache
X-RemovedCookies
X-HTML-Minification-Powered-By
Liferay-Portal
Datacenter
Ms-Operation-Id
X-RTag
X-Source
X-UA
X-Cache-Control
X-Environment-Context
X-Dc
X-L-Path
X-FireWall-Port
X-Upgrade-Enabled
Healthy
X-App-Server
X-Cache-Server
From-Origin
X-Endurance-Cache-Level
X-CACHE-KEY
X-APP-VERSION
Accept-CH-Lifetime
X-Esi
X-PressLabs-Stats
X-Handled-By
X-RateLimit-Limit
Version
X-Status
X-Backend-Name
X-Rule
X-RN-RSRV
X-Cache-Var
X-Cache-Var-Map
Meta-Geo
X-Path-Route
X-Wix-Request-Id
X-ES-SERVER
X-Format
X-Timing-Wait
Selected-Fe
X-Proxy-Build
X-Access
OT-Force-Account-Verify
X-Section
X-Request-Time
X-Tb
X-ProxyCache-Key
X-Storage
X-ShardId
X-ProxyCache-Status
X-Origin
Mn-Server-Ip
X-ShopId
X-Akamai-Request-ID
Azure-SiteName
Azure-RegionName
X-EIG-Tracking-Id
X-Proto
X-BYPASS-REASON
Azure-Version
X-Goog-Meta-Goog-Reserved-File-Mtime
Azure-SlotName
X-Content-Age
Cache-Tags
X-Human
X-Sorting-Hat-ShopId
Srv
X-Sorting-Hat-PodId
X-PCL
X-Shopify-Generated-Cart-Token
X-Shopify-Stage
X-Alternate-Cache-Key
X-OCL
Azure-InstanceId
Akamai-GRN
Decoy-Debug-Status
X-Pubstack
X-AWS-Id
DB-Nickname
X-Akamai-Request-ID2
Decoy-Debug-Key
X-Hyper-Cache
Decoy-Debug-TTL
Origin-Edge-Control
Now
X-Hl-Ver
X-JoinUs
X-LJ-Flow-ID
X-MP-GENERATED-AT
Origin-Cache-Control
X-Qloud-Router
X-Generated-By
NGX
X-Cluster-Node
X-Debug-Cache
X-Proxy
X-Cache-Host
X-Soup
X-Cache-Config
X-VWS-Id
X-Vgn-Hpd-Reason
X-UUID
X-NYM-Debug-Backend
X-FC-Vary-Parameters
Ec-Rule-Version
Node
X-Time-Microsecs
X-Web-Node
X-Proxy-Cache-Status
X-Hosted-By
S-Rt
X-FW-Dynamic
X-ServerID
X-Viewer-Country
X-Redis-Cache
X-Yottaa-Optimizations
X-SaId
X-Yottaa-Metrics
TWC-Locale-Group
X-Say-Cacheable
TWC-Privacy
X-IP
X-BCube-Filmed-By
Webcakes-App-Name
X-Akamai-Transformed
X-RCS-CacheZone
TWC-Device-Class
TWC-Connection-Speed
Property-Id
TWC-GeoIP-Country
X-Detected-As
TWC-GeoIP-LatLong
Webcakes-App-Version
X-CCM
X-Locale
X-Www-Served-By
X-Varnish-Hits
X-Generated
X-SayCDN-TTL
X-Say-TTL
X-Site-Version
Webcakes-Region
X-Origin-Hint
Cross-Origin-Window-Policy
X-Amzn-Remapped-Content-Length
X-TNCMS
X-FB-TRIP-ID
X-Loop
X-Xfnlog-Site
Accept-Charset
GEO-INFO
X-R9-Blue-Green-Version
L5d-Success-Class
X-CS
X-Unique-Id
X-NCache
Cache-Name
Uber-Trace-Id
Viewport
X-Drupal-Cache-Tags
X-Trafficlayer-App-Name
X-Trafficlayer-App-Scope
Webserver
Time
Cache-Key
X-UA-Device-Type
X-Backend-TTL
X-CDN-Forward
X-Cache-Remote
Mime-Version
X-UnsetCookies
X-From
X-Mode
X-Origin-TTL
X-Forwarded-Host
VIX-Pulpo-Upstream-Status
X-Origin-CC
VIX-Pulpo-Node
Accept-Language
Rt-Fastcgi-Cache
X-Drupal-Cache-Contexts
Country
X-Cluster-Name
X-Newrelic-Synthetics
X-B3-Spanid
Odigeo-Trace-Id
X-Info
X-TT-TIMESTAMP
X-Microcachable
X-Whom
X-NGENIX-Cache
X-Edge-Location
X-CLOUD-TRACE-CONTEXT
X-Varnish-Cache-Hits
X-Magnolia-Registration
X-PERF
X-ApacheServer
ServedBy
Content-Disposition
X-Daa-Tunnel
X-Geo
X-EC-Lua
X-UPSTREAM-Address
Proxy-Connection
X-Zipkin-Id
X-Routing-Service
Ohc-Cache-HIT
Ohc-File-Size
X-Device-Type
X-Proxied
Cf-Ipcountry
X-Via-Fastly
X-No-Session
X-Uri
X-Request-UUID
X-D
X-Rewrite-Enabled
X-CF-Lambda-Fn
GEO-REGION-INFO
X-External-Request-Id
X-CF-Lambda-Version
X-Rocket-Build-Number
X-Connection-Hash
X-S
X-Sigma
X-Sigma-Backend
X-DPWN-IS-SECURE
X-Session-Fingerprint
T-Server
X-S-Cookie
X-ScT
X-Rojux
X-Date
AsisCache
BehaviorPad-Version
Mobile-Detection-Method
Meta-Geo-Continent
Apple-News-Services-Request-Url
Apple-News-Services-Host
Apple-News-Services-Handled
X-GeoIP-Country-Code
X-SRCache-Key
X-Geo-Header
Machine
Fastcgi-X-Cache-Version
Apple-News-Services-Parsed-Url
X-G
Content-Style-Type
MD5-Digest
X-Destination
Content-Script-Type
Rendered-Blocks
X-Region-Sid
X-VG-WebServer
X-VG-WebCache
VivaBuild
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
X-Twitter-Response-Tags
X-VG-TLSProxy
Viewtype
X-Application
X-Vdms-Version
X-Aed
Xc-Version
W
X-A-Dcw
X-A-Dam
X-A-Dgt
X-A-Wwc
X-Accel-Expires-Debug
X-A-Ccd
X-A
X-Trv-Group
X-B-Cookie
X-ARC
X-Transaction
HitType
Geo-Info
X-PHP-Host
X-C
User-Cache-Control
X-Labrador-Cache-Channel
X-Backend-State
X-TrackingId
Environment
X-Agile
X-Epic-Correlation-Id
X-Hit
HA-Ipaddr
X-Wikidot-Static-Cache
X-Auto-Login
X-Wikidot-Backend
X-Thanos
X-Developers
Locid
X-SIPLIST1
CDCHOST
X-Cache-Debug
X-Contensis-Viewer-Groups
IsBot
Section-Io-Cache
X-Cache-ASPX
X-WebServer
X-CGP
X-Logging-Id
Server-Cache-Control
Powered-By
Gh-Request-Id
X-VC-Cache
X-Eu-Site
X-CUA
X-Varnish-Authentication
X-App-Name
X-Bip
X-Distil-CS
X-Agile-Id
X-Agile-Age
X-Render-Time
X-Real-IP
Fastly-Soc-X-Request-Id
X-Tumblr-Pixel-3
Ha-Gx-Prefs
Server-Surrogate-Control
X-GoCache-CacheStatus
X-Nc
X-Cache-Time
X-Dispatcher-Server
X-Debug-Cache-Fetch
X-Cache-URL
X-Cdn-Srv
X-Block-Status
X-Cache-Backend
X-Cache-Info
X-Cache-Bucket
X-Clara-WADP
X-Cms-Context
X-BBXSRF
X-Debug-Log
X-Debug-Cookies
X-Debug-Cache-Store
X-Core-Mission
X-Debug-Cache-Expiry
X-Azure-Ref
X-Instart-Isnd
X-Servername
X-Urbn-Site-Id
X-WADP-Cache
X-Webstats-RespID
Access-Control-Request-Headers
X-Rebelmouse-Cache-Control
X-Urbn-Context-Path
X-TT-LOGID
X-SVT-ORM-RULES
X-Sucuri-Cache
X-SVT-ORM-VERSION
X-Swa-Ws
X-Trace-Id
Fastly-SSL
IBM-Web2-Location
X-User
X-TH-Server
X-VServer
X-We-Are-Hiring
Fastly-SIE
Countrycode
X-LI-UUID
X-LI-Proto
X-Clientip
Memcached
X-FW-Version
X-Li-Fabric
X-Li-Pop
X-Server-W
X-Request-URI
X-IN-APIGATEWAY
X-Hnp-Log
X-IN-APIGATEWAYSSL
Fastly-SWR
X-Key
X-Irp-Debug
X-Hash
X-GeoIP-City
X-Fetched-On
X-Fastly-Cache
X-Gen-Mode
X-Generated-In
X-Generation-Time
X-Micro-Cache
X-Ms-Request-Id
X-Owner
X-OVcl-Cache
X-Proxy-Upstream
X-Rebelmouse-Surrogate-Control
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-OVcl
X-Origin-Expires
X-Nginx-Cache-Key
X-Ms-Version
X-NodeID
X-NX-Host
X-Origin-Date
X-Distributor
X-Gamma-Serve
Cache-Host
Server-Int
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
True-Client-Country-4JS
Server-ID
AKAMAI
RNT-Machine
Request-EU
Request-Country
RNT-Time
Fastly-Backend-Name
Mail-Subject
X-Varnish-Beresp-Grace
Web-Mar-Node
Cdncip
Locale
Country-Code
Heartbleed
Kp-EeAlive
X-AK-Request-ID
We-Hiring
V-Age
Cdnsip
X-Oneagent-Js-Injection
X-Is-Gdpr
X-Variation
X-Generated-On
X-NU-AKA-ACS-Version
X-Up
X-Platform-Server
X-Matched-Rule
X-TA-CDN-Provider
X-Req
X-Reboot
X-Service
X-ServiceProvider
X-Thinkindot-L3
X-Trafficlayer-App-Version
Adler-Geo
X-Old-Content-Length
X-Level-Front-Cache
X-Has-Esi
X-Internal-Host
X-Cache-Tags
Platform
X-Nginx-Cache
Is-Eu
ServerName
X-JWT-State
Wxu-Next-Region
Server-Host
X-Core-Value
Thinkindot-CacheControl
Thinkindot-Control
Wxu-Next-Hostname
Wxu-Next-Commit
PFcat
Thinkindot-CacheControl-Type
FNAC-ModuleRouting
Filterid
X-App-Version
X-SERVER
Cache-Hits
X-Location
X-S-Maxage
X-Response-By
X-Lb-Id
X-Air-Hostname
RequestId
X-B3-Parentspanid
X-Var-Ttl
X-Parent-Response-Time
X-Cache-Expired-At
X-Refresh
X-Tb-Optimization-Total-Bytes-Saved
X-CSRF-TOKEN
Pragrma
Group
S-Cnection
X-NC
Memory
X-Tec-Api-Version
ProcessTime
X-Tec-Api-Origin
X-Tec-Api-Root
X-Ua
X-CF-Powered-By
Powered-By-ChinaCache
X-Pjax-Url
X-Wa
X-B3-SpanId
X-Cdn-Forward
X-BACKEND-TTL
Origin
User-Agent
X-Server-IP
X-CSRF-Token
X-Pf-Uncompressing
SRV
X-Correlation-ID
X-Sucuri-ID
X-Varnish-Cacheable
X-Cdn-Request-ID
Media-Length
TTL
PICS-Label
Geoip-Latitude
X-NWS-UUID-VERIFY
X-Via-CDN
Geoip-City
X-Vcl-Version
X-COUNTRY
GeoIp-Country-Code
X-NGINX-Cache
X-Unique-ID
X-Oracle-Dms-Rid
X-Sucuri-Id
X-Servedbyhost
X-Developer
Dnion-Transfer-Encoding
X-LAGOON
X-Sn-Servicetimems
X-Device-Os
X-Node-Id
X-Cdn-Origin
X-Cache-Grace
X-Ocache
X-Rocket-Nginx-Bypass
X-Webkit-CSP
SN
X-Litespeed-Cache
X-Varnish-Ttl
X-Via-Ucdn
Esi-Enabled
X-AIR-PT
On-Server
X-Reqid
M-TraceId
XServer
X-TIME
X-Request-Host
A
X-HS-Status
X-MSEdge-Features
X-MSEdge-Flight
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
X-Planisys-CDN-Cache
X-Policy
X-FORWARDED-FOR
X-Cache-Status-Check
Cloudfront-Viewer-Country
Cdn
Hostname
X-Request-Start
X-Azure-Ref-OriginShield
X-Oss-Hash-Crc64ecma
X-Oss-Server-Time
HostName
X-Oss-Storage-Class
X-Oss-Object-Type
X-Oss-Request-Id
X-Fastly-Country-Code
X-Cache-Ttl
Who
Rt-Proxy-Cache
X-Beluga-Record
X-Beluga-Node
X-Beluga-Response-Time
X-Beluga-Status
Resin-Trace
X-Beluga-Trace
X-Beluga-Cache-Status
X-VHOST
X-Ftr-Cache-Host
X-ServedByHost
Host-ID
X-Varnish-URL
X-Method
GeoIP-Country-Code
Magicmarker
X-VCL-Version
NtCoent-Length
CF-Cached-On
X-Ratelimit-Remaining
X-DC
Ttl
X-Zone
X-LiteSpeed-Cache-Control
GeoIP-Latitude
X-Bc
Pics-Label
X-APP
MIME-Version
Tcn
X-Fastly-Backend-Reqs
X-Varnish-Url
X-Slack-Backend
Cteonnt-Length
GeoIP-City
Load-Balancing
X-RPS
X-Svr
X-Be
X-RSL
X-RPM
X-DI
X-DB
X-DSS
X-DW
X-Action
X-Newrelic-App-Data
Ohc-Response-Time
X-VarnishDD-TTL
X-PF-Uncompressing
Amp-Access-Control-Allow-Source-Origin
WebServer
X-Ftr-Request-Id
X-Ratelimit-Limit
DSUID
X-SRV
X-PJAX-URL
X-Swift-Error
Pramga
Arc-Country
X-Cache-FS-Status
X-Server-Time
Vix-Hermes-Req-Id
X-Skip-Cache
X-Processor
X-Dispatch
X-PAYTM-SRV-ID
X-FPC
CACHE
Release
X-MServer
X-VCT
X-Tid
X-ND-Cache
Processtime
X-BE
X-ABtesting
X-Dynatrace
X-Hp-Ccpa-Warning
Fastly-Drupal-HTML
X-Flog
X-DevSite-Last-Modified
X-Hello
X-Dynatrace-Js-Agent
Servername
X-WR-MODIFICATION
N-Cache
Cdn-Request-Time
X-ID
X-Edge-Server
Cdn-Host
X-Served-From
Cache-Provider
X-HostName
X-Aicache-OS
X-Configured-By
X-Frame-Option
X-Bc-Bl
X-Amzn-Remapped-Date
X-Ftr-Dc
X-SD-PageType
X-Upstream-Ct
X-LB-ID
CDN
X-Amzn-Remapped-Connection
X-Ftr-Balancer
Dynatrace
Pagetype
CF-IPCountry
X-Fastly-Cache-Hits
X-Ftr-Backend-Server
X-Snapshot-Date
Lfy
X-WA
X-Branch-Name
X-Ftr-Realm
X-Ftr-Backend
SD-X-WS
X-Upstream-Ht
Requestid
X-StackifyID
X-CACHE-AGE
L
X-Apw-Access-Action
X-Cache-Id
X-Varnish-Beresp-TTL
X-Request-Url
V-Cache
X-Apw-Access-Object
Proxy-Firewall
X-ZONE
X-SN
X-Apw-Hits
X-Cc-Req-Id
X-Cc-Via
X-Edge-IP
D-Cc-Upstream
X-VC
Warning
X-Apw-Access-Token
X-Compress-Hint
X-SB
X-Backend-Host
Section-Io-Origin-Status
Section-Origin-Responded
X-WPE-Loopback-Upstream-Addr
WZWS-RAY
Section-Io-Origin-Time-Seconds
Section-Io-Id
X-BC
X-Check-Cacheable
WP-Super-Cache
X-Request-URL
X-Powered-Y
X-Via-NSCOPI
X-Worker
X-ServerName
X-App
Lb
X-ElasticPress-Search
Backend-Name
Correlation-Id
X-Fastly-Cache-Status
X-Release