Threat Level: green Handler on Duty: Manuel Humberto Santander Pelaez

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
X-Frame-Options
Strict-Transport-Security
X-Content-Type-Options
Accept-Ranges
Last-Modified
Pragma
CF-RAY
CF-Cache-Status
Link
X-Powered-By
ETag
X-XSS-Protection
Expect-CT
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
X-UA-Compatible
X-Cache-Hits
X-Amz-Cf-Pop
X-Amz-Cf-Id
Referrer-Policy
X-Served-By
X-Varnish
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Download-Options
X-AspNet-Version
Alt-Svc
Access-Control-Allow-Credentials
X-Runtime
X-Xss-Protection
X-Drupal-Cache
X-Adblock-Key
X-Check
Content-Security-Policy-Report-Only
X-Generator
X-Cacheable
X-Cache-Status
X-Permitted-Cross-Domain-Policies
Timing-Allow-Origin
X-DNS-Prefetch-Control
X-Template
X-Language
X-Iinfo
X-Content-Security-Policy
Content-Encoding
Status
X-FRAME-OPTIONS
X-AspNetMvc-Version
X-Buckets
X-Request-ID
X-Kinja-Server-Push
Xkey
Upgrade
X-Via
Access-Control-Expose-Headers
X-Turbo-Charged-By
Access-Control-Max-Age
Keep-Alive
X-Drupal-Dynamic-Cache
X-Cache-Group
X-Pass-Why
X-Age
EagleId
X-Backend
X-Envoy-Upstream-Service-Time
X-Robots-Tag
X-Ua-Compatible
X-Amz-Request-Id
X-Amz-Id-2
X-Page-Speed
X-Pingback
X-Server-Powered-By
X-AH-Environment
X-Server
X-UA-Device
X-Proxy-Cache
X-Hacker
X-CDN
Request-Context
X-Nginx-Cache-Status
X-Swift-CacheTime
X-Swift-SaveTime
Grace
X-Varnish-Cache
Ali-Swift-Global-Savetime
X-Cdn
P3p
X-LiteSpeed-Cache
Cf-Railgun
Server-Timing
Feature-Policy
X-Amz-Version-Id
X-Device
X-WebKit-CSP
X-Server-Id
X-OneAgent-JS-Injection
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Rq
X-Ac
X-Cnection
EagleEye-TraceId
Report-To
X-Cloud-Trace-Context
Request-Id
X-Response-Time
X-Backend-Server
X-Host
Content-Location
X-Node
X-Readtime
X-Origin-Cache
X-Vhost
X-Cache-Lookup
X-Application-Context
X-ORACLE-DMS-ECID
X-DataDome
X-Dispatcher
X-Ruxit-JS-Agent
NEL
X-ORACLE-DMS-RID
X-Rack-Cache
X-Origin-Upstream-Status
X-HW
Surrogate-Control
X-Dns-Prefetch-Control
Rating
X-Country-Code
X-Clacks-Overhead
Allow
X-Country
X-Url
X-FTR-Request-ID
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-DynaTrace
X-Instart-Request-ID
X-MS-InvokeApp
Fusion-Component-Id
Fusion-Content-Id
Fusion-Source
Fusion-Content-Source
Fusion-Template-Id
X-Goog-Hash
X-Vname
X-TtlSet
X-PC
X-Varnish-TTL
X-B3-TraceId
X-TTL
Pinterest-Generated-By
Verso
X-Powered-By-Plesk
Public-Key-Pins
X-Px
RTSS
Edge-Control
X-Mod-Pagespeed
X-ESI
Response
X-Middleton-Display
X-Middleton-Response
X-Sol
Display
X-Ah-Environment
X-VARITI-CCR
SPRequestGuid
X-Exp-Variant
X-D2id
X-Exp-Id
X-Kinja-Server
X-Use-Magma
X-Kinja-Revision
X-GoogleNews-Bot
X-Cdn-Fetch
X-Kinja
X-Kinja-Build
X-SharePointHealthScore
Accept-Ch-Lifetime
X-Recruiting
X-Akam-SW-Version
X-CST
Service-Worker-Allowed
X-Vcap-Request-Id
SPRequestDuration
SPIisLatency
X-Version
X-Server-Name
X-GitHub-Request-Id
TCN
X-Powered-CMS
X-Navigation-Version
X-Abt-Application-Version
MS-Author-Via
X-Trace
X-Shard
Charset
X-Debug
Fastly-Restarts
Nginx-Cache
X-Aspnetmvc-Version
Realpath
X-Amz-Server-Side-Encryption
X-Amz-Rid
X-RateLimit-Remaining
X-Upstream
Accept-CH
Ar-Sid
AR-PoweredBy
AR-ATIME
AR-CACHE
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Forwarded-Proto
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-Ezoic-Cdn
X-NF-Request-ID
Front-End-Https
X-Cached
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-Goog-Stored-Content-Encoding
X-MSEdge-Ref
DynaTrace
Arr-Disable-Session-Affinity
Access-Control-Request-Method
Pagespeed
X-Shield-Request-Id
Content-MD5
AR-Request-ID
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Mrf-Item-Lastmod
X-Mrf-Section-Lastmod
X-VCache
X-FTR-Cache-Status
X-Country-Code-Real
X-FTR-Expires
MicrosoftSharePointTeamServices
X-XRDS-Location
S
X-Amz-Meta-S3cmd-Attrs
X-Goog-Storage-Class
X-T
X-Fastly-Request-ID
Paypal-Debug-Id
X-Id
X-DynaTrace-JS-Agent
X-FTR-DC
X-FTR-Backend
X-FTR-Realm
X-FTR-Backend-Server
X-FTR-Balancer
X-Varnish-Age
X-Ser
ServerID
Accept-Ch
X-Via-JSL
X-Client-IP
X-Grace
X-Content-Type
X-Accel-Expires
X-Correlation-Id
X-Dw-Request-Base-Id
X-Forwarded-For
Edge-Cache-Tag
Fastcgi-Cache
X-Hits
X-Amzn-Trace-Id
X-Fastcgi-Cache
X-Content-Digest
Powered
X-Frontend
X-DIS-Request-ID
AMP-Access-Control-Allow-Source-Origin
X-N
X-Mobile-Rewrite
PB-PID
X-FTR-Cache-Host
PB-RID
Arc-Version
X-HS-Hub-Id
X-HS-Content-Id
X-Vcache
Pinterest-Version
X-Pinterest-Rid
Server-Name
X-Logged-In
X-Server-ID
TP-L2-Cache
TP-Cache
X-Request-Processing-Time
X-Request-Received
X-Microsite
X-Kinsta-Cache
X-Request-Handler-Origin-Region
X-Cache-Hit
X-GUploader-UploadID
X-Zen-Fury
X-FastCGI-Cache
X-Time
X-Type
X-Az
X-Rid
X-AppVersion
X-Activity-Id
X-IPLB-Instance
Healthy
X-LB-Cache
Backend-Timing
X-Analytics
X-Revision
Retry-After
X-User-Agent
X-Cache-Age
X-Whom
X-Srv
X-B3-Sampled
X-Node-Name
FilterID
Server-Node
X-RateLimit-Limit
X-NWS-LOG-UUID
X-Hp-Webp
Alternate-Protocol
Cache-Tag
X-SERVER
Accept-Charset
X-F-Cache
Cache-Status
X-Akamai-Edgescape
X-Content-Options
X-Cache-Rule
X-Webkit-CSP
X-Content-Security-Policy-Report-Only
NR-ENABLED
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Cache-2
X-Kong-Upstream-Latency
X-Content-Powered-By
DC
X-Kong-Proxy-Latency
MS-CV
X-Cluster
X-FB-Debug
VIX-Pulpo-Upstream-Status
X-AOL-HN
X-Tumblr-Pixel
X-Amzn-RequestId
X-Tumblr-Pixel-0
X-Amz-Apigw-Id
X-Instance
VIX-Pulpo-Node
X-Debug-Info
X-Tumblr-User
Access-Control-Allow-Method
Tracecode
X-Jobs
X-Varnish-Grace
Refresh
X-App-Environment
X-PHP-Backend
Surrogate-Key
X-B
X-Page-Id
X-Forwarded-Host
X-Framework
Source
Fastcgi-Useragent
X-Request-Guid
X-Cache-TTL
Actual-Object-TTL
X-Seen-By
X-App-Server
Host
X-Cache-Operation
X-Mobile-URL
X-FW-Serve
X-FW-Hash
X-FW-Server
X-FW-Static
X-FW-Type
Frame-Options
X-Cache-Control
X-Geo-Country
X-TA-CDN-Provider
X-Cached-By
X-Hostname
Cleartype
X-Pad
X-Host-Name
X-Cache-Key
X-Signature
X-B-Cache
Upgrade-Insecure-Requests
X-BCube-Filmed-By
X-Git-Hash
X-Mobile
X-Element-Page-Cache
X-WebKit-CSP-Report-Only
X-Response-Served-From
NGB
X-Varnish-Backend
X-Ttl
Xserver
X-ATG-Version
X-GeoIP
X-RemovedCookies
WPE-Backend
X-UA-Device-Type
X-ProcessESI
Filters
X-Tumblr-Pixel-2
X-TT
GEO-INFO
Ms-Operation-Id
Cache-Tv-Group
X-RTag
X-Amz-Replication-Status
Eomportal-Instance
X-HS-Cache-Config
X-RequestSource
X-Tumblr-Pixel-1
X-Handled-By
X-Drupal-Cache-Tags
X-Daa-Tunnel
Webserver
From-Origin
X-Cacheable-TTL
Payment
X-Adobe-Content
X-Origin-Server
X-Adobe-Loc
X-EdgeConnect-Cache-Status
X-TT-TIMESTAMP
X-TX-ID
X-XRDS-LOCATION
X-Cache-Remote
X-Wix-Request-Id
X-Cache-TTL-Remaining
X-Status
Datacenter
X-Presslabs-Stats
Liferay-Portal
X-FW-Dynamic
X-Esi
Cache
X-WA-Info
X-Acc-Meta-Resource-Type
X-Hyper-Cache
X-Region
X-Edge-Location
X-Contextid
X-Ratelimit-Reset
Version
X-Cache-Action
Viewport
X-Content-Age
X-Cache-NE
X-B3-Traceid
X-CF-Powered-By
X-Varnish-Hostname
PageSpeed
X-PressLabs-Stats
X-Storage
Accept-CH-Lifetime
X-Akamai-Transformed
X-Cache-Server
X-HS-Combine-CSS
Ohc-File-Size
X-Varnish-Server
X-ES-SERVER
X-RN-RSRV
Load-Balancing
X-Path-Route
X-Accel-Buffering
X-Cache-Var-Map
Meta-Geo
X-Cache-Var
Host-Header
X-IP
X-Xfnlog-Site
Cache-Tags
X-Proxy
Country
X-Via-Fastly
X-Cache-Enabled
X-Viewer-Country
X-PCL
TWC-Privacy
X-NCache
X-Upgrade-Enabled
X-Access
X-Proto
X-Section
X-Origin
X-Varnish-Cache-Hits
X-Tumblr-Pixel-3
X-UnsetCookies
TWC-Connection-Speed
X-TNCMS
Rt-Fastcgi-Cache
X-Origin-Hint
Webcakes-Region
X-Cache-Config
X-Loop
Release
Property-Id
X-CCM
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-Device-Type
Vix-Hermes-Req-Id
TWC-Locale-Group
Webcakes-App-Version
X-Cache-Time
TWC-GeoIP-Country
DB-Nickname
TWC-GeoIP-LatLong
X-OCL
Cache-Name
X-Debug-Cache
TWC-Device-Class
Webcakes-App-Name
X-Drupal-Cache-Contexts
X-Labrador-Cache-Channel
X-EIG-Tracking-Id
X-FC-Vary-Parameters
X-From
X-Format
X-CS
X-Cluster-Node
Mn-Server-Ip
Ec-Rule-Version
S-Rt
Selected-Fe
X-Backend-TTL
X-Backend-Name
X-Hosted-By
X-Human
X-Timing-Wait
X-Rule
X-VCT
X-Vgn-Hpd-Reason
Cache-Hits
X-Www-Served-By
X-R9-Blue-Green-Version
X-Proxy-Build
X-Cache-Host
X-JoinUs
X-Cache-Grace
X-NGENIX-Cache
X-Akamai-Request-ID2
X-Origin-Response-Time
DSUID
X-Akamai-Request-ID
S-Cnection
X-PERF
X-Locale
Decoy-Debug-TTL
X-Web-Node
X-ApacheServer
X-Site-Version
X-Varnish-Hits
X-Trace-Id
X-Time-Microsecs
X-Goog-Meta-Goog-Reserved-File-Mtime
Decoy-Debug-Status
Azure-SiteName
Azure-SlotName
Azure-RegionName
Azure-InstanceId
Ohc-Cache-HIT
Azure-Version
X-Generated
X-Hit
Decoy-Debug-Key
X-FireWall-Port
X-Ua
X-NewRelic-App-Data
X-OVcl-Cache
X-Real-IP
X-Rendered-As
X-OVcl
Cache-Key
X-S
Origin-Cache-Control
Origin-Edge-Control
L5d-Success-Class
X-Pubstack
Server-Info
Time
X-Redis-Cache
X-Trafficlayer-App-Scope
X-Trafficlayer-App-Name
Now
X-FW-Version
X-SS-Set-Cookie
X-Litespeed-Cache
X-Upstream-HT
X-Upstream-CT
Fastcgi-X-Cache-Version
OT-Force-Account-Verify
Fastly-SSL
X-Origin-CC
X-Origin-TTL
X-ServerID
X-Cluster-Name
Access-Control-Request-Headers
X-APP-VERSION
ServedBy
Mime-Version
X-Load-Cache
Cteonnt-Length
X-Alternate-Cache-Key
Origin
X-FB-TRIP-ID
X-ShardId
X-ShopId
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-UUID
X-Shopify-Stage
X-App-Version
X-Parent-Response-Time
X-Tec-Api-Origin
Hostname
X-Tec-Api-Version
X-Tec-Api-Root
NtCoent-Length
X-CACHE-KEY
X-Soup
X-VG-WebCache
X-GoCache-CacheStatus
X-Rocket-Nginx-Bypass
X-VG-TLSProxy
X-Upstream-Proxy
Accept-Language
Machine
X-Is-Bot
X-Tb
X-Uri
Nel
IBM-Web2-Location
NGX
Odigeo-Trace-Id
X-ECACHE
X-CSRF-TOKEN
X-No-Session
CF-IPCountry
X-BYPASS-REASON
X-MServer
X-Environment-Context
X-Info
X-L-Path
X-ProxyCache-Key
X-ProxyCache-Status
X-Node-Id
X-Oneagent-Js-Injection
X-Tt-Trace-Tag
A
Arc-Country
Apple-News-Services-Handled
Apple-News-Services-Request-Url
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
Uber-Trace-Id
Request-Country
X-External-Request-Id
X-DPWN-IS-SECURE
X-G
X-Hl-Ver
X-PAYTM-SRV-ID
X-Instart-Info
X-Developer
X-Detected-As
X-Cms-Context
X-CF-Lambda-Version
X-Connection-Hash
X-D
X-Destination
X-Date
X-Region-Sid
X-Request-UUID
X-VG-WebServer
X-Twitter-Response-Tags
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
Xc-Version
X-Worker
X-Trv-Group
X-Transaction
X-Rojux
X-Rewrite-Enabled
X-S-Cookie
X-ScT
X-SRCache-Key
X-Server-Time
X-CF-Lambda-Fn
X-B-Cookie
Memcached
MD5-Digest
Meta-Geo-Continent
Mobile-Detection-Method
Rendered-Blocks
Node
GEO-REGION-INFO
Fly-Request-Id
Cache-Prefix
BehaviorPad-Version
Content-Script-Type
Content-Style-Type
Fly-Cache
Cross-Origin-Window-Policy
Request-EU
Rt-Proxy-Cache
X-A-Wwc
X-A-Dgt
X-Accel-Expires-Debug
X-Aed
X-ARC
X-AIR-PT
X-A-Dcw
X-A-Dam
T-Server
ServerName
Viewtype
VivaBuild
X-A-Ccd
X-A
AsisCache
X-Application
X-B3-Parentspanid
X-Geo
Proxy-Connection
Request-Time
X-B3-SpanId
X-NC
X-Nginx-Cache
Backend-Name
X-Endurance-Cache-Level
We-Hiring
X-Cdn-Srv
X-SIPLIST1
X-SVT-ORM-VERSION
X-Device-Os
X-SVT-ORM-RULES
X-Nc
X-Compress-Hint
X-WADP-Cache
X-Clara-WADP
X-Cache-Bucket
X-Has-Esi
Fastly-Soc-X-Request-Id
X-JWT-State
X-Is-Gdpr
Srv
X-B3-Spanid
IsBot
X-Amzn-Remapped-Content-Length
Mail-Subject
N-Cache
X-Developers
X-UA
X-S-Maxage
Akamai-GRN
X-PHP-Host
User-Cache-Control
X-Generated-On
X-Generation-Time
X-Geo-Header
X-Generated-By
X-Fetched-On
X-Eu-Site
X-Fastly-Cache
X-Azure-Ref-OriginShield
X-Azure-Ref
X-Guploader-Uploadid
Wxu-Next-Region
X-Amz-Meta-Cache-Control
X-Hash
X-GeoIP-City
X-Auto-Login
X-Backend-Host
X-Epic-Correlation-Id
X-Dispatch
X-Clientip
X-Dispatcher-Server
X-CUA
X-Debug-Cache-Expiry
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-CGP
X-Cache-FS-Status
X-BBXSRF
X-Backend-Url
X-Bip
X-Distributor
X-Distil-CS
X-C
X-IN-APIGATEWAY
X-Magnolia-Registration
X-Wikidot-Backend
X-Wikidot-Static-Cache
CDCHOST
X-Block-Status
X-Webstats-RespID
X-WebServer
X-Var-Ttl
X-Variation
X-VC-Cache
X-We-Are-Hiring
X-Cache-Info
X-Cdn-Origin
X-Proxy-Cache-Status
X-Proxy-Upstream
X-Request-URI
X-Sn-Servicetimems
X-NX-Host
X-Hnp-Log
X-Debug-Cookies
X-Debug-Log
X-ElasticPress-Search
X-Gen-Mode
X-User
X-Up
X-Location
Wxu-Next-Hostname
X-Old-Content-Length
X-Origin-Date
X-LI-UUID
X-LI-Proto
X-Irp-Debug
X-Level-Front-Cache
X-Li-Fabric
X-Li-Pop
X-Origin-Expires
X-Owner
X-Service
X-Skip-Cache
X-Thanos
X-TrackingId
X-Server-IP
X-Request-Start
X-Platform-Server
X-Release
X-Reqid
X-IN-APIGATEWAYSSL
X-Reboot
Pramga
X-Via-CDN
Adler-Geo
Platform
Wxu-Next-Commit
Heartbleed
Served-By
Section-Io-Cache
RNT-Time
AKAMAI
PFcat
Gh-Request-Id
Ha-Gx-Prefs
HA-Ipaddr
Is-Eu
L
Pagetype
Content-Disposition
Countrycode
Server-Host
RNT-Machine
X-Ratelimit-Limit
X-Microcachable
X-NWS-UUID-VERIFY
SRV
X-SD-PageType
X-Swa-Ws
X-Qloud-Router
X-SayCDN-TTL
X-Matched-Rule
X-App-Name
X-Say-TTL
W
X-Servername
X-Nginx-Cache-Key
X-Urbn-Context-Path
X-Urbn-Site-Id
X-VServer
X-Svr
Magicmarker
X-Key
X-Method
X-Thinkindot-L3
Esi-Enabled
X-Lb-Id
X-Rebelmouse-Surrogate-Control
X-Say-Cacheable
X-Policy
SD-X-WS
X-RateLimit-Limit-Second
Thinkindot-CacheControl-Type
True-Client-Country-4JS
X-Backend-State
X-Generated-In
X-Cache-Id
Web-Mar-Node
X-RateLimit-Remaining-Second
Thinkindot-Control
Locale
Kp-EeAlive
Fastly-SWR
Fastly-SIE
Server-Int
X-Rebelmouse-Cache-Control
X-Core-Mission
Thinkindot-CacheControl
X-Cdn-Forward
X-Dc
Cache-Provider
X-Instart-Isnd
X-MSEdge-Features
X-Cache-URL
V-Age
X-ServiceProvider
X-Internal-Host
X-MSEdge-Flight
Resin-Trace
Server-ID
X-GEO
X-DC
X-VWS-Id
X-FPC
X-LJ-Flow-ID
Memory
X-Scheme
X-AWS-Id
Cdn-Request-Time
X-Edge-Server
Cdn-Host
X-Cache-Backend
X-Be
X-Processor
X-GDPR
REQUESTUUID
X-Mode
X-Org
X-Request-Time
Group
SS
X-NodeID
X-Servedbyhost
X-Wa
X-Hello
X-Flog
X-Pjax-Url
X-ABtesting
X-Datadome
X-CDN-Forward
Cache-Host
X-Server-W
X-Response-By
X-IPS-LoggedIn
X-Unique-ID
Country-Code
Cache-Cookie-Set-From
X-Page-Type
X-Ms-Version
X-Ms-Request-Id
Cache-Cookie-Set-Idcheck
X-Oss-Server-Time
X-Oss-Request-Id
X-Oss-Storage-Class
X-Oss-Object-Type
Cache-Cookie-Set-Lfrom
X-SN
X-VCL-Version
X-Oss-Hash-Crc64ecma
X-Ruxit-Js-Agent
X-Varnish-Beresp-Status
X-Oracle-Dms-Rid
X-Varnish-Beresp-Ttl
X-HS-Status
X-Varnish-Beresp-Grace
X-Routing-Service
X-Webkit-Csp
X-EC-Lua
X-Zipkin-Id
X-Proxied
Lfy
UCS
X-SRV
X-Via-Ucdn
X-Tb-Optimization-Total-Bytes-Saved
X-Ftr-Request-Id
PICS-Label
X-Session-Fingerprint
X-Zone
X-Dynatrace
X-URL
Ttl
X-Agile-Id
X-Cache-Debug
X-Agile-Age
X-Agile
X-COUNTRY
X-GRACE
X-DataStream-Cache-Status
Powered-By-ChinaCache
X-Logtrace-Id
SN
Ajk
X-MP-GENERATED-AT
X-RateLimit-Reset
X-Ratelimit-Remaining
X-Varnish-Beresp-TTL
X-PF-Uncompressing
X-7Graus-Varnish-XKeys
GeoIP-Latitude
GeoIP-City
X-Fastly-Country-Code
Proxy-Firewall
GeoIP-Country-Code
X-Pf-Uncompressing
X-Webapp-Samesite-None-Activated-N
GeoIp-Country-Code
Geoip-City
Geoip-Latitude
X-7Graus-Varnish-Cache-Control
ProcessTime
X-Sucuri-Id
X-Source
X-Cache-Miss-From
X-CSRF-Token
X-Sedo-Request-Id
X-APP
X-Grey
X-ZONE
Environment
Powered-By
X-Logging-Id
X-Cache-Category-Id
X-Unique-Id
X-HTML-Minification-Powered-By
XServer
X-NODE
X-Newrelic-Synthetics
X-Ftr-Cache-Host
Cdn
X-CLOUD-TRACE-CONTEXT
X-Bc
X-Sucuri-ID
X-TH-Server
X-Tt-Trace-Host
Pics-Label
M-TraceId
CACHE
X-Core-Value
X-DataStream-Origin-MEX-Latency
X-DataStream-MidMile-RTT
CF-Cached-On
X-Vcl-Version
X-Check-Cacheable
X-Edge
Fastly-Backend-Name
X-LiteSpeed-Cache-Control
X-Sucuri-Cache
X-Vdms-Version
WWW
X-Aicache-OS
X-Ftr-Realm
X-Ftr-Dc
X-Ftr-Balancer
X-Dynatrace-Js-Agent
X-Ftr-Backend
X-Ftr-Backend-Server
HostName
GW-Server
X-Sigma-Backend
X-Sigma
X-Mid
X-Rocket-Build-Number
X-AK-Request-ID
Cdncip
Requestid
X-RCS-CacheZone
X-Fastly-Backend-Reqs
Cdnsip
MIME-Version
Cf-Ipcountry
X-Planisys-CDN-TTL
LB
X-Swift-Error
X-MCACHE
X-Cache-Tag
X-Varnish-Ttl
X-LAGOON
X-FORWARDED-FOR
Pragrma
X-Shopify-Generated-Cart-Token
X-Planisys-CDN-Rules
X-Fstrz
X-Planisys-CDN-Cache
Amp-Access-Control-Allow-Source-Origin
X-UPSTREAM-Address
X-NGINX-Cache
X-Varnish-Url
X-ServedByHost
Ohc-Response-Time
X-Gannett-Site-Version
X-TT-LOGID
X-BC
X-Litespeed-Cache-Control
X-Via-NSCOPI
X-Secret
Lb
URI
X-WA
X-RSL
X-RPS
X-Cache-Ttl
X-BE
X-CDN-Cache
X-Action
X-PJAX-URL
X-RPM
X-DB
X-DW
X-DSS
X-DI
Dynatrace
X-SaId
X-ORACLE-APMCS-REQUEST-ID
X-ORACLE-APMCS-TAG
X-Varnish-Cacheable
On-Server
Host-ID
X-WR-MODIFICATION
TTL
X-GeoIP-Country-Code
X-ND-Cache
RequestUuid
WZWS-RAY
X-Correlation-ID
DataCenter
Is-Session-Tracking
Get-Access-Time
Server-Id
CDN
X-Upstream-Ht
X-Flow-Id
X-Fastly-Cache-Hits
X-Upstream-Ct
User-Agent
X-Nananana
X-Proxy-Cacherz
X-Fpc
X-Zalando-Child-Request-Id
X-Page-Impression-Id
X-Trafficlayer-App-Version
Xkeyrz
Xkeypdq
Inserted-Into-Cache-At
X-Gen-Id
X-Refresh
X-MID
X-Via-SSL
X-VC
X-Via-Edge
X-Served-From
Correlation-Id
Locid
Warning
X-SB
X-Dw-Trace-Id
X-Cf-Powered-By
X-Akamai-SSL-Client-Sid
X-Akamai-ERRuleID
X-Akamai-ERPolicy
X-Req
X-Pod
Thinkindot-Cache-Type
X-Amzn-Remapped-Date
X-Amzn-Remapped-Connection
Gannett-Cam-Experience-Id
Cneonction
X-ServerName
SID
X-Crawler
X-Bug-Bounty
HitType
Who
Processtime
X-ECache
X-Newrelic-App-Data
X-Request-URL
Xet-Cookie
RequestId
X-LB-ID
X-NU-AKA-ACS-Version
V-Cache
X-MiniProfiler-Ids
X-Gdpr
X-LiteSpeed-Tag