Threat Level: green Handler on Duty: Rick Wanner

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
Strict-Transport-Security
X-Frame-Options
X-Content-Type-Options
Last-Modified
Link
CF-Cache-Status
Cf-Request-Id
Accept-Ranges
ETag
CF-RAY
Expect-CT
Pragma
X-Powered-By
X-Cache
Via
Age
X-XSS-Protection
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Xss-Protection
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
X-Served-By
X-FRAME-OPTIONS
X-Download-Options
X-Timer
X-Request-Id
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-Adblock-Key
X-AspNet-Version
X-Permitted-Cross-Domain-Policies
Alt-Svc
X-Runtime
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-DNS-Prefetch-Control
X-Check
X-Cache-Status
X-Generator
CF-Ray
X-Cacheable
X-Iinfo
Timing-Allow-Origin
X-Envoy-Upstream-Service-Time
X-Request-ID
Feature-Policy
X-Ua-Compatible
Status
X-Content-Security-Policy
X-Drupal-Dynamic-Cache
Content-Encoding
X-AspNetMvc-Version
Access-Control-Expose-Headers
X-CDN
Upgrade
X-XSS-PROTECTION
P3p
Access-Control-Max-Age
X-Via
X-Cache-Group
X-Robots-Tag
Server-Timing
X-UA-Device
Request-Context
Keep-Alive
X-Amz-Request-Id
X-AH-Environment
X-Dns-Prefetch-Control
X-Turbo-Charged-By
X-Backend
X-Proxy-Cache
X-Amz-Id-2
X-Ws-Request-Id
X-Age
Host-Header
X-Server-Powered-By
X-Hacker
X-Server
X-Rq
X-Vhost
EagleId
X-Varnish-Cache
Grace
X-Amz-Version-Id
X-Dispatcher
X-LiteSpeed-Cache
Cf-Edge-Cache
Allow
X-Akamai-Path-Stats
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Swift-CacheTime
X-Swift-SaveTime
X-Device
Ali-Swift-Global-Savetime
X-WebKit-CSP
X-Nginx-Cache-Status
X-Page-Speed
X-Aws-Lambda-Call-Status
X-Host
Accept-CH
X-Node
X-OneAgent-JS-Injection
X-Pingback
Cf-Railgun
X-Cache-Spec
Request-Id
EagleEye-TraceId
X-Server-Id
Surrogate-Control
X-Akam-SW-Version
X-Backend-Server
X-Cache-Lookup
X-Response-Time
X-Readtime
Accept-CH-Lifetime
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-HW
Content-Location
X-Content-Security-Policy-Report-Only
X-Application-Context
X-Trace
Rating
X-Cloud-Trace-Context
Fastly-Restarts
X-Country
X-Url
X-WebKit-CSP-Report-Only
X-Clacks-Overhead
X-MS-InvokeApp
X-Edge
Accept-Ch-Lifetime
X-Amz-Server-Side-Encryption
X-Rack-Cache
Edge-Control
X-Nginx-Upstream-Cache-Status
X-B3-TraceId
X-PC
X-Ruxit-JS-Agent
X-Vname
X-TtlSet
X-Content-Type
X-Mod-Pagespeed
X-ESI
X-Vcap-Request-Id
X-Use-Magma
X-Kinja-Build
X-Oneagent-Js-Injection
X-Kinja-Server
X-Kinja
X-Exp-Id
X-Kinja-Revision
X-GoogleNews-Bot
X-D2id
X-Cdn-Fetch
X-Exp-Variant
X-GitHub-Request-Id
Xkey
Verso
X-Mcache
X-Amz-Rid
Cache-Tag
X-CST
X-VARITI-CCR
X-Powered-By-Plesk
X-Varnish-TTL
RTSS
Service-Worker-Allowed
X-ECACHE
X-FastCGI-Cache
X-Ruxit-Js-Agent
X-Navigation-Version
X-Upstream
X-Version
X-Abt-Application-Version
X-Cached
X-Client-IP
X-Dw-Request-Base-Id
X-Cnection
X-Ac
X-Px
X-Ttl
X-Element-Page-Cache
X-SharePointHealthScore
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Instrumentation
X-Server-Name
SPRequestGuid
Arr-Disable-Session-Affinity
Public-Key-Pins
X-Cache-TTL
SPIisLatency
SPRequestDuration
Display
Pagespeed
X-Sol
X-Middleton-Display
X-NWS-LOG-UUID
X-Country-Code
Permissions-Policy
X-Ser
Accept-Ch
X-RateLimit-Remaining
Response
X-Middleton-Response
X-Midtier
X-Edge-Location-Klb
X-Kinsta-Cache
X-Goog-Hash
X-Cache-Key
X-Forwarded-For
Content-MD5
X-SRCache-Fetch-Status
X-SRCache-Store-Status
Access-Control-Request-Method
X-NF-Request-ID
X-Correlation-Id
X-Shield-Request-Id
Front-End-Https
X-DataDome
X-MSEdge-Ref
X-Recruiting
X-HP-Webp
Cf-Apo-Via
X-HP-Trace-Id
X-Jurisdiction
TP-Cache
TP-L2-Cache
Edge-Cache-Tag
AR-ATIME
AR-CACHE
AR-Request-ID
AR-SID
AR-PoweredBy
Nginx-Cache
X-T
X-Accel-Expires
MicrosoftSharePointTeamServices
X-Daa-Tunnel
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
X-Powered-CMS
X-RateLimit-Limit
TCN
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-Grace
X-Mg-S
X-Id
X-Content-Digest
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Hits
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Content-Id
Server-Node
X-HS-Hub-Id
X-Request-Received
Filters
X-Request-Processing-Time
Server-Name
X-Amzn-Trace-Id
X-Frontend
X-Distributor
X-Geo-Country
MS-Author-Via
S
Fastcgi-Cache
X-Protected-By
X-LLID
X-Language
Cache-Status
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Fastly-Request-Id
X-XRDS-Location
X-LB-Cache
X-PressLabs-Stats
X-Origin-Server
Cross-Origin-Opener-Policy
X-Ezoic-Cdn
Count-Hit
X-Fastcgi-Cache
Host
X-B3-Sampled
X-FB-Debug
X-Request-Handler-Origin-Region
X-Microsite
X-F-Cache
X-Seen-By
X-Page-Id
X-Git-Hash
X-Amz-Meta-S3cmd-Attrs
X-Forwarded-Proto
Filterid
X-Ua-Browser
X-Ab
Charset
Payment
X-Litespeed-Cache
X-VCache
X-ASPNET-VERSION
X-Cluster-Name
X-Cache-Age
X-Ratelimit-Reset
Surrogate-Key
X-TTL
Realpath
X-Rid
X-Origin-Cache
Accept-Charset
Cache-Tags
X-NGENIX-Cache
X-Template
Alternate-Protocol
X-Www-Served-By
Access-Control-Allow-Method
Retry-After
X-Webkit-Csp
X-Logged-In
X-AppVersion
X-Az
X-Activity-Id
X-Upgrade-Enabled
Cleartype
X-DIS-Request-ID
X-DynaTrace
X-App-Environment
X-Providence-Cookie
X-Is-Crawler
X-Varnish-Grace
X-Request-Guid
X-Route-Name
X-TT
X-Tb
X-Varnish-Backend
X-Flags
X-Amz-Replication-Status
X-Aspnet-Duration-Ms
X-Signature
X-B-Cache
X-B
X-Wix-Request-Id
X-Source
X-Type
X-Node-Name
X-Envoy-Decorator-Operation
DC
Paypal-Debug-Id
X-Hostname
ServerID
X-Drupal-Cache-Tags
Frame-Options
X-Fastly-Request-ID
X-Proxy
X-Debug
X-Revision
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Server-ID
X-Mobile
X-Contextid
Pinterest-Generated-By
X-Content-Options
Pinterest-Version
X-Pinterest-Rid
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Load-Cache
X-GUploader-UploadID
X-Cache-Rule
X-Goog-Generation
X-Goog-Metageneration
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Cache-Control
X-N
Amp-Access-Control-Allow-Source-Origin
X-Magnolia-Registration
Country
Refresh
X-Content
Node
X-Original-Request-Id
X-Whom
X-User-Agent
X-Response-Served-From
Referer-Policy
X-EdgeConnect-Cache-Status
Viewport
NGB
Access-Control-Request-Headers
X-Debug-IsPreview
X-Cache-TTL-Remaining
X-Cacheable-TTL
X-Debug-IsConnected
X-Environment-Context
X-L-Path
X-Framework
X-Adobe-Content
X-Adobe-Loc
X-Yottaa-Optimizations
VIX-Pulpo-Upstream-Status
X-Unique-Id
Uber-Trace-Id
Url
VIX-Pulpo-Node
X-Servername
X-Content-Powered-By
X-Yottaa-Metrics
X-Real-IP
X-Jobs
X-Page-View
X-G
X-Mid
X-Rendered-As
X-Status
X-Varnish-Server
Content-Disposition
X-Akamai-Request-ID2
X-Is-Bot
X-Cache-Time
X-Varnish-Age
X-Cache-Grace
X-XRDS-LOCATION
X-Oracle-Dms-Rid
X-Oracle-Dms-Ecid
X-RemovedCookies
X-NYM-Debug-Backend
X-ProcessESI
X-Instance
Akamai-GRN
X-Ratelimit-Remaining
Countrycode
X-Time
Srv
X-Drupal-Cache-Contexts
Version
X-Mg-Request-UUID
X-COUNTRY
X-Restarts
X-Via-JSL
X-Http-Reason
X-App-Server
X-Cache-Expired-At
X-Trace-Id
X-CDN-Forward
Accept-Language
X-Debug-Info
Protected
X-Cache-Hit
X-APP-VERSION
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-Pixel-1
Healthy
X-Hosted-By
X-IPLB-Instance
X-IPLB-Request-ID
X-Tumblr-User
X-Cache-Operation
Cross-Origin-Resource-Policy
X-Nginx-Cache-Key
X-Azure-Ref
X-Backend-Name
Section-Io-Cache
X-Ratelimit-Limit
X-Device-Type
Liferay-Portal
X-Akamai-Edgescape
Content-Secure-Policy
Backend
X-FW-Type
X-FW-Dynamic
X-FW-Static
X-FW-Hash
X-FW-Server
Fastcgi-Useragent
X-FW-Serve
Server-Info
X-Datadome
X-Tt-Logid
X-RTag
X-Cache-Action
MS-CV
X-Api-Version
Ms-Operation-Id
X-UPSTREAM-Address
X-SRV
Load-Balancing
X-RN-RSRV
X-Rule
X-Proxy-Cache-Status
X-Mobile-URL
Meta-Geo
X-Storage
X-Mode
X-Cache-NGX
X-VC-Cache
GEO-INFO
X-Varnish-Beresp-Grace
X-Content-Age
X-Redis-Cache
X-Shopify-Stage
X-Site-Version
X-Skip-Cache
X-ShopId
X-ShardId
X-Say-Cacheable
X-Say-TTL
X-SayCDN-TTL
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-VWS-Id
CF-IPCountry
X-Handled-By
X-Varnishpool
X-Varnish-Hostname
X-Sql-Count
X-Sql-Duration-Ms
X-Uri
X-Region
X-Proto
CDN-Uid
S-Rt
X-Adobe-Source
CDN-RequestId
CDN-RequestCountryCode
CDN-CachedAt
CDN-EdgeStorageId
CDN-PullZone
X-AWS-Id
X-Cache-Enabled
X-PCL
X-PHP-Backend
X-PHP-Host
X-OCL
X-No-Session
X-Cms-Context
X-Labrador-Cache-Channel
X-LJ-Flow-ID
CDN-Cache
X-Alternate-Cache-Key
X-UUID
X-Request-Time
X-ProxyCache-Status
X-ProxyCache-Key
X-Proxied
X-Proxy-Build
X-Routing-Service
X-Section
X-Urbn-Site-Id
X-Urbn-Context-Path
X-UA-Device-Type
X-Timing-Wait
X-ServerID
X-HTML-Minification-Powered-By
X-Detected-As
X-Edge-Location
X-Cache-Type
X-Cache-Server
X-BYPASS-REASON
X-Extlb
X-FB-TRIP-ID
X-GeoCountry
X-Hl-Ver
X-GeoCode
X-Generated-By
X-Forwarded-Host
X-Via-Fastly
X-Web-Node
Webcakes-App-Version
Webcakes-Region
Webcakes-App-Name
Web-Mar-Node
TWC-Privacy
X-Cache-Host
X-Format
X-Generation-Time
X-Varnish-Cache-Hits
X-Origin-Hint
X-Locale
TWC-Locale-Group
TWC-GeoIP-LatLong
Azure-RegionName
Azure-SiteName
Azure-InstanceId
X-Zipkin-Id
X-Xfnlog-Site
Azure-SlotName
Azure-Version
TWC-GeoIP-Country
TWC-Device-Class
TWC-Connection-Speed
Onion-Location
X-Access
Property-Id
Selected-Fe
Apigw-Requestid
Eomportal-Instance
DB-Nickname
Mn-Server-Ip
Locale
X-Cache-Status-Check
X-Tid
X-Storefront-Renderer-Rendered
X-Nginx-Cache
X-Server-W
X-R9-Blue-Green-Version
X-Ms-Request-Id
X-Ms-Version
X-Origin-Date
X-URL
X-JoinUs
WP-Super-Cache
X-SaId
Cache-Name
Xserver
X-FireWall-Port
X-DynaTrace-JS-Agent
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
ServedBy
X-Zen-Fury
X-LSADC-Cache
X-App-Version
X-Amzn-RequestId
X-ECache
X-Amz-Apigw-Id
X-Human
X-Varnish-Ttl
X-TNCMS
X-Ua
X-Loop
X-Cache-Tags
X-Dc
X-Debug-Cache
Cache
Xet-Cookie
Source
X-Reqid
X-TA-CDN-Provider
X-GEO
X-RCS-CacheZone
X-Cached-By
X-Varnish-Hits
X-Soup
X-Pubstack
X-Correlation-ID
SD-X-WS
X-Aspnetmvc-Version
X-Amzn-Remapped-Content-Length
Origin
X-MP-GENERATED-AT
X-Newrelic-Synthetics
X-Cdn
X-Origin-TTL
WPO-Cache-Status
X-Webkit-CSP
WPO-Cache-Message
X-Origin-CC
Cross-Origin-Window-Policy
X-Provided-By
X-Tumblr-Pixel-2
From-Origin
X-Vgn-Hpd-Reason
X-Service
LB
X-IPS-LoggedIn
X-Varnish-Beresp-Ttl
X-B3-SpanId
X-AOL-HN
Webserver
Rip
X-NewRelic-App-Data
X-Tec-Api-Version
X-Tec-Api-Root
X-Tec-Api-Origin
X-Via-NSCOPI
X-GG-Cache-Date
X-Request-Host
X-FW-Version
X-Platform-Server
Ngx.Var.Host
HostName
X-Aed
X-AK-Request-ID
X-A-Wwc
X-Application
X-ScT
X-ARC
Expiry
X-A-Dgt
X-NAPM-TraceId
X-Orig-Expires
Odigeo-Trace-Id
X-A-Ccd
X-A
Rendered-Blocks
X-TIM-N
X-A-Dcw
Sslversion
X-User
X-Served-From
Environment
A
X-Destination
X-Developer
X-Cache-NE
Cdnsip
Cdncip
X-Connection-Hash
BehaviorPad-Version
X-D
X-Ec-Fail
X-Ec-GeoHdr
X-BCube-Filmed-By
X-Bc-Bl
X-B-Cookie
X-Shop-Environment
X-SRCache-Key
X-Forwarded-Path
DCR-Decision-By
X-External-Request-Id
DCR-Processing-Time-Ms
X-Owner
X-A-Dam
Lang
X-CSRF-Token
X-PBS-Appsvrname
X-Tenant
X-VG-WebCache
MD5-Digest
X-Rewrite-Enabled
Xc-Version
T-Server
Host-ID
X-Vdms-Path
X-Rojux
X-S-Cookie
X-Processor
Meta-Geo-Continent
X-S
X-Vdms-Version
Surrogated-Key
X-B3-Traceid
Mime-Version
OT-Force-Account-Verify
X-VC
Redirect-Candidate
VNS-Cache
X-Pool
X-Qloud-Router
X-Accel-Buffering
X-Dispatcher-Number
Machine
X-Bip
X-Generated-On
X-Aicache-OS
VNS-Age
X-Level-Front-Cache
CPC-Cache
X-Cluster-Node
Upgrade-Insecure-Requests
X-Parent-Response-Time
CPC-Age
X-Thanos
X-Varnish-Beresp-Status
X-WA-Info
X-TIME
X-Clientip
Thinkindot-Control
Tube-Got-Results
X-Clara-WADP
Release
X-Cdn-Origin
X-Ckpd-Fst-Backend
X-Cache-Info
Traceparent
Server-Host
X-CacheTTL
X-Cache-Bucket
TDXMobile
Wxu-Next-Region
X-BBC-Edge-Cache-Status
Tube-Get-Contents
Req-Svc-Chain
State
Wxu-Next-Hostname
Wxu-Next-Commit
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
X-Ad-Defer-Variation
Tube-Return
X-Branch-Name
Vix-Hermes-Req-Id
X-Cluster
X-Cache-Id
X-Origin-Response-Time
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
X-Policy
X-Region-Sid
X-Rocket-Nginx-Serving-Static
X-Rocket-Build-Number
X-VG-TLSProxy
X-VServer
X-Variation
X-Origin
X-Planisys-CDN-Cache
X-Worker
X-WADP-Cache
X-Wix-Viewer-Type
X-S-Maxage
X-Varnish-Remaining-TTL
X-SplitTest
X-Sn-Servicetimems
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-V-Cache
X-Thinkindot-L3
X-Varnish-CookieHashed-On
X-Slack-Backend
X-Varnish-CookieINHashed-On
X-SB
X-Scale
X-Sigma
X-SIPLIST1
X-Sigma-Backend
X-Optimistic-Header
X-NodeID
X-Ec-Custom-Error
X-DPWN-IS-SECURE
X-Epic-Correlation-Id
X-Esi-Check
X-Fmm-Version
X-Fetched-On
X-Device-Os
X-DefHash
X-Core-Value
X-Core-Mission
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-DefElseHash
X-Datadog-Trace-Id
X-Forwarded-Site
X-Gamma-Serve
X-Irp-Debug
X-Hash
X-Loc
X-Minions-Version
X-Mvc-Supplant-OutputCached
X-Mvc-Supplant-Cachable
X-Gzip
X-GeoIP-City
X-Gateway-Cache-Status
X-Gateway-Cache-Key
X-Gateway-Request-Id
X-Gateway-Skip-Cache
X-GeoIP
X-CMSURLCustom
Tube-Got-Eval
DSUID
Country-Code
Cmstype
Cmsid
Fastly-GeoIP-CountryCode
Fastly-SIE
Kp-EeAlive
IsBot
Is-Eu
Fastly-SWR
Click-Count-Error
Click-Count-Action-Start
Apple-News-Services-Handled
Adler-Geo
Cache-Hits
Producers
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Candidate-Md5Url
Canary
Apple-News-Services-Request-Url
Memcached
Cache-Host
Mobile-Detection-Method
NGX
Origin-CC
NM-Fastcgi-Cache
Origin-EX
Platform
X-Cache-Debug
Mail-Subject
We-Hiring
X-Auto-Login
Web-Mar-Region
X-INCAP-ABP
Sever-Int
X-Nyt-Route
X-CGP
Servername
X-Csrf-Jwt
Gh-Request-Id
Server-Ext
Server-Hostname
X-Gdpr
Cluster
X-NCache
X-Scheme
X-JWT-State
X-Request-URI
X-ZONE
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Is-Gdpr
X-HS-Content-Campaign-Id
X-Origin-Time
Datacenter
X-Gen-Mode
X-Geo-Header
X-Hnp-Log
X-Has-Esi
X-Eu-Site
X-Developers
Svr
V-Age
User-Cache-Control
X-Proxy-Cache-Info
Decoy-Debug-Key
X-Block-Status
Decoy-Debug-Status
Decoy-Debug-TTL
X-Viewer-Country
L5d-Success-Class
Ha-Gx-Prefs
CloudFront-Viewer-Country
Fastly-SSL
L
X-Cdn-Srv
Fastly-Backend-Name
HA-Ipaddr
WebServer
X-Cache-Remote
Cache-Tv-Group
X-Trace-ID
Ec-Rule-Version
X-Tx-Id
X-WP-CF-Super-Cache-Active
Fastcgi-Cache-TTL
CDCHOST
X-Sucuri-ID
AKAMAI
X-Sucuri-Cache
X-Presslabs-Stats
X-LB-NoCache
X-Session-Fingerprint
Time
X-ND-Cache
Ssr
X-Rebelmouse-Cache-Control
X-Var-Ttl
X-FC-Vary-Parameters
X-ATG-Version
X-Origin-Expires
X-Fastly-Backend
X-Fastly-Cache
Memory
X-Azure-Ref-OriginShield
X-Rebelmouse-Surrogate-Control
X-Udemy-Cache-App-Namespace
AMP-Access-Control-Allow-Source-Origin
Sid
Pics-Label
X-Newrelic-App-Data
SID
Fastly-Drupal-HTML
X-Nf-Request-Id
X-Tb-Optimization-Total-Bytes-Saved
X-Via-Popv
X-Via-Popn
X-Pod-Name
X-Via-Poph
X-NWS-UUID-VERIFY
Env
X-Generated-In
X-Cache-Date
X-Xrds-Location
X-Akamai-Transformed
X-Refresh
X-Buckets
Server-ID
X-Ig-Push-State
X-Servedbyhost
X-DC
X-Cs
X-Release
X-Pass-Why
X-Conf
X-Up
X-Edge-Pop
X-NC
X-Dispatch
Fastly-Drupal-Html
X-MSEdge-Features
My-App
X-MSEdge-Flight
X-EC-Lua
X-Microcachable
X-Fpc
X-CACHE-KEY
X-Tumblr-Pixel-3
X-RateLimit-Reset
X-Esi
X-Lambda-Id
X-Dmc
X-Wa
X-Endurance-Cache-Level
CDN
X-PX
X-ID
X-MCACHE
GeoIp-Country-Code
X-TX-ID
X-CS
X-Be
X-CACHE-AGE
Magicmarker
X-VCL-Version
X-Req
True-Client-IP
X-Zone
X-TRACE-ID
X-NGINX-Cache
X-Webkit-CSP-Report-Only
X-Wikidot-Static-Cache
X-LB-ID
X-Wikidot-Backend
X-Vc
X-Air-Hostname
CacheControlHeader
X-Air-Source
X-Air-Trace-Id
X-TH-Server
X-CSRF-TOKEN
Hostname
X-Yandex-Sdch-Disable
X-Hyper-Cache
True-Client-Country-4JS
X-CF-Lambda-Fn
X-Op-Id-All
X-Micro-Cache
X-CF-Lambda-Version
X-Srv
Path
Pramga
X-M-Reqid
Resin-Trace
X-M-Log
X-Air-Pt
True-Client-Ip
X-App
X-Alfa-Service
X-Vcl-Version
X-HS-Status
X-Varnish-Beresp-TTL
X-B3-Spanid
Tcn
GeoIP-Country-Code
X-Qnm-Cache
C-Via
Tracecode
X-GeoIP-Country-Code
X-GeoIP-Region-Code
X-TrackingId
N-Cache
X-SERVER-NAME
X-Vercel-Cache
X-Vercel-Id
Section-Origin-Responded
X-FPC
On-Server
Fastcgi-X-Cache-Version
X-Datacenter
Section-Io-Origin-Time-Seconds
X-Akamai-Pragma-Client-IP
WWW-Authenticate
Esi-Enabled
X-Accel-Expires-Debug
X-PAYTM-SRV-ID
Section-Io-Id
Section-Io-Origin-Status
X-Platform
X-Date
NtCoent-Length
X-CLOUD-TRACE-CONTEXT
X-Check-Cacheable
X-RAMCache
X-WA
X-Edge-Origin-Shield-Bytes
X-Edge-Origin-Shield-Region
Proxy-Connection
Yjs-Id
Hit
X-Webkit-Csp-Report-Only
X-Platform-Cluster
X-Via-CDN
X-ServedByHost
X-Mly-Id
X-Old-Content-Length
Server-Id
Lb
GeoIP-Latitude
FSS-Cache
X-Platform-Processor
X-Platform-Router
X-Edge-POP
X-Node-Id
X-Cdn-Forward
X-Geo
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
X-LiteSpeed-Cache-Control
X-Lb-Id
Powered-By
X-API-Version
YJS-ID
X-Response-By
X-TT-LOGID
X-LAGOON
X-SD-PageType
User-Agent
ENV
X-Request-Start
X-AIR-PT
X-Dw-Trace-Id
X-UA
X-Via-PopH
X-PERF
X-ApacheServer
X-Client-Ip
X-Via-PopV
X-Via-PopN
HIT
X-Akamai-ERPolicy
X-Akamai-ERRuleID
Cache-Key
Cdn
XkeyRZ
DynaTrace
X-Li-Fabric
X-FL-EDGE
X-Via-Ucdn
X-Traceid
X-CUA
X-Webstats-RespID
X-From
X-Location
X-Proxy-CacheRZ
X-Cache-Ttl
Locid
X-LI-UUID
X-LI-Proto
X-Li-Pop
X-FORWARDED-FOR
Geoip-Latitude
Srvid
Server-Ttl
X-Render-Time
Dnion-Transfer-Encoding
X-Instance-Name
X-Service-Response-Time
Sm-Log-Id
X-Varnish-Authentication
X-Director
Ohc-File-Size
X-DB
X-RPS
X-RSL
X-Proxy-Cache-Hk
X-RPM
X-DW
X-Cache-ASPX
X-DI
X-DSS
X-Contensis-Viewer-Groups
Location
XServer
Nginx-CQVIP
PFcat
XM
X-Lb-Nocache
X-LiteSpeed-Tag
DT-Hot-News
X-VarnishDD-TTL
X-HN
PICS-Label
X-CF-Powered-By
X-Proxy-Upstream
X-Wp-Cf-Super-Cache
X-Litespeed-Cache-Control
X-Wp-Cf-Super-Cache-Cache-Control
X-Server-IP
X-Request-Url
X-B3-ParentSpanId
X-Fastly-Cache-Hits
Vha6-Origin
Wpo-Cache-Message
X-Cdn-Request-ID
X-HostName
X-Fastly-Backend-Reqs
Wpo-Cache-Status
CountryCode
X-Ips-Loggedin
Warning
Wp-Super-Cache
X-Cache-Ngx
X-Yottaa-OS
Swift-Performance
X-DataCenter
CF-Cached-On
ServerName
X-Test
WZWS-RAY
Fastcgi-Cache-Ttl
SRV
Req-ID
X-Mg-Cache
X-Moov-T
X-Moov-Xdn-Version
X-ElasticPress-Query