Threat Level: green Handler on Duty: Jim Clausing

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
X-XSS-Protection
CF-RAY
Cf-Request-Id
CF-Cache-Status
Last-Modified
Accept-Ranges
Link
Pragma
Expect-CT
ETag
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
Alt-Svc
X-Served-By
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Request-ID
X-Cache-Status
X-Generator
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Content-Security-Policy
Content-Encoding
X-CDN
X-Envoy-Upstream-Service-Time
Status
Feature-Policy
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
X-AspNetMvc-Version
X-Xss-Protection
Access-Control-Max-Age
X-Via
Upgrade
Keep-Alive
X-Ws-Request-Id
X-Ua-Compatible
X-Turbo-Charged-By
X-Age
X-AH-Environment
X-Robots-Tag
Request-Context
X-Proxy-Cache
EagleId
X-Cache-Group
Server-Timing
X-Backend
X-Hacker
X-Amz-Request-Id
Report-To
X-Server
X-Amz-Id-2
Host-Header
X-Server-Powered-By
X-UA-Device
X-Nginx-Cache-Status
Grace
X-Dns-Prefetch-Control
X-Varnish-Cache
X-LiteSpeed-Cache
X-Rq
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Page-Speed
Cf-Railgun
X-Pingback
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
NEL
X-Amz-Version-Id
X-OneAgent-JS-Injection
Xkey
X-Cache-Spec
X-Backend-Server
Allow
X-Host
X-Vhost
EagleEye-TraceId
X-Device
X-CST
X-WebKit-CSP
X-Server-Id
Request-Id
Surrogate-Control
X-Dispatcher
X-Kinja-Server-Push
Accept-CH
X-Node
Content-Location
X-Response-Time
X-Akam-SW-Version
Accept-CH-Lifetime
X-Ruxit-JS-Agent
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
P3p
X-Template
X-Language
X-Ac
X-Application-Context
X-Country
X-Readtime
X-Cloud-Trace-Context
X-Mod-Pagespeed
X-Cache-Lookup
MS-Author-Via
X-Origin-Cache
X-B3-TraceId
X-MS-InvokeApp
X-Cnection
Rating
X-ORACLE-DMS-ECID
X-HW
Accept-Ch
X-Url
X-TtlSet
X-Vname
X-PC
X-Clacks-Overhead
Edge-Control
X-ESI
X-GitHub-Request-Id
Accept-Ch-Lifetime
X-FastCGI-Cache
X-ASPNET-VERSION
X-Trace
Display
Pagespeed
X-Middleton-Display
X-Sol
X-Middleton-Response
Response
X-Content-Type
X-Buckets
X-D2id
X-Vcap-Request-Id
X-Exp-Variant
X-Use-Magma
X-Kinja-Build
X-GoogleNews-Bot
X-Cdn-Fetch
X-Kinja-Revision
X-Kinja-Server
Arr-Disable-Session-Affinity
X-Kinja
X-Exp-Id
Verso
X-Varnish-TTL
X-Goog-Hash
X-Server-Name
X-Rack-Cache
Service-Worker-Allowed
X-Country-Code
X-Oneagent-Js-Injection
X-Navigation-Version
X-VARITI-CCR
X-ORACLE-DMS-RID
X-Abt-Application-Version
X-Amz-Rid
X-Pinterest-Rid
Pinterest-Version
Pinterest-Generated-By
X-Webkit-CSP
X-Cache-TTL
X-Client-IP
X-TTL
X-Powered-By-Plesk
X-SharePointHealthScore
SPRequestGuid
SPRequestDuration
SPIisLatency
X-Release
X-Fastly-Request-ID
X-Dw-Request-Base-Id
X-MSEdge-Ref
X-Element-Page-Cache
Fastly-Restarts
X-NF-Request-ID
X-Cached
X-Origin-Upstream-Status
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
Public-Key-Pins
RTSS
X-Px
AR-PoweredBy
AR-Request-ID
Ar-Sid
AR-CACHE
X-Edge
AR-ATIME
Fusion-Component-Id
Fusion-Content-Source
Fusion-Deployment-Id
Fusion-Source
Fusion-Template-Id
Fusion-Content-Id
X-SRCache-Fetch-Status
X-SRCache-Store-Status
Access-Control-Request-Method
X-LLID
X-Powered-CMS
X-Pinterest-Direct
X-Upstream
Content-MD5
X-Ezoic-Cdn
X-HP-Webp
X-Jurisdiction
X-Amz-Server-Side-Encryption
X-ECACHE
X-MCACHE
X-Mid
X-Content-Digest
S
X-Aspnetmvc-Version
X-Recruiting
X-Mg-S
Charset
Cache-Tag
X-PressLabs-Stats
MicrosoftSharePointTeamServices
X-Debug
TCN
X-Version
X-Ttl
Front-End-Https
Fastcgi-Cache
X-Grace
X-XRDS-Location
X-Content-Security-Policy-Report-Only
X-T
Filters
Cache-Tags
X-Kinsta-Cache
Edge-Cache-Tag
Server-Node
X-Yandex-Sdch-Disable
X-Forwarded-Proto
X-Id
X-Amzn-Trace-Id
X-Cache-Key
Powered-By-ChinaCache
X-Accel-Expires
Nginx-Cache
X-Logged-In
X-Forwarded-For
Surrogate-Key
X-Correlation-Id
X-Varnish-Age
Server-Name
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-DynaTrace
X-B3-Sampled
X-DIS-Request-ID
X-Server-ID
X-Hits
X-Microsite
X-Request-Handler-Origin-Region
X-Ser
X-Request-Received
X-Request-Processing-Time
TP-Cache
TP-L2-Cache
X-AppVersion
X-Activity-Id
X-Az
X-Amz-Replication-Status
X-Shield-Request-Id
X-FTR-Request-ID
X-Litespeed-Cache
X-HS-Cache-Config
X-HS-Hub-Id
X-HS-Content-Id
X-HS-Combine-CSS
X-F-Cache
Accept-Charset
X-Git-Hash
X-Goog-Stored-Content-Length
X-Goog-Metageneration
X-Goog-Storage-Class
X-Goog-Generation
X-GUploader-UploadID
X-Goog-Stored-Content-Encoding
X-Origin-Server
X-Respond-Thread
X-Geo-Country
X-LB-Cache
X-DataDome
X-Upgrade-Enabled
X-Hostname
Section-Io-Cache
X-Rid
X-Cache-Age
X-Ruxit-Js-Agent
X-Frontend
Cleartype
X-Mobile-URL
Host
Access-Control-Allow-Method
Paypal-Debug-Id
Cache
Healthy
Alternate-Protocol
X-IPLB-Instance
X-Type
MS-CV
ServerID
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-AOL-HN
X-Content-Options
X-Whom
X-App-Environment
X-Varnish-Backend
X-Cache-Action
X-Aspnet-Duration-Ms
X-Is-Crawler
X-TT
X-Route-Name
X-Request-Guid
X-Providence-Cookie
X-Flags
Payment
X-WebKit-CSP-Report-Only
X-VCache
X-B-Cache
X-Debug-Info
X-Signature
Fastcgi-Useragent
X-Seen-By
X-Page-Id
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Jobs
X-Mobile
X-Source
X-XRDS-LOCATION
X-N
X-Cached-By
X-NWS-LOG-UUID
X-Load-Cache
X-Browser-Type
X-Time
X-Akamai-Edgescape
X-RateLimit-Remaining
X-Via-JSL
Nel
Version
X-FB-Debug
X-Cache-Rule
X-Cache-Operation
DynaTrace
Viewport
X-Fastcgi-Cache
X-Response-Served-From
X-Rule
X-Accel-Buffering
X-Original-Request-Id
X-Daa-Tunnel
Refresh
X-Framework
X-Proxy
X-Drupal-Cache-Tags
DC
X-Tt-Trace-Tag
Realpath
X-ProcessESI
X-Tt-Trace-Host
X-RemovedCookies
X-Zen-Fury
X-Cacheable-TTL
Referer-Policy
X-Instance
X-Region
Access-Control-Request-Headers
Ms-Operation-Id
X-RTag
X-Real-IP
X-HTML-Minification-Powered-By
X-UUID
X-Cache-Time
X-Node-Name
X-Drupal-Cache-Contexts
X-FW-Hash
X-L-Path
X-Page-View
X-Environment-Context
X-FW-Dynamic
X-Distributor
X-FW-Type
X-FW-Server
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-FW-Static
X-FW-Serve
GEO-INFO
X-Cache-Expired-At
X-Contextid
Eomportal-Instance
X-Wix-Request-Id
X-B
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
Liferay-Portal
X-Cluster-Name
X-Tumblr-User
Node
Countrycode
X-G
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Cache-Control
X-Content-Powered-By
X-Amz-Meta-S3cmd-Attrs
X-User-Agent
X-IPS-LoggedIn
X-Cache-Hit
X-Tumblr-Pixel-2
Webserver
SRV
Server-Info
Protected
Section-Origin-Responded
Section-Io-Id
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
From-Origin
X-Ratelimit-Limit
X-App-Server
X-Revision
X-Protected-By
X-Oracle-Dms-Rid
Ec-Rule-Version
X-Pass-Why
X-Backend-Name
X-Cache-Server
Cache-Status
Frame-Options
X-Hyper-Cache
X-FireWall-Port
X-ES-SERVER
X-Endurance-Cache-Level
X-Handled-By
X-Hl-Ver
X-RN-RSRV
Retry-After
Meta-Geo
X-Mode
X-UPSTREAM-Address
X-Locale
X-Soup
X-Site-Version
X-Via-CDN
X-Adobe-Loc
X-FB-TRIP-ID
X-Adobe-Content
TWC-Locale-Group
Webcakes-App-Name
Webcakes-App-Version
TWC-Privacy
TWC-GeoIP-LatLong
Cache-Tv-Group
Property-Id
TWC-Connection-Speed
TWC-Device-Class
Webcakes-Region
X-Varnishpool
X-Origin-Hint
X-Www-Served-By
X-NYM-Debug-Backend
CF-IPCountry
Country
X-Forwarded-Host
X-Web-Node
X-Human
X-Cache-Grace
X-Storage
X-Be
TWC-GeoIP-Country
X-Labrador-Cache-Channel
X-Origin-Date
X-FW-Version
X-Format
X-BYPASS-REASON
X-PHP-Host
X-Proto
X-Redis-Cache
X-Pubstack
X-ProxyCache-Key
X-Proxy-Build
Azure-InstanceId
Azure-RegionName
Decoy-Debug-Status
Decoy-Debug-TTL
Selected-Fe
Fastly-SSL
Decoy-Debug-Key
X-Access
Azure-SiteName
Azure-SlotName
Azure-Version
Cache-Name
X-Section
X-ProxyCache-Status
X-Timing-Wait
X-FTR-Backend
X-TT-LOGID
X-Uri
X-FTR-Balancer
X-FTR-Backend-Server
X-Country-Code-Real
X-FTR-Realm
X-UA-Device-Type
X-FTR-DC
X-FTR-Cache-Status
S-Cnection
X-ApacheServer
X-OCL
X-Via-Fastly
X-No-Session
X-PCL
X-PERF
X-AIR-PT
X-SayCDN-TTL
X-Sql-Count
X-Server-W
X-Say-TTL
X-Say-Cacheable
X-Qloud-Router
X-WA-Info
X-Sql-Duration-Ms
X-S-Maxage
X-FTR-Expires
X-AWS-Id
X-VWS-Id
X-LJ-Flow-ID
X-R9-Blue-Green-Version
X-Hosted-By
Mn-Server-Ip
X-Status
X-Loop
X-TNCMS
X-LAGOON
X-Request-Time
Cache-Hits
X-Ratelimit-Remaining
X-Cache-TTL-Remaining
X-Cluster
X-Cache-Var
X-Cache-Var-Map
X-Shopify-Stage
X-ShopId
X-Sorting-Hat-PodId
X-ShardId
X-Routing-Service
X-Xfnlog-Site
X-Sorting-Hat-ShopId
X-Dynatrace
X-Proxied
X-Storefront-Renderer-Rendered
X-MP-GENERATED-AT
X-Alternate-Cache-Key
X-Zipkin-Id
X-CCM
X-Is-Bot
AMP-Access-Control-Allow-Source-Origin
X-Rendered-As
X-Air-Hostname
Xserver
X-Detected-As
X-Webkit-Csp
X-EdgeConnect-Cache-Status
X-Cdn
X-Amz-Apigw-Id
X-Cache-Host
X-Amzn-RequestId
X-Amzn-Remapped-Content-Length
X-Unique-Id
X-SRV
X-Info
X-Device-Type
X-B3-Traceid
X-Dc
X-Microcachable
Apigw-Requestid
SD-X-WS
X-Nginx-Cache
X-Varnish-Ttl
X-Tec-Api-Root
X-Tec-Api-Origin
X-Tec-Api-Version
X-Cache-Backend
X-Time-Microsecs
X-Cache-Enabled
X-Backend-TTL
X-GEO
X-Content-Age
Tracecode
X-Platform
X-ServerID
X-Varnish-Server
X-Debug-IsConnected
X-Debug-IsPreview
Amp-Access-Control-Allow-Source-Origin
X-Azure-Ref
X-Erf-Stays-Bingo-Pdp-Web
X-Varnish-Grace
X-DynaTrace-JS-Agent
DSUID
X-Backend-Host
X-APP-VERSION
X-GG-Cache-Date
X-ID
X-Sucuri-ID
X-NewRelic-App-Data
X-Tb
X-Oss-Object-Type
X-Oss-Hash-Crc64ecma
X-Oss-Server-Time
X-Oss-Request-Id
X-Oss-Storage-Class
X-Correlation-ID
Arc-Version
PB-RID
Akamai-GRN
PB-PID
Uber-Trace-Id
X-Cache-Remote
Backend
X-BCube-Filmed-By
X-Akamai-Transformed
X-ATG-Version
X-Proxy-Cache-Status
X-Magnolia-Registration
X-Origin-Response-Time
CACHE
X-Varnish-Cache-Hits
Instruction
X-D
X-Level-Front-Cache
X-A-Ccd
X-A
Thinkindot-Control
Pramga
Lfy
X-SRCache-Key
Rendered-Blocks
X-Origin-TTL
T-Server
SR-User-Adfree
X-Fetched-On
X-Origin-CC
X-Connection-Hash
X-PAYTM-SRV-ID
X-Processor
X-External-Request-Id
X-CF-Lambda-Fn
X-Thinkindot-L3
Thinkindot-CacheControl-Type
X-PBS-Appsvrname
Machine
Thinkindot-CacheControl
Path
Xc-Version
DCR-Processing-Time-Ms
X-Trace-Id
X-Generation-Time
X-Location
DCR-Decision-By
X-Device-Os
Odigeo-Trace-Id
X-B-Cookie
MD5-Digest
X-Session-Fingerprint
X-Rewrite-Enabled
X-Destination
X-Cache-NE
X-ScT
X-Generated-On
X-Matched-Rule
Fastcgi-X-Cache-Version
X-S-Cookie
X-Rojux
X-S
Expiry
Meta-Geo-Continent
X-Request-UUID
X-A-Wwc
X-Vtex-Remote-Cache
X-Vtex-Processado-Em
X-CF-Lambda-Version
X-From
X-A-Dgt
X-Trv-Group
X-A-Dam
X-A-Dcw
X-VG-WebServer
Mobile-Detection-Method
X-VG-WebCache
X-Vdms-Version
X-Vdms-Path
X-Application
X-ARC
X-Aed
X-RCS-CacheZone
X-CSRF-Token
X-Adobe-Source
ServedBy
X-JWT-State
X-Varnish-Hostname
AKAMAI
Host-ID
Cf-Device-Type
X-Has-Esi
X-HN
X-FC-Vary-Parameters
X-GeoIP
Fastly-Backend-Name
L
X-Geo-Header
X-HS-Content-Campaign-Id
Pagetype
Locid
C-Via
PFcat
Cache-Host
CacheControlHeader
X-Irp-Debug
Magicmarker
X-Is-Gdpr
Gh-Request-Id
Wxu-Next-Hostname
X-VServer
X-VarnishDD-TTL
X-Azure-Ref-OriginShield
X-NC
X-Wikidot-Backend
X-Wikidot-Static-Cache
Release
X-Micro-Cache
BehaviorPad-Version
X-Request-Start
X-Developers
X-Bip
X-Sn-Servicetimems
DB-Nickname
X-SVT-ORM-RULES
X-Swa-Ws
X-Skip-Cache
X-Cdn-Origin
X-Cache-Bucket
X-Cache-Date
X-Tumblr-Pixel-3
X-Thanos
Wxu-Next-Region
X-Reqid
X-OVcl
X-OVcl-Cache
Ssr
X-Node-Id
X-Mvc-Supplant-Cachable
Wxu-Next-Commit
X-Owner
X-SVT-ORM-VERSION
X-GeoIP-City
X-Cache-PHP
X-Cache-NGX
X-Ms-Request-Id
X-Ms-Version
Server-Ext
On-Server
Server-Host
Sever-Int
Server-Hostname
L5d-Success-Class
X-Cache-Info
X-Backend-State
X-Eu-Site
NGX
X-Fastly-Cache
X-Host-Name
X-Fastly-Backend
Rt-Fastcgi-Cache
X-Developer
X-Cache-Tags
X-Nginx-Cache-Key
CDCHOST
X-User
X-IP
X-Policy
User-Cache-Control
X-Clientip
X-Var-Ttl
X-Cms-Context
X-Method
X-Debug-Cache
X-Varnish-Hits
X-Csrf-Jwt
X-Origin-Expires
Cf-Bgj
X-CUA
X-Generated-In
X-Core-Value
CloudFront-Viewer-Country
HA-Ipaddr
Ha-Gx-Prefs
X-Request-URI
UCS
Content-Disposition
X-Scheme
X-Request-Host
X-CGP
X-Generated-By
X-Varnish-Beresp-Grace
X-Esi-Check
X-Envoy-Decorator-Operation
X-Dispatcher-Server
X-WADP-Cache
X-DPWN-IS-SECURE
X-NWS-UUID-VERIFY
X-Clara-WADP
X-Variation
X-DefHash
X-TX-ID
X-Servername
X-DefElseHash
X-SIPLIST1
X-CS
X-Cache-Id
X-Cache-Expires
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Block-Status
X-Branch-Name
X-Cache-Debug
X-Varnish-Remaining-TTL
X-Ratelimit-Reset
X-Fmm-Version
Apple-News-Services-Request-Url
Origin
Platform
Apple-News-Services-Parsed-Url
Apple-News-Services-Handled
Apple-News-Services-Host
X-Hnp-Log
NM-Fastcgi-Cache
Location
IsBot
Is-Eu
Fastly-SWR
Fastly-SIE
X-Gzip
X-GoCache-CacheStatus
Adler-Geo
X-Li-Fabric
X-Rebelmouse-Cache-Control
X-Gen-Mode
V-Age
Web-Mar-Node
X-Rebelmouse-Surrogate-Control
X-TrackingId
X-Platform-Server
X-LI-UUID
X-Li-Pop
X-Origin
X-Loc
X-NU-AKA-ACS-Version
X-Old-Content-Length
X-Varnish-Beresp-Ttl
X-App-Version
X-B3-Spanid
X-Varnish-Beresp-Status
X-NCache
X-Response-By
X-Varnish-Cacheable
X-Slack-Backend
X-Varnish-Url
X-VG-TLSProxy
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Hash
X-Gamma-Serve
Vix-Hermes-Req-Id
True-Client-Country-4JS
CDN-EdgeStorageId
CDN-CachedAt
CDN-Cache
S-Rt
CDN-PullZone
Fastly-Drupal-HTML
CDN-Uid
CDN-RequestId
CDN-RequestCountryCode
X-NAPM-TraceId
Xkeyi7
X-Proxy-Cachei7
X-Refresh
HostName
X-PF-Uncompressing
X-EC-Lua
X-Core-Mission
Cross-Origin-Window-Policy
X-URL
X-CACHE-GROUP
X-Sucuri-Cache
N-Cache
X-Mvc-Supplant-OutputCached
Url
X-BBXSRF
Pics-Label
X-Aicache-OS
X-Cdn-Forward
X-Cache-2
Content-Secure-Policy
X-B3-SpanId
Ohc-File-Size
X-CDN-Forward
X-Varnish-Authentication
X-Cc-Req-Id
X-Cache-ASPX
X-Cc-Via
X-LB-ID
X-FireWall-Protection
X-Contensis-Viewer-Groups
D-Cc-Upstream
Cteonnt-Length
Sid
X-Via-Popn
X-Svr
X-Via-Poph
X-Via-Popv
X-DC
X-Error
X-TA-CDN-Provider
X-Servedbyhost
MIME-Version
X-Tb-Optimization-Total-Bytes-Saved
X-Wa
Esi-Enabled
X-Server-IP
X-Srv
X-TIME
X-Unique-ID
X-Cache-Config
X-Origin-Time
X-Nyt-Route
X-Gdpr
X-FPC
X-API-Version
Source
X-Webkit-CSP-Report-Only
X-SN
Geoip-Latitude
GeoIp-Country-Code
X-VC
Hostname
HitType
X-Epic-Correlation-Id
XServer
Ohc-Cache-HIT
X-RateLimit-Limit
X-NodeID
X-SB
X-TraceId
X-Webstats-RespID
Server-Ttl
Req-Svc-Chain
X-Cs
X-LI-Proto
Who
X-Fastly-Request-Id
X-NGINX-Cache
X-VCL-Version
X-SD-PageType
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
X-HS-Status
X-LiteSpeed-Cache-Control
Country-Code
X-Check-Cacheable
Server-ID
X-Planisys-CDN-Cache
X-Nc
Geo-Info
X-Ua
X-Esi
X-BBC-Edge-Cache-Status
Kp-EeAlive
X-Render-Time
Cmsid
EpKe-Alive
Cmstype
SID
NtCoent-Length
X-HOST
X-Served-From
Svr
X-Vgn-Hpd-Reason
X-Worker
X-Auto-Login
X-Ftr-Cache-Host
Request-ID
X-UA
X-Dynatrace-Js-Agent
X-RAMCache
A
X-Vcl-Version
X-Viewer-Country
Resin-Trace
Cache-Provider
Cache-Key
X-CSRF-TOKEN
X-DSS
X-DI
X-DW
X-RPM
X-RSL
X-RPS
ProcessTime
X-DB
X-CACHE-KEY
Viewtype
VivaBuild
CDN
M-TraceId
GeoIP-Country-Code
Server-Id
GeoIP-Latitude
X-Cluster-Node
X-Li-Proto
X-CCDN-Origin-Time
X-TIM-N
X-Hcs-Proxy-Type
X-CCDN-CacheTTL
X-Newrelic-Synthetics
Upgrade-Insecure-Requests
X-HostName
Arc-Country
X-Air-Source
Processtime
X-Action
Cross-Origin-Opener-Policy
X-App
TDXMobile
X-Internal-Host
X-CF-Powered-By
X-FTR-Cache-Host
X-Fpc
X-Oss-Cdn-Auth
Tcn
Datacenter
CF-Cached-On
X-CLOUD-TRACE-CONTEXT
OT-Force-Account-Verify
X-BBC-Origin-Response-Status
Mime-Version
X-ServedByHost
X-Geo
X-Vc
X-WA
X-FORWARDED-FOR
WZWS-RAY
X-HITS
X-Lb-Id
X-Dw-Trace-Id
X-Pinterest-Sli-Response-Type
X-Service
Cdn
X-MSEdge-Features
X-MSEdge-Flight
X-Pinterest-Sli-Latency-Threshold
X-Cache-Tag
X-Pinterest-Sli-Endpoint-Name
X-Via-PopN
X-Via-PopV
X-Via-PopH
X-ND-Cache
X-BACKEND-TTL
Proxy-Connection
Srv
X-Fastly-Backend-Reqs
X-CACHE-AGE
X-Client-Ip
X-Flog
X-Hello
X-Parent-Response-Time
Filterid
X-IN-APIGATEWAYSSL
X-IN-APIGATEWAY
X-ABtesting
Dnion-Transfer-Encoding
DataCenter
X-Presslabs-Stats
FSS-Cache
URI
X-Oracle-DMS-ECID
Vha6-Origin
X-Via-NSCOPI
NGB
W
X-Pf-Uncompressing
X-Forwarded-Site
X-Acc-Debug-Context
CountryCode
X-Acc-Rdl
X-Edge-Location
PICS-Label
X-Request-URL
X-LiteSpeed-Tag
X-JoinUs
X-Akamai-Request-ID
X-NGENIX-Cache
X-PHP-Backend
Media-Length
X-Akamai-Pragma-Client-IP
X-Cdn-Request-ID
X-SaId
X-MiniProfiler-Ids
X-Extlb
Cf-Ipcountry
X-ElasticPress-Search
X-Accel-Expires-Debug
X-PJAX-URL
X-Pad
X-Depends-On
X-Proxy-Upstream
X-Region-Sid
X-VC-Cache
X-Req
X-Date
X-Bc-Bl
LB
Epwk-X-Cache
X-Ms-Meta-Staticbatchstarttime
Mail-Subject
Memcached
We-Hiring
Surrogated-Key
X-Ms-Meta-Originalurl
Content-Style-Type
X-Acquia-Application-Trace
Content-Script-Type
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Via-SSL
X-Traceid
X-Request-Url
X-Csrf-Token
X-Via-Edge
X-B3-Parentspanid
X-Akamai-ERPolicy
X-Akamai-ERRuleID
X-Vcache
X-Acquia-Site
Inserted-Into-Cache-At
X-Varnish-Beresp-TTL
Edge-Copy-Time
X-Swift-Error
X-ElasticPress-Query
X-Provided-By
X-ZONE
X-Sigma
X-Sigma-Backend
X-Tid
X-Rocket-Build-Number
Env
X-Zone
X-APP
X-UnsetCookies
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
Akamai-Age-Ms
Environment
Phost
X-Storefront-Renderer-Verified
X-Redis-Count
X-Redis-Duration-Ms
X-Snapshot-Date
Xet-Cookie
Ohc-Response-Time
X-ServerName
X-Litespeed-Cache-Control
X-Debug-Cache-Fetch
Time
NnCoection
X-C
Memory
X-Debug-Cache-Store