Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
CF-RAY
Cf-Request-Id
CF-Cache-Status
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
X-XSS-Protection
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
Alt-Svc
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Adblock-Key
X-Runtime
X-Permitted-Cross-Domain-Policies
X-Request-ID
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Check
X-Cache-Status
X-DNS-Prefetch-Control
X-Generator
X-Cacheable
Timing-Allow-Origin
P3p
X-Content-Security-Policy
X-Iinfo
X-FRAME-OPTIONS
Status
Content-Encoding
Feature-Policy
X-AspNetMvc-Version
X-CDN
X-Envoy-Upstream-Service-Time
Upgrade
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
X-Ua-Compatible
Access-Control-Max-Age
X-Via
Keep-Alive
X-Ws-Request-Id
Request-Context
X-Robots-Tag
Server-Timing
X-AH-Environment
X-Server
X-Hacker
X-Age
X-Turbo-Charged-By
X-Proxy-Cache
X-Server-Powered-By
X-Cache-Group
X-Backend
Host-Header
X-Amz-Request-Id
EagleId
X-Nginx-Cache-Status
X-Amz-Id-2
X-Dns-Prefetch-Control
Report-To
X-LiteSpeed-Cache
X-Rq
X-UA-Device
X-Varnish-Cache
X-Page-Speed
Grace
X-Pingback
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-Device
EagleEye-TraceId
NEL
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Vhost
X-Amz-Version-Id
Cf-Railgun
X-OneAgent-JS-Injection
X-Dispatcher
X-Host
X-CST
X-Cache-Spec
X-Server-Id
Allow
X-Node
Surrogate-Control
X-Backend-Server
Request-Id
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Webkit-CSP
Accept-CH
X-Readtime
X-WebKit-CSP
X-Akam-SW-Version
X-Response-Time
Xkey
X-HW
X-Country
Accept-Ch-Lifetime
X-Language
X-Application-Context
X-Ac
Content-Location
X-Ruxit-JS-Agent
X-Template
MS-Author-Via
X-Cloud-Trace-Context
Rating
X-Cache-Lookup
X-Url
X-Mod-Pagespeed
X-B3-TraceId
X-TtlSet
X-Vname
Edge-Control
X-PC
X-Clacks-Overhead
X-ESI
X-MS-InvokeApp
X-Trace
X-GitHub-Request-Id
X-Content-Type
Fastly-Restarts
X-Varnish-TTL
X-Rack-Cache
X-Cnection
X-Origin-Cache
Accept-CH-Lifetime
X-ASPNET-VERSION
X-Country-Code
X-Kinja-Build
X-Kinja-Server
X-Cdn-Fetch
X-Kinja-Revision
X-Kinja
X-Use-Magma
X-Exp-Id
X-GoogleNews-Bot
X-Exp-Variant
X-Goog-Hash
X-VARITI-CCR
X-D2id
Verso
X-FastCGI-Cache
Arr-Disable-Session-Affinity
Accept-Ch
X-Server-ID
X-Buckets
X-Cached
X-Server-Name
X-Vcap-Request-Id
Cache-Tag
X-ORACLE-DMS-ECID
X-Amz-Rid
X-Abt-Application-Version
X-Navigation-Version
X-Client-IP
Service-Worker-Allowed
X-Powered-By-Plesk
X-Fastly-Request-ID
RTSS
Access-Control-Request-Method
X-Ttl
X-MSEdge-Ref
X-Element-Page-Cache
X-Powered-CMS
Public-Key-Pins
X-Sol
Pagespeed
Response
Display
X-Middleton-Response
X-Middleton-Display
X-Upstream
X-NF-Request-ID
X-Dw-Request-Base-Id
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Px
X-Version
X-Cache-TTL
X-Edge
S
X-Kinsta-Cache
X-Edge-Location-Klb
X-LLID
Realpath
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-ECACHE
SPRequestDuration
X-TTL
SPIisLatency
X-Accel-Expires
X-SharePointHealthScore
SPRequestGuid
X-HP-Webp
X-Jurisdiction
X-Oneagent-Js-Injection
X-Instrumentation
X-MCACHE
X-Mid
X-Server-Lifecycle-Phase
X-Kraken-Routeconfig-Destination
X-T
X-Kraken-Loop-Name
X-PressLabs-Stats
X-Shield-Request-Id
X-Content-Security-Policy-Report-Only
X-Cache-Key
X-Forwarded-Proto
X-DynaTrace
Pinterest-Generated-By
Pinterest-Version
X-Pinterest-Rid
Edge-Cache-Tag
Fastcgi-Cache
X-Amz-Server-Side-Encryption
X-Recruiting
X-Correlation-Id
X-ORACLE-DMS-RID
Charset
X-Ruxit-Js-Agent
TP-L2-Cache
TP-Cache
X-Mg-S
X-XRDS-Location
X-Content-Digest
Nginx-Cache
X-Id
X-Request-Processing-Time
X-Request-Received
TCN
Filters
Front-End-Https
X-Ezoic-Cdn
Server-Node
X-Logged-In
Alternate-Protocol
X-Forwarded-For
X-Release
Cache-Tags
Content-MD5
X-Origin-Upstream-Status
Fusion-Content-Source
Fusion-Source
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Content-Id
X-Geo-Country
Fusion-Component-Id
X-Hostname
X-Litespeed-Cache
X-Protected-By
X-Amzn-Trace-Id
X-Grace
X-Origin-Server
X-RateLimit-Remaining
X-Www-Served-By
Server-Name
X-Rid
X-Amz-Replication-Status
Host
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Metageneration
X-GUploader-UploadID
X-F-Cache
Cleartype
X-Contextid
X-HS-Hub-Id
X-HS-Content-Id
X-HS-Cache-Config
X-HS-Combine-CSS
X-AppVersion
X-Az
X-Activity-Id
X-Debug-Info
X-LB-Cache
X-Frontend
Section-Io-Cache
X-NWS-LOG-UUID
X-Erf-Bev-Bev
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
MicrosoftSharePointTeamServices
X-WebKit-CSP-Report-Only
X-Git-Hash
X-Ser
X-Page-Id
X-Cache-Age
X-Respond-Thread
X-VCache
X-Daa-Tunnel
X-Content-Options
X-Aspnetmvc-Version
X-Upgrade-Enabled
Accept-Charset
Access-Control-Allow-Method
X-Varnish-Age
X-Mobile-URL
X-DIS-Request-ID
X-Source
X-Hits
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Signature
Paypal-Debug-Id
X-B-Cache
ServerID
X-Varnish-Backend
X-Whom
X-Varnish-Grace
X-Cache-Action
Payment
Healthy
X-B3-Sampled
X-TT
X-FB-Debug
Viewport
X-Tec-Api-Origin
X-Tec-Api-Version
X-Tec-Api-Root
X-CACHE-GROUP
X-Aspnet-Duration-Ms
X-Is-Crawler
X-Route-Name
Node
X-Request-Guid
X-Providence-Cookie
X-Flags
X-AOL-HN
X-App-Environment
X-Fastcgi-Cache
AR-Request-ID
AR-ATIME
AR-PoweredBy
Ar-Sid
AR-CACHE
X-N
Version
X-Seen-By
Fastcgi-Useragent
X-Load-Cache
X-Mobile
DynaTrace
X-Type
DC
X-Yandex-Sdch-Disable
X-Ab
MS-CV
X-Microsite
X-HTML-Minification-Powered-By
X-Request-Handler-Origin-Region
X-Distributor
X-XRDS-LOCATION
SRV
X-Tt-Trace-Host
X-Cache-Expired-At
X-Tt-Trace-Tag
Retry-After
Filterid
Frame-Options
X-Cache-Control
X-User-Agent
X-Original-Request-Id
X-IPLB-Instance
X-Response-Served-From
X-Jobs
Refresh
X-ProcessESI
X-IPS-LoggedIn
X-Proxy-Cache-Status
X-Region
X-RemovedCookies
X-Real-IP
Uber-Trace-Id
Access-Control-Request-Headers
X-Adobe-Content
X-Device-Type
X-Adobe-Loc
X-Cluster-Name
X-Debug-IsConnected
X-Content-Powered-By
X-Debug-IsPreview
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-Pixel-1
X-Tumblr-User
X-Varnish-Server
X-UUID
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
NGB
X-B
X-Instance
X-Cache-Time
X-Framework
X-Proxy
X-Cacheable-TTL
X-G
X-RTag
Ms-Operation-Id
X-Page-View
X-RateLimit-Limit
X-App-Version
X-Vgn-Hpd-Reason
X-Debug
X-Zen-Fury
X-FW-Hash
Countrycode
X-FW-Serve
X-Time
Cache-Status
X-FW-Static
X-FW-Server
X-FW-Type
X-FW-Dynamic
X-NGENIX-Cache
X-Accel-Buffering
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Origin-Responded
X-Wix-Request-Id
X-CDN-Forward
Section-Io-Id
X-FireWall-Port
X-Azure-Ref
X-Mg-Request-UUID
Cache
X-Nginx-Cache
X-Cache-Rule
X-Node-Name
X-Oracle-Dms-Rid
X-Ms-Version
X-Drupal-Cache-Tags
X-Ms-Request-Id
X-Rendered-As
X-Is-Bot
Surrogate-Key
Referer-Policy
S-Cnection
Country
SD-X-WS
Liferay-Portal
X-Cache-Hit
X-EdgeConnect-Cache-Status
X-App-Server
Amp-Access-Control-Allow-Source-Origin
X-Environment-Context
Eomportal-Instance
X-L-Path
X-Cache-Operation
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-Varnishpool
X-SaId
X-Drupal-Cache-Contexts
X-Timing-Wait
X-RN-RSRV
X-UPSTREAM-Address
X-ES-SERVER
Meta-Geo
X-Proxy-Build
Selected-Fe
X-JoinUs
X-Shopify-Stage
X-PHP-Backend
X-GG-Cache-Date
X-S-Maxage
X-Cache-TTL-Remaining
X-Revision
X-Xfnlog-Site
X-ShopId
X-Storefront-Renderer-Rendered
X-Alternate-Cache-Key
X-Sorting-Hat-ShopId
X-Request-Time
X-Sorting-Hat-PodId
From-Origin
X-ShardId
X-Via-Fastly
X-Varnish-Beresp-Grace
X-Varnish-Hostname
X-No-Session
X-Backend-Host
X-AWS-Id
Protected
ServedBy
X-BYPASS-REASON
X-Cache-Server
X-Endurance-Cache-Level
X-LJ-Flow-ID
X-Pubstack
X-VWS-Id
X-Handled-By
Cache-Name
X-Adobe-Source
X-R9-Blue-Green-Version
X-Loop
X-TNCMS
X-Aws-Lambda-Call-Status
X-ProxyCache-Status
X-ProxyCache-Key
X-Human
TWC-GeoIP-LatLong
Property-Id
TWC-Privacy
Webcakes-App-Version
Webcakes-App-Name
TWC-GeoIP-Country
TWC-Locale-Group
TWC-Connection-Speed
Azure-InstanceId
Azure-SlotName
Azure-RegionName
Apigw-Requestid
Azure-Version
Azure-SiteName
Country-Code
Cache-Tv-Group
TWC-Device-Class
X-Be
X-RCS-CacheZone
X-Origin-Date
X-Origin-Hint
X-Say-Cacheable
X-Say-TTL
X-Tumblr-Pixel-2
X-OCL
X-SayCDN-TTL
X-LAGOON
X-PCL
Webcakes-Region
X-Hl-Ver
X-Server-W
X-NYM-Debug-Backend
X-UA-Device-Type
Mn-Server-Ip
X-Status
X-Labrador-Cache-Channel
X-Proto
X-Format
X-Backend-Name
X-FB-TRIP-ID
X-PERF
X-Cache-Type
X-Section
X-Akamai-Edgescape
X-PHP-Host
X-ApacheServer
Fastly-SSL
X-Access
X-TA-CDN-Provider
Decoy-Debug-Key
Akamai-GRN
Decoy-Debug-Status
Decoy-Debug-TTL
X-Hosted-By
X-Sql-Count
X-Uri
CF-IPCountry
X-Sql-Duration-Ms
Xserver
X-Hyper-Cache
X-Redis-Cache
X-Web-Node
X-B3-SpanId
X-Parallel-Accel
X-Cache-PHP
X-TT-LOGID
X-Ua-Device
X-ATG-Version
X-Rule
X-ServerID
X-Time-Microsecs
X-FW-Version
X-Trace-Id
X-Cache-Ttl
Count-Hit
X-WA-Info
X-CSRF-Token
AMP-Access-Control-Allow-Source-Origin
X-HP-Trace-Id
X-MP-GENERATED-AT
X-Tumblr-Pixel-3
OT-Force-Account-Verify
X-Cached-By
X-Cluster-Node
X-Soup
X-Content-Age
X-Datadome
GEO-INFO
Backend
X-Akamai-Transformed
X-Azure-Ref-OriginShield
X-Cache-Enabled
X-Servername
Cross-Origin-Opener-Policy
X-CS
X-Edge-Location
X-Varnish-Cache-Hits
X-Dc
X-Mode
X-Generation-Time
X-Cache-Host
X-Detected-As
X-Bc-Bl
X-Varnish-Hits
X-Varnish-Beresp-Status
Web-Mar-Node
X-Info
X-Varnish-Ttl
X-Microcachable
X-Unique-ID
X-Amzn-Remapped-Content-Length
X-Amzn-RequestId
X-Varnish-Beresp-Ttl
X-Cache-NGX
X-Amz-Apigw-Id
X-Storage
X-Debug-Cache
X-Routing-Service
X-Proxied
X-Zipkin-Id
X-Platform
SID
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-APP-VERSION
Ec-Rule-Version
X-Extlb
X-Magnolia-Registration
X-B3-Traceid
X-Origin-TTL
X-Origin-CC
X-Via-JSL
Upgrade-Insecure-Requests
X-Srv
X-NWS-UUID-VERIFY
Url
Cross-Origin-Window-Policy
CDN-EdgeStorageId
Meta-Geo-Continent
CDN-PullZone
M-TraceId
MD5-Digest
A
CDCHOST
Mobile-Detection-Method
CDN-Cache
CDN-CachedAt
CDN-RequestCountryCode
Host-ID
Apple-News-Services-Request-Url
Fastcgi-X-Cache-Version
DCR-Processing-Time-Ms
Apple-News-Services-Handled
Cache-Host
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
CDN-RequestId
CDN-Uid
DCR-Decision-By
BehaviorPad-Version
Expiry
X-Application
X-Ratelimit-Reset
X-Processor
X-Request-URI
X-Rewrite-Enabled
X-Rojux
X-PBS-Appsvrname
X-PAYTM-SRV-ID
X-Epic-Correlation-Id
X-External-Request-Id
X-From
X-NAPM-TraceId
X-S
X-S-Cookie
X-VG-WebCache
X-Vdms-Version
X-VG-WebServer
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
X-Vdms-Path
X-Thanos
X-ScT
X-Service
X-Session-Fingerprint
X-SRCache-Key
X-Developer
X-Destination
X-A-Ccd
X-A
X-A-Dam
X-A-Dcw
X-A-Dgt
T-Server
Surrogated-Key
Path
Rendered-Blocks
Req-Svc-Chain
State
X-A-Wwc
X-Aed
X-Cache-NE
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-D
X-Cache-Bucket
X-Bip
X-Aicache-OS
X-ARC
X-B-Cookie
X-BCube-Filmed-By
Odigeo-Trace-Id
X-Connection-Hash
DataCenter
X-Air-Hostname
Content-Secure-Policy
X-Air-Source
X-Air-Trace-Id
X-Ua
Source
Server-Info
X-Cache-Grace
S-Rt
Who
X-TrackingId
X-Rocket-Build-Number
X-Request-UUID
X-Proxy-Upstream
L
DSUID
X-Scheme
Memcached
Fastly-Drupal-HTML
X-SVT-ORM-RULES
X-Sigma-Backend
X-SVT-ORM-VERSION
X-Served-From
Kp-EeAlive
NGX
X-Device-Os
X-Envoy-Decorator-Operation
X-Gamma-Serve
X-Core-Value
X-Cms-Context
X-Branch-Name
X-Cache-Debug
UCS
X-Generated-On
X-Geo-Header
X-Level-Front-Cache
X-VarnishDD-TTL
X-Locale
X-HN
X-Hash
Pics-Label
PFcat
Origin
X-Location
X-Sigma
X-Rebelmouse-Surrogate-Control
X-Forwarded-Host
X-Shop-Environment
X-Tenant
Fastly-SWR
X-Rebelmouse-Cache-Control
X-Platform-Server
X-Orig-Expires
X-NU-AKA-ACS-Version
X-VG-TLSProxy
X-Forwarded-Path
X-Clientip
Fastly-SIE
C-Via
Content-Disposition
Cmstype
Cmsid
User-Cache-Control
X-Tb
X-DataDome
X-Generated-In
X-Fastly-Cache
Wxu-Next-Region
X-Generated-By
X-AIR-PT
X-Forwarded-Site
X-Accel-Expires-Debug
X-Fetched-On
X-Fmm-Version
X-Origin-Expires
X-Variation
X-Csrf-Jwt
X-Cache-Info
X-Cluster
X-CGP
X-VC-Cache
X-Date
X-Eu-Site
X-Clara-WADP
X-Backend-State
X-Developers
X-Fastly-Backend
X-Is-Gdpr
Wxu-Next-Hostname
Arc-Version
Is-Eu
PB-PID
Platform
PB-RID
X-Site-Version
X-Skip-Cache
X-User
X-Var-Ttl
X-Thinkindot-L3
X-WADP-Cache
Adler-Geo
X-Req
X-SRV
X-Has-Esi
X-DPWN-IS-SECURE
X-GoCache-CacheStatus
X-GeoIP-City
X-Loc
X-JWT-State
X-Cache-Tags
X-Men
X-Owner
X-Policy
X-Origin
X-Nginx-Cache-Key
X-Micro-Cache
X-GeoIP
X-Request-Host
HA-Ipaddr
Thinkindot-Control
Thinkindot-CacheControl-Type
Thinkindot-CacheControl
Ha-Gx-Prefs
Pagetype
Fastcgi-Cache-TTL
Fastly-Backend-Name
Gh-Request-Id
TDXMobile
X-VHOST
Server-Host
Server-Ext
NM-Fastcgi-Cache
Release
Server-Hostname
Sever-Int
L5d-Success-Class
Location
Svr
Esi-Enabled
True-Client-Country-4JS
CacheControlHeader
Wxu-Next-Commit
X-Amz-Meta-S3cmd-Attrs
AKAMAI
Vix-Hermes-Req-Id
Arc-Country
X-LI-UUID
X-Old-Content-Length
X-Mvc-Supplant-Cachable
X-Ftr-Request-Id
X-Li-Pop
X-Varnish-CookieHashed-On
X-Gzip
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Varnish-Remaining-TTL
X-Hnp-Log
X-Irp-Debug
Mail-Subject
X-Li-Fabric
X-Varnish-CookieINHashed-On
X-SIPLIST1
X-RateLimit-Remaining-Second
X-VServer
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Slack-Backend
X-Sucuri-ID
X-Via-NSCOPI
X-Viewer-Country
Cache-Key
Cf-Device-Type
X-RateLimit-Limit-Second
X-Qloud-Router
Webserver
X-DefHash
Locid
X-DefElseHash
X-PF-Uncompressing
IsBot
X-FC-Vary-Parameters
X-Esi-Check
X-Gen-Mode
We-Hiring
X-Cache-Id
X-Block-Status
V-Age
Nel
X-EC-Lua
X-Minions-Version
VNS-Age
CPC-Age
VNS-Cache
X-Varnish-Url
CPC-Cache
Cache-Hits
X-Conf
NtCoent-Length
X-Planisys-CDN-TTL
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-GEO
X-Vc
X-BBC-Edge-Cache-Status
X-Via-Popv
X-Via-Popn
X-Via-Poph
X-Mvc-Supplant-OutputCached
X-HS-Content-Campaign-Id
MIME-Version
X-Zone
X-Ratelimit-Limit
X-Servedbyhost
X-Ckpd-Fst-Backend
My-App
Powered-By-ChinaCache
X-TX-ID
X-Internal-Host
X-DC
X-Worker
X-Unique-Id
X-Pass-Why
XServer
X-Auto-Login
X-Refresh
X-LB-ID
X-V-Cache
Time
X-PJAX-URL
Memory
X-ID
X-CACHE-KEY
X-NCache
X-NC
X-Rocket-Nginx-Serving-Static
Server-ID
X-Traceid
Geo-Info
WebServer
X-Ratelimit-Remaining
X-Platform-Processor
X-Newrelic-Synthetics
X-ZONE
X-Tx-Id
X-LSADC-Cache
X-OVcl
X-Platform-Router
X-Platform-Cluster
X-Render-Time
X-OVcl-Cache
X-Wa
X-NewRelic-App-Data
X-Webkit-CSP-Report-Only
X-Correlation-ID
X-Webkit-Csp
Cf-Bgj
X-M-Reqid
X-TIME
X-Qnm-Cache
X-SD-PageType
X-M-Log
HostName
X-Cache-Remote
X-Backend-TTL
Magicmarker
X-App
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
Environment
X-Datadog-Trace-Id
X-TraceId
X-Geo
X-BBC-Origin-Response-Status
DB-Nickname
X-Origin-Time
X-API-Version
X-NodeID
X-Gdpr
Hostname
X-Nyt-Route
X-Method
Resin-Trace
X-Cache-Config
GeoIp-Country-Code
X-Dispatcher-Server
X-Server-IP
X-VCL-Version
Cluster
X-Via-Ucdn
Geoip-Latitude
X-CLOUD-TRACE-CONTEXT
X-Cache-Var
X-Cache-Var-Map
Candidate-Md5Url
X-Edge-Pop
X-Tb-Optimization-Total-Bytes-Saved
X-Pod-Name
X-LI-Proto
X-IP
Ssr
Tcn
Ohc-File-Size
X-Content
Datacenter
X-Ua-Browser
Cf-Ipcountry
X-ElasticPress-Query
X-Origin-Response-Time
X-HITS
N-Cache
X-Dynatrace
X-MSEdge-Features
X-MSEdge-Flight
X-Akamai-Pragma-Client-IP
X-CACHE-AGE
X-Nc
LB
X-Li-Proto
Web-Mar-Region
X-NODE
X-Node-Id
X-Varnish-Beresp-TTL
X-Trv-Group
Cdn
X-DynaTrace-JS-Agent
X-Vcl-Version
X-AB
Proxy-Connection
X-ND-Cache
X-Wix-Viewer-Type
X-Via-CDN
GeoIP-Latitude
GeoIP-Country-Code
Servername
CF-Cached-On
Onion-Location
X-HostName
WWW-Authenticate
Env
X-APP
X-EIG-Tracking-Id
X-ServerName
X-Varnish-Cacheable
WZWS-RAY
X-Reqid
X-HS-Status
X-Cs
Server-Id
CDN
Sid
X-Fpc
X-WA
X-Dynatrace-Js-Agent
X-MG-S
Lb
X-Fastly-Backend-Reqs
X-NGINX-Cache
Viewtype
X-TIM-N
Cteonnt-Length
X-Tid
Redirect-Candidate
Rt-Fastcgi-Cache
X-Pjax-Url
VivaBuild
X-Request-Start
X-Check-Cacheable
X-URL
URI
X-Up
Machine
X-Lb-Id
Tracecode
Ohc-Cache-HIT
X-Esi
X-CSRF-TOKEN
X-Xrds-Location
X-FTR-Request-ID
X-Cache-Date
Pramga
X-IN-APIGATEWAYSSL
X-VC
X-Cache-Backend
X-Fastly-Request-Id
X-Via-PopV
Is-Us
X-IN-APIGATEWAY
X-Via-PopH
X-Via-PopN
X-Cdn-Forward
X-Sn-Servicetimems
On-Server
Shield-Pop
X-Cdn-Origin
FSS-Cache
X-SN
X-ServedByHost
Server-Ttl
Mime-Version
CountryCode
X-RAMCache
X-Fastly-Cache-Hits
X-Contensis-Viewer-Groups
X-Provided-By
X-Varnish-Authentication
W
X-Acquia-Purge-Tags
X-Acquia-Site
X-Amz-Meta-Cb-Modifiedtime
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Core-Mission
X-UnsetCookies
CloudFront-Viewer-Country
CACHE
X-Cache-ASPX
X-Air-Pt
X-LiteSpeed-Cache-Control
X-Swa-Ws
X-FORWARDED-FOR
X-Yottaa-OS
WP-Super-Cache
Xet-Cookie
Warning
X-Oss-Hash-Crc64ecma
X-StackifyID
X-FTR-DC
X-Pf-Uncompressing
X-FTR-Realm
X-SB
Req-ID
X-Cache-Expires
X-Cdn-Request-ID
X-Swift-Error
Content-Style-Type
X-Oss-Object-Type
X-ElasticPress-Search
Content-Script-Type
X-Webstats-RespID
X-FTR-Cache-Status
X-FTR-Backend-Server
Vha6-Origin
X-Oss-Storage-Class
X-FTR-Balancer
X-RSL
Ohc-Response-Time
X-FTR-Backend
Xc-Version
X-Pad
X-Country-Code-Real
X-Dw-Trace-Id
X-Oss-Request-Id
X-Oss-Server-Time
X-DSS
X-DW
X-RPM
X-RPS
X-Action
X-DI
X-DB
X-C
X-Tt-Logid
X-FTR-Expires
X-MiniProfiler-Ids
X-TH-Server
X-Snapshot-Date
ServerName