Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
X-XSS-Protection
CF-RAY
Cf-Request-Id
CF-Cache-Status
Last-Modified
Accept-Ranges
Link
Pragma
Expect-CT
ETag
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Cache-Status
X-Generator
X-Request-ID
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Content-Security-Policy
Content-Encoding
X-CDN
X-Envoy-Upstream-Service-Time
Status
Feature-Policy
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
X-AspNetMvc-Version
X-Xss-Protection
Access-Control-Max-Age
X-Via
Upgrade
Keep-Alive
X-Ws-Request-Id
X-Ua-Compatible
X-Turbo-Charged-By
X-Age
X-AH-Environment
X-Robots-Tag
Request-Context
X-Proxy-Cache
EagleId
X-Cache-Group
X-Backend
Server-Timing
X-Hacker
X-Amz-Request-Id
Report-To
X-Server
X-Amz-Id-2
Host-Header
X-Server-Powered-By
X-UA-Device
Grace
X-Nginx-Cache-Status
X-Dns-Prefetch-Control
X-Varnish-Cache
X-LiteSpeed-Cache
X-Rq
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Swift-SaveTime
X-Page-Speed
Cf-Railgun
X-Pingback
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Amz-Version-Id
NEL
X-OneAgent-JS-Injection
Xkey
X-WebKit-CSP
X-Backend-Server
X-Cache-Spec
Allow
X-Host
X-Vhost
EagleEye-TraceId
X-CST
X-Device
X-Server-Id
Surrogate-Control
Request-Id
X-Dispatcher
X-Kinja-Server-Push
X-Node
Content-Location
X-Response-Time
X-Akam-SW-Version
Accept-CH
X-Ruxit-JS-Agent
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
Accept-CH-Lifetime
X-Template
X-Language
X-Ac
X-Application-Context
X-Country
X-Readtime
X-Mod-Pagespeed
X-Cache-Lookup
X-Cloud-Trace-Context
MS-Author-Via
X-Origin-Cache
Accept-Ch
X-B3-TraceId
Rating
X-Cnection
X-MS-InvokeApp
Accept-Ch-Lifetime
X-ORACLE-DMS-ECID
X-HW
X-Url
X-TtlSet
X-PC
X-Vname
X-Clacks-Overhead
X-ESI
X-GitHub-Request-Id
Edge-Control
X-ASPNET-VERSION
X-Trace
X-Sol
Response
X-Middleton-Display
X-Middleton-Response
Display
Pagespeed
X-Content-Type
X-FastCGI-Cache
X-Buckets
X-D2id
X-Vcap-Request-Id
Verso
Arr-Disable-Session-Affinity
X-Exp-Id
X-Use-Magma
X-Kinja
X-Kinja-Build
X-Kinja-Revision
X-GoogleNews-Bot
X-Kinja-Server
X-Exp-Variant
X-Cdn-Fetch
X-Varnish-TTL
X-Goog-Hash
X-Server-Name
X-Rack-Cache
Service-Worker-Allowed
X-Country-Code
X-Oneagent-Js-Injection
X-Navigation-Version
X-VARITI-CCR
X-Abt-Application-Version
X-Amz-Rid
X-ORACLE-DMS-RID
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
X-Cache-TTL
X-TTL
X-Client-IP
X-Powered-By-Plesk
SPRequestGuid
X-SharePointHealthScore
SPRequestDuration
SPIisLatency
X-Fastly-Request-ID
X-Release
X-MSEdge-Ref
X-Dw-Request-Base-Id
X-Element-Page-Cache
Fastly-Restarts
X-NF-Request-ID
X-Cached
X-Origin-Upstream-Status
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Webkit-CSP
Public-Key-Pins
RTSS
X-Px
AR-Request-ID
AR-ATIME
AR-CACHE
AR-PoweredBy
Ar-Sid
X-Edge
Fusion-Content-Id
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Component-Id
Fusion-Content-Source
Fusion-Source
Access-Control-Request-Method
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-LLID
X-Powered-CMS
X-Upstream
X-Ezoic-Cdn
X-Pinterest-Direct
Content-MD5
X-Jurisdiction
X-HP-Webp
X-Amz-Server-Side-Encryption
X-ECACHE
X-MCACHE
X-Mid
Charset
X-Content-Digest
X-Recruiting
S
X-Mg-S
X-Aspnetmvc-Version
X-PressLabs-Stats
Cache-Tag
MicrosoftSharePointTeamServices
X-Debug
X-Version
X-Ttl
Front-End-Https
Fastcgi-Cache
TCN
X-Content-Security-Policy-Report-Only
X-Grace
X-XRDS-Location
X-T
Filters
Cache-Tags
X-Kinsta-Cache
Edge-Cache-Tag
Server-Node
X-Forwarded-Proto
X-Id
X-Yandex-Sdch-Disable
X-Amzn-Trace-Id
X-Cache-Key
Powered-By-ChinaCache
X-Accel-Expires
Nginx-Cache
X-Logged-In
Surrogate-Key
X-Correlation-Id
Server-Name
X-Forwarded-For
X-Varnish-Age
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-DynaTrace
X-B3-Sampled
X-DIS-Request-ID
X-Hits
X-Request-Handler-Origin-Region
X-Server-ID
X-Microsite
X-Ser
TP-Cache
TP-L2-Cache
X-Request-Received
X-Request-Processing-Time
X-AppVersion
X-Activity-Id
X-Shield-Request-Id
X-Amz-Replication-Status
X-Az
X-Litespeed-Cache
X-FTR-Request-ID
X-HS-Cache-Config
X-HS-Hub-Id
X-HS-Content-Id
X-HS-Combine-CSS
X-F-Cache
Accept-Charset
X-GUploader-UploadID
X-Goog-Metageneration
X-Git-Hash
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Origin-Server
X-Respond-Thread
Nel
X-Hostname
X-Geo-Country
X-DataDome
X-LB-Cache
Section-Io-Cache
X-Upgrade-Enabled
X-Rid
X-Frontend
X-Cache-Age
X-Ruxit-Js-Agent
X-Mobile-URL
Cleartype
Access-Control-Allow-Method
Host
Healthy
Alternate-Protocol
Paypal-Debug-Id
X-Type
Cache
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-TEC-API-VERSION
ServerID
X-Content-Options
X-IPLB-Instance
MS-CV
X-AOL-HN
Payment
X-WebKit-CSP-Report-Only
X-App-Environment
X-Varnish-Backend
X-Whom
X-Request-Guid
X-Is-Crawler
X-TT
X-Flags
X-Signature
X-Route-Name
X-Providence-Cookie
X-Cache-Action
X-B-Cache
X-Aspnet-Duration-Ms
X-Debug-Info
X-VCache
X-Seen-By
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
Fastcgi-Useragent
X-Page-Id
X-Jobs
X-Mobile
X-Fastcgi-Cache
X-Source
X-N
X-XRDS-LOCATION
X-Cached-By
X-Load-Cache
X-NWS-LOG-UUID
X-Browser-Type
X-Akamai-Edgescape
X-Time
X-Via-JSL
X-RateLimit-Remaining
Version
X-FB-Debug
X-Cache-Operation
X-Cache-Rule
Viewport
DynaTrace
X-Response-Served-From
X-Rule
X-Original-Request-Id
X-Accel-Buffering
Refresh
DC
X-Zen-Fury
X-Proxy
X-Framework
X-Drupal-Cache-Tags
X-Daa-Tunnel
X-Tt-Trace-Host
X-ProcessESI
X-Instance
X-Cacheable-TTL
X-Tt-Trace-Tag
Realpath
X-RemovedCookies
Ms-Operation-Id
X-RTag
X-Real-IP
Referer-Policy
Access-Control-Request-Headers
X-Region
X-Cache-Time
X-Node-Name
X-UUID
X-HTML-Minification-Powered-By
X-Contextid
X-Distributor
X-FW-Hash
X-FW-Dynamic
X-Page-View
X-FW-Serve
X-FW-Server
X-FW-Type
X-FW-Static
X-L-Path
X-Environment-Context
X-Yottaa-Optimizations
X-Drupal-Cache-Contexts
X-Yottaa-Metrics
X-Cache-Expired-At
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
Eomportal-Instance
X-Wix-Request-Id
X-B
Liferay-Portal
GEO-INFO
Node
X-Cluster-Name
X-Tumblr-User
Countrycode
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-G
X-Tumblr-Pixel
X-Cache-Control
X-Amz-Meta-S3cmd-Attrs
X-Content-Powered-By
X-IPS-LoggedIn
X-User-Agent
SRV
X-Cache-Hit
Webserver
X-Tumblr-Pixel-2
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
Server-Info
Section-Io-Id
Section-Io-Origin-Status
From-Origin
Protected
X-Ratelimit-Limit
X-Revision
X-App-Server
X-Protected-By
X-Oracle-Dms-Rid
X-Pass-Why
Ec-Rule-Version
X-Backend-Name
Cache-Status
X-Cache-Server
Frame-Options
X-Hyper-Cache
X-FireWall-Port
X-Handled-By
X-ES-SERVER
X-Mode
X-RN-RSRV
X-Endurance-Cache-Level
X-UPSTREAM-Address
Retry-After
Meta-Geo
X-Hl-Ver
X-Via-CDN
X-Locale
X-Adobe-Content
X-Soup
X-Storage
X-Adobe-Loc
X-Site-Version
X-FB-TRIP-ID
X-Forwarded-Host
X-NYM-Debug-Backend
X-Human
X-Www-Served-By
Decoy-Debug-TTL
Property-Id
Fastly-SSL
Webcakes-App-Version
Decoy-Debug-Status
Country
Decoy-Debug-Key
Cache-Tv-Group
X-Cache-Grace
X-Varnishpool
CF-IPCountry
TWC-Locale-Group
TWC-GeoIP-Country
Webcakes-Region
X-Section
X-Be
TWC-Privacy
X-Pubstack
X-Web-Node
X-Access
X-Format
TWC-GeoIP-LatLong
X-Origin-Hint
TWC-Connection-Speed
Webcakes-App-Name
TWC-Device-Class
X-FW-Version
X-BYPASS-REASON
X-Labrador-Cache-Channel
X-OCL
X-PCL
X-ApacheServer
Selected-Fe
Azure-SiteName
Azure-RegionName
Azure-SlotName
Azure-Version
Cache-Name
X-PERF
X-PHP-Host
X-Timing-Wait
X-SayCDN-TTL
X-TT-LOGID
X-UA-Device-Type
X-Uri
X-Say-TTL
X-Say-Cacheable
X-Proxy-Build
X-Proto
X-ProxyCache-Key
X-ProxyCache-Status
X-Redis-Cache
Azure-InstanceId
X-Origin-Date
X-FTR-Backend
X-Country-Code-Real
X-FTR-Backend-Server
X-FTR-Cache-Status
X-FTR-Realm
X-FTR-DC
S-Cnection
X-FTR-Balancer
X-Qloud-Router
X-No-Session
X-LAGOON
X-Server-W
X-Sql-Count
X-WA-Info
X-Via-Fastly
X-Sql-Duration-Ms
X-AIR-PT
X-S-Maxage
X-TNCMS
X-Hosted-By
X-Status
X-R9-Blue-Green-Version
Mn-Server-Ip
X-LJ-Flow-ID
X-AWS-Id
X-VWS-Id
X-Loop
X-FTR-Expires
X-Request-Time
X-Cache-Var-Map
X-Cache-TTL-Remaining
X-Cache-Var
X-Cluster
Cache-Hits
X-Ratelimit-Remaining
X-Storefront-Renderer-Rendered
X-Zipkin-Id
X-Proxied
X-Xfnlog-Site
X-Routing-Service
X-CCM
X-Dynatrace
X-ShardId
X-MP-GENERATED-AT
X-Alternate-Cache-Key
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-ShopId
X-Shopify-Stage
X-Air-Hostname
X-Rendered-As
AMP-Access-Control-Allow-Source-Origin
X-Is-Bot
Xserver
X-Detected-As
X-Webkit-Csp
X-Amzn-RequestId
X-EdgeConnect-Cache-Status
X-Cache-Host
X-Cdn
X-Amz-Apigw-Id
X-Amzn-Remapped-Content-Length
X-SRV
X-Info
Apigw-Requestid
X-Device-Type
X-Dc
X-B3-Traceid
X-Microcachable
X-Tec-Api-Origin
X-Tec-Api-Root
SD-X-WS
X-Nginx-Cache
X-Varnish-Ttl
X-Tec-Api-Version
X-Unique-Id
X-Cache-Backend
X-Time-Microsecs
X-Cache-Enabled
X-Backend-TTL
Tracecode
X-Content-Age
X-ServerID
X-Platform
X-Debug-IsConnected
X-Varnish-Server
X-Debug-IsPreview
X-GEO
X-Azure-Ref
X-Erf-Stays-Bingo-Pdp-Web
Amp-Access-Control-Allow-Source-Origin
X-DynaTrace-JS-Agent
X-Backend-Host
DSUID
X-Varnish-Grace
X-APP-VERSION
X-Sucuri-ID
X-NewRelic-App-Data
Uber-Trace-Id
X-Tb
X-GG-Cache-Date
X-Oss-Storage-Class
X-Oss-Hash-Crc64ecma
X-ID
X-Oss-Request-Id
X-Oss-Server-Time
X-Oss-Object-Type
Arc-Version
X-Correlation-ID
PB-PID
PB-RID
Akamai-GRN
X-BCube-Filmed-By
Backend
X-Cache-Remote
X-Akamai-Transformed
X-Magnolia-Registration
X-ATG-Version
X-Proxy-Cache-Status
X-Origin-Response-Time
Rendered-Blocks
X-Destination
X-Device-Os
Path
Pramga
MD5-Digest
Instruction
Fastcgi-X-Cache-Version
Expiry
DCR-Processing-Time-Ms
Lfy
Machine
Mobile-Detection-Method
Meta-Geo-Continent
SR-User-Adfree
Odigeo-Trace-Id
X-Connection-Hash
X-Cache-NE
X-Aed
X-CF-Lambda-Fn
X-A-Wwc
X-Application
X-ARC
X-B-Cookie
X-External-Request-Id
X-Varnish-Cache-Hits
X-CF-Lambda-Version
X-A-Dgt
X-Trace-Id
Thinkindot-CacheControl-Type
X-D
Thinkindot-CacheControl
Thinkindot-Control
X-A
X-A-Dcw
X-A-Dam
X-A-Ccd
T-Server
X-Trv-Group
X-Location
X-Session-Fingerprint
CACHE
X-S
X-Vdms-Path
X-Rojux
X-Request-UUID
DCR-Decision-By
X-Matched-Rule
X-Vtex-Processado-Em
X-S-Cookie
X-PAYTM-SRV-ID
Xc-Version
X-ScT
X-Vdms-Version
X-Thinkindot-L3
X-Level-Front-Cache
X-Generated-On
X-From
X-SRCache-Key
X-PBS-Appsvrname
X-Fetched-On
X-Vtex-Remote-Cache
X-Origin-TTL
X-Rewrite-Enabled
X-VG-WebServer
X-Processor
X-VG-WebCache
X-Generation-Time
X-Origin-CC
X-RCS-CacheZone
X-Adobe-Source
X-CSRF-Token
ServedBy
Wxu-Next-Commit
Wxu-Next-Hostname
X-Reqid
Ssr
X-Request-URI
X-Request-Start
Magicmarker
Ha-Gx-Prefs
HA-Ipaddr
Gh-Request-Id
Fastly-Backend-Name
X-SVT-ORM-RULES
X-Sn-Servicetimems
Host-ID
X-Skip-Cache
Pagetype
X-Wikidot-Backend
X-VServer
Locid
L
L5d-Success-Class
PFcat
X-User
X-VarnishDD-TTL
BehaviorPad-Version
Release
X-GeoIP
X-Has-Esi
X-HN
X-Thanos
X-Cdn-Origin
X-CGP
X-Csrf-Jwt
X-GeoIP-City
X-Tumblr-Pixel-3
X-FC-Vary-Parameters
X-Generated-In
X-Developers
X-Geo-Header
X-SVT-ORM-VERSION
X-Cache-Info
X-Cache-Date
X-Swa-Ws
X-Eu-Site
X-Micro-Cache
X-Mvc-Supplant-Cachable
X-Node-Id
X-OVcl-Cache
X-OVcl
X-Azure-Ref-OriginShield
X-Backend-State
X-HS-Content-Campaign-Id
X-Bip
X-Cache-Bucket
X-Wikidot-Static-Cache
X-Irp-Debug
X-JWT-State
X-Is-Gdpr
X-Owner
Wxu-Next-Region
X-Cache-PHP
X-Cache-NGX
X-NC
CacheControlHeader
Cache-Host
X-Varnish-Hostname
AKAMAI
DB-Nickname
C-Via
Cf-Device-Type
X-Ms-Version
X-Ms-Request-Id
X-Nginx-Cache-Key
User-Cache-Control
X-Var-Ttl
X-Policy
Apple-News-Services-Handled
On-Server
Apple-News-Services-Parsed-Url
X-Host-Name
Apple-News-Services-Host
Rt-Fastcgi-Cache
X-Envoy-Decorator-Operation
Server-Host
X-CUA
X-Request-Host
X-Core-Value
X-Cms-Context
UCS
V-Age
Server-Hostname
X-Developer
Sever-Int
Server-Ext
X-Fastly-Backend
Content-Disposition
NGX
X-Generated-By
X-Cache-Tags
CloudFront-Viewer-Country
X-Origin-Expires
Cf-Bgj
X-IP
X-Debug-Cache
X-Scheme
X-Fastly-Cache
Apple-News-Services-Request-Url
X-Clientip
X-Method
X-Varnish-Hits
CDCHOST
X-Varnish-Beresp-Grace
X-Block-Status
X-Cache-Id
X-Cache-Expires
X-Cache-Debug
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Branch-Name
X-Varnish-Url
X-Varnish-Remaining-TTL
X-Clara-WADP
X-DPWN-IS-SECURE
X-Servername
X-SIPLIST1
X-Hnp-Log
X-Gzip
X-Li-Fabric
X-Li-Pop
X-NWS-UUID-VERIFY
X-CS
X-Loc
X-LI-UUID
X-GoCache-CacheStatus
X-Old-Content-Length
X-NU-AKA-ACS-Version
X-Dispatcher-Server
X-Variation
X-DefHash
X-Esi-Check
X-Fmm-Version
X-TX-ID
X-Gen-Mode
X-Origin
X-DefElseHash
X-VG-TLSProxy
Platform
Origin
NM-Fastcgi-Cache
Adler-Geo
X-TrackingId
Web-Mar-Node
Vix-Hermes-Req-Id
True-Client-Country-4JS
X-Platform-Server
Location
Fastly-SWR
Fastly-SIE
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-Ratelimit-Reset
IsBot
Is-Eu
X-WADP-Cache
X-Varnish-Beresp-Status
X-Varnish-Beresp-Ttl
X-App-Version
X-B3-Spanid
X-Goog-Meta-Goog-Reserved-File-Mtime
CDN-PullZone
CDN-EdgeStorageId
CDN-CachedAt
X-Hash
X-Gamma-Serve
CDN-RequestCountryCode
Fastly-Drupal-HTML
X-NCache
CDN-Uid
X-Slack-Backend
CDN-RequestId
X-Response-By
CDN-Cache
X-Varnish-Cacheable
S-Rt
HostName
X-EC-Lua
X-Core-Mission
X-NAPM-TraceId
Url
Xkeyi7
Pics-Label
X-PF-Uncompressing
X-Refresh
X-Proxy-Cachei7
Cross-Origin-Window-Policy
X-URL
X-Aicache-OS
X-BBXSRF
X-Mvc-Supplant-OutputCached
X-CACHE-GROUP
X-Sucuri-Cache
N-Cache
X-Cdn-Forward
X-Cache-2
X-CDN-Forward
Content-Secure-Policy
X-B3-SpanId
Ohc-File-Size
X-Cache-ASPX
D-Cc-Upstream
X-LB-ID
X-Contensis-Viewer-Groups
X-Varnish-Authentication
X-Cc-Req-Id
Cteonnt-Length
X-Cc-Via
X-FireWall-Protection
Sid
X-Via-Poph
X-Svr
X-Via-Popv
X-Via-Popn
X-Unique-ID
X-TA-CDN-Provider
X-Wa
X-Error
Esi-Enabled
X-Tb-Optimization-Total-Bytes-Saved
X-DC
X-Servedbyhost
MIME-Version
X-Server-IP
X-Srv
X-Origin-Time
X-Nyt-Route
X-Cache-Config
X-API-Version
Source
X-Epic-Correlation-Id
X-TIME
X-FPC
X-Gdpr
X-CLOUD-TRACE-CONTEXT
X-Webkit-CSP-Report-Only
Hostname
Geo-Info
GeoIp-Country-Code
HitType
Geoip-Latitude
XServer
X-SN
X-VC
Ohc-Cache-HIT
X-RateLimit-Limit
Req-Svc-Chain
Server-Ttl
X-Webstats-RespID
X-SB
X-NodeID
X-TraceId
X-Cs
X-LI-Proto
X-NGINX-Cache
Who
X-Fastly-Request-Id
Server-ID
X-HS-Status
X-VCL-Version
X-Planisys-CDN-Rules
X-LiteSpeed-Cache-Control
X-Planisys-CDN-Cache
X-SD-PageType
X-Planisys-CDN-TTL
X-Check-Cacheable
Country-Code
X-Nc
X-Ua
X-Esi
X-BBC-Edge-Cache-Status
Svr
Kp-EeAlive
X-Render-Time
Cmstype
SID
Cmsid
EpKe-Alive
X-HOST
Request-ID
VivaBuild
X-Viewer-Country
X-Ftr-Cache-Host
X-Auto-Login
X-Served-From
Tcn
X-Vgn-Hpd-Reason
Viewtype
X-Worker
X-UA
X-Dynatrace-Js-Agent
NtCoent-Length
X-RAMCache
X-DW
Cache-Key
A
X-RSL
ProcessTime
X-CSRF-TOKEN
Resin-Trace
X-CACHE-KEY
Cache-Provider
X-RPS
X-RPM
X-DB
X-DI
X-DSS
X-Vcl-Version
Server-Id
X-Li-Proto
GeoIP-Country-Code
CDN
X-Cluster-Node
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Hcs-Proxy-Type
X-TIM-N
GeoIP-Latitude
M-TraceId
Upgrade-Insecure-Requests
X-Newrelic-Synthetics
Cross-Origin-Opener-Policy
TDXMobile
Processtime
X-Action
Arc-Country
X-CF-Powered-By
X-App
X-Internal-Host
X-Air-Source
X-Geo
X-FTR-Cache-Host
X-Fpc
Datacenter
X-Oss-Cdn-Auth
OT-Force-Account-Verify
CF-Cached-On
Mime-Version
X-ServedByHost
X-WA
WZWS-RAY
X-Vc
X-BBC-Origin-Response-Status
X-FORWARDED-FOR
X-HITS
X-HostName
X-Lb-Id
Cdn
X-MSEdge-Features
X-Service
X-MSEdge-Flight
X-Pinterest-Sli-Latency-Threshold
X-Cache-Tag
X-BACKEND-TTL
X-ND-Cache
X-Via-PopH
Proxy-Connection
X-Via-PopV
X-Dw-Trace-Id
X-Via-PopN
X-Fastly-Backend-Reqs
X-Pinterest-Sli-Response-Type
X-Pinterest-Sli-Endpoint-Name
X-Client-Ip
X-CACHE-AGE
Filterid
X-IN-APIGATEWAY
X-Flog
X-Hello
X-IN-APIGATEWAYSSL
X-Parent-Response-Time
Srv
Dnion-Transfer-Encoding
X-ABtesting
X-Via-NSCOPI
FSS-Cache
X-Forwarded-Site
W
X-Presslabs-Stats
URI
DataCenter
Vha6-Origin
X-Pf-Uncompressing
NGB
X-Oracle-DMS-ECID
X-Acc-Rdl
X-Acc-Debug-Context
CountryCode
X-SaId
PICS-Label
X-Edge-Location
X-MiniProfiler-Ids
Media-Length
X-NGENIX-Cache
X-Cdn-Request-ID
X-Akamai-Request-ID
X-Akamai-Pragma-Client-IP
X-JoinUs
X-PHP-Backend
X-LiteSpeed-Tag
X-Request-URL
Cf-Ipcountry
X-Extlb
Epwk-X-Cache
LB
X-Ms-Meta-Originalurl
Inserted-Into-Cache-At
Surrogated-Key
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-Proxy-Upstream
X-Region-Sid
X-Req
X-VC-Cache
X-UnsetCookies
X-PJAX-URL
X-Pad
We-Hiring
Memcached
X-Accel-Expires-Debug
X-Bc-Bl
X-Depends-On
X-Date
Mail-Subject
X-Ms-Meta-Staticbatchstarttime
X-Akamai-ERRuleID
X-Csrf-Token
X-Acquia-Site
X-Swift-Error
X-Varnish-Beresp-TTL
X-Vcache
X-ElasticPress-Search
X-ElasticPress-Query
X-Via-SSL
X-Traceid
X-B3-Parentspanid
X-Via-Edge
X-Akamai-ERPolicy
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Request-Url
Content-Script-Type
Edge-Copy-Time
Content-Style-Type
X-Acquia-Application-Trace
X-Provided-By
X-ZONE
X-Sigma
X-Tid
X-Sigma-Backend
Environment
X-Rocket-Build-Number
X-Zone
Env
X-Snapshot-Date
X-APP
X-Redis-Count
Time
Phost
Akamai-Age-Ms
X-Redis-Duration-Ms
NnCoection
Xet-Cookie
X-C
Ohc-Response-Time
X-Debug-Cache-Fetch
X-Debug-Cache-Store
X-Litespeed-Cache-Control
X-ServerName
Memory
X-Storefront-Renderer-Verified