Threat Level: green Handler on Duty: Guy Bruneau

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Accept-Ranges
Expect-CT
X-XSS-Protection
CF-RAY
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
P3P
X-Xss-Protection
X-Served-By
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Request-ID
X-Adblock-Key
Access-Control-Allow-Credentials
CF-Ray
X-Permitted-Cross-Domain-Policies
X-AspNet-Version
X-Request-Id
Alt-Svc
Content-Security-Policy-Report-Only
X-Runtime
X-DNS-Prefetch-Control
X-Drupal-Cache
X-Check
X-Cache-Status
X-Generator
X-Cacheable
P3p
Timing-Allow-Origin
X-FRAME-OPTIONS
X-Iinfo
X-Envoy-Upstream-Service-Time
X-Content-Security-Policy
X-Drupal-Dynamic-Cache
Feature-Policy
Content-Encoding
Upgrade
Access-Control-Expose-Headers
Status
X-AspNetMvc-Version
X-CDN
Access-Control-Max-Age
X-Via
Server-Timing
X-UA-Device
X-Robots-Tag
Request-Context
X-Turbo-Charged-By
X-Cache-Group
X-Amz-Request-Id
EagleId
X-Amz-Id-2
X-Backend
Keep-Alive
X-AH-Environment
X-Proxy-Cache
X-Ws-Request-Id
X-Server
X-Age
Host-Header
X-Hacker
X-Ua-Compatible
Cf-Edge-Cache
X-Vhost
X-Server-Powered-By
X-Rq
Allow
X-Varnish-Cache
X-Dispatcher
X-Amz-Version-Id
Grace
X-LiteSpeed-Cache
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-OneAgent-JS-Injection
X-WebKit-CSP
Accept-CH
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Device
Cf-Apo-Via
X-Page-Speed
Cf-Railgun
X-Aws-Lambda-Call-Status
X-Server-Id
X-Host
X-Node
X-Pingback
X-Cache-Spec
X-Nginx-Cache-Status
X-Akam-SW-Version
Surrogate-Control
X-Dns-Prefetch-Control
X-Backend-Server
EagleEye-TraceId
Request-Id
X-Cache-Lookup
X-Readtime
X-Ruxit-JS-Agent
X-HW
X-Cloud-Trace-Context
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Content-Security-Policy-Report-Only
X-Trace
X-Application-Context
X-Response-Time
Accept-CH-Lifetime
Permissions-Policy
X-CST
X-Mod-Pagespeed
X-Nginx-Upstream-Cache-Status
Fastly-Restarts
X-Edge
Accept-Ch-Lifetime
Content-Location
X-Country
X-Content-Type
X-WebKit-CSP-Report-Only
X-Mcache
X-ECACHE
Rating
X-Clacks-Overhead
X-MS-InvokeApp
X-Url
X-TtlSet
X-PC
X-Vname
X-Midtier
X-Amz-Server-Side-Encryption
X-VARITI-CCR
RTSS
X-B3-TraceId
Cache-Tag
X-Vcap-Request-Id
X-Element-Page-Cache
X-D2id
Verso
Origin-Trial
X-Ac
X-Exp-Id
X-Cdn-Fetch
X-Exp-Variant
X-Kinja
X-Use-Magma
X-Kinja-Server
X-Kinja-Revision
X-Kinja-Build
X-Server-Name
X-GoogleNews-Bot
X-Rack-Cache
X-Varnish-TTL
X-Cnection
X-Cache-TTL
X-Powered-By-Plesk
Service-Worker-Allowed
X-ESI
Xkey
X-Navigation-Version
X-Abt-Application-Version
X-NWS-LOG-UUID
X-Ttl
SPRequestGuid
X-SharePointHealthScore
X-Amz-Rid
Edge-Control
X-GitHub-Request-Id
X-Client-IP
X-Cached
X-Fastcgi-Cache
X-Px
X-Mg-S
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Erf-Bev-Bev-Is-Generated
X-Instrumentation
X-Erf-Bev-Bev
X-Browser-Type
Arr-Disable-Session-Affinity
X-Litespeed-Cache
X-Upstream
SPRequestDuration
SPIisLatency
X-Correlation-Id
X-Sol
X-Cache-Key
Display
X-Middleton-Display
Pagespeed
Content-MD5
X-Dw-Request-Base-Id
X-SRCache-Store-Status
X-SRCache-Fetch-Status
Access-Control-Request-Method
X-NF-Request-ID
Edge-Cache-Tag
X-XRDS-Location
X-Goog-Hash
X-Daa-Tunnel
Front-End-Https
X-Country-Code
Public-Key-Pins
X-RateLimit-Remaining
X-Version
X-Forwarded-For
X-Powered-CMS
AR-ATIME
AR-Request-ID
AR-CACHE
AR-SID
AR-PoweredBy
TCN
X-MSEdge-Ref
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
X-T
X-Recruiting
X-Content-Digest
X-Id
X-Accel-Expires
X-Middleton-Response
Response
Mrf-Cache-Status
MRF-Tech
X-B3-TraceId-Primal
X-Shield-Request-Id
X-Ser
TP-Cache
TP-L2-Cache
Nginx-Cache
X-Amzn-Trace-Id
S
X-Hits
X-Request-Processing-Time
X-Request-Received
X-HS-Hub-Id
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Content-Id
Server-Node
Cache-Status
X-Distributor
X-Edge-Location-Klb
X-Kinsta-Cache
X-Fastly-Request-ID
Cache-Tags
MicrosoftSharePointTeamServices
X-Grace
Fastcgi-Cache
Alternate-Protocol
Server-Name
X-Protected-By
X-DataDome
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-Ratelimit-Limit
X-Ezoic-Cdn
X-DIS-Request-ID
X-Origin-Server
X-Geo-Country
X-Ruxit-Js-Agent
X-Ua-Browser
X-LB-Cache
X-Request-Handler-Origin-Region
X-Frontend
X-Microsite
X-Rid
X-Debug-Info
X-Varnish-Backend
X-Ratelimit-Reset
Cross-Origin-Opener-Policy
Cleartype
Healthy
X-Logged-In
X-Www-Served-By
X-Forwarded-Proto
X-Git-Hash
X-NGENIX-Cache
Payment
Filterid
X-FB-Debug
X-Page-Id
X-TTL
X-Load-Cache
X-Ratelimit-Remaining
Charset
X-B3-Sampled
Content-Disposition
X-Webkit-Csp
X-VCache
X-ASPNET-VERSION
X-Origin-Cache
X-LLID
X-Oracle-Dms-Ecid
X-Cluster-Name
X-Oracle-Dms-Rid
DC
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
MS-Author-Via
X-Hostname
X-PressLabs-Stats
X-GUploader-UploadID
X-Goog-Metageneration
X-Upgrade-Enabled
Retry-After
Access-Control-Allow-Method
Accept-Charset
X-Proxy
X-Activity-Id
X-Az
X-AppVersion
X-F-Cache
Cross-Origin-Resource-Policy
X-Type
X-B-Cache
X-Amz-Replication-Status
X-Signature
X-Contextid
X-Hosted-By
X-Revision
X-Is-Crawler
X-Providence-Cookie
X-Route-Name
X-Request-Guid
X-Flags
Paypal-Debug-Id
Accept-Ch
X-Aspnet-Duration-Ms
X-Amz-Meta-S3cmd-Attrs
Viewport
X-Varnish-Server
X-Seen-By
X-Whom
X-TT
X-B
X-Azure-Ref
X-Wix-Request-Id
X-RateLimit-Limit
Surrogate-Key
X-Fb-Rlafr
Amp-Access-Control-Allow-Source-Origin
X-App-Environment
X-DynaTrace
Referer-Policy
Realpath
X-FastCGI-Cache
X-Source
X-Aspnetmvc-Version
Count-Hit
X-Tt-Trace-Tag
X-Akamai-Edgescape
X-Tt-Trace-Host
X-App-Server
X-Mobile
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-ORACLE-DMS-RID
X-ORACLE-DMS-ECID
Host
X-Cache-Control
X-N
X-EdgeConnect-Cache-Status
X-HTML-Minification-Powered-By
X-Tumblr-Pixel-0
X-Varnish-Grace
X-Tumblr-Pixel-1
X-Tumblr-Pixel
X-Original-Request-Id
X-Cache-Rule
X-Response-Served-From
X-Tumblr-User
Version
X-Magnolia-Registration
Refresh
X-Oneagent-Js-Injection
X-Varnish-Age
X-UUID
VIX-Pulpo-Upstream-Status
X-Envoy-Decorator-Operation
VIX-Pulpo-Node
SD-X-WS
Ms-Operation-Id
X-RTag
X-Cache-Time
Access-Control-Request-Headers
MS-CV
X-Rule
Section-Io-Cache
X-Environment-Context
X-Cache-Expired-At
X-FW-Dynamic
X-Cache-Grace
X-Adobe-Loc
X-Adobe-Content
X-FW-Hash
X-Content-Powered-By
X-Cache-Status-Check
X-FW-Static
Protected
X-Status
X-L-Path
X-FW-Serve
Akamai-GRN
X-FW-Server
X-FW-Type
X-FW-Version
X-Page-View
GEO-INFO
NGB
X-G
X-Cacheable-TTL
X-Cache-Age
X-Framework
X-Jobs
X-RemovedCookies
X-ProcessESI
X-Servername
X-Rendered-As
X-Is-Bot
X-Instance
X-Template
X-NYM-Debug-Backend
X-Language
X-Device-Type
X-Http-Reason
Url
X-User-Agent
X-Akamai-Request-ID2
X-Backend-Name
X-Debug-IsPreview
X-Debug-IsConnected
X-Nginx-Cache
X-CDN-Forward
X-B3-Traceid
X-Newrelic-App-Data
SRV
X-Drupal-Cache-Contexts
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Drupal-Cache-Tags
CDN-RequestId
X-Cache-Hit
WPO-Cache-Status
From-Origin
X-Tb
WPO-Cache-Message
X-Trace-Id
Country
X-Region
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
Accept-Language
X-Tt-Logid
Front
X-Node-Name
X-URL
X-Real-IP
X-Amz-Apigw-Id
X-Amzn-RequestId
Fastly-Drupal-HTML
X-Fastly-Request-Id
X-VC-Cache
Backend
Uber-Trace-Id
X-Content-Options
X-Mode
Fastly-SWR
Fastly-SIE
Content-Secure-Policy
X-Unique-Id
X-DynaTrace-JS-Agent
X-Cache-Operation
X-Time
Meta-Geo
X-RN-RSRV
X-Tumblr-Pixel-2
X-UPSTREAM-Address
Filters
X-Generation-Time
X-COUNTRY
X-Rewrite-Enabled
X-Web-Node
X-Proxy-Cache-Info
X-Section
X-Rocket-Nginx-Serving-Static
X-IPS-LoggedIn
X-Cache-TTL-Remaining
Azure-SiteName
Azure-SlotName
X-Cache-Server
X-Zen-Fury
Azure-RegionName
X-Amzn-Remapped-Content-Length
X-Format
Webserver
Onion-Location
X-Access
CF-IPCountry
Azure-InstanceId
Azure-Version
Apigw-Requestid
X-Debug
X-Cache-Host
X-Cms-Context
X-Adobe-Source
X-Cache-Action
X-Say-TTL
X-Sql-Duration-Ms
X-Sucuri-Cache
X-Sucuri-ID
X-Reqid
X-SRV
X-Proxy-Cache-Status
X-Say-Cacheable
X-SayCDN-TTL
X-Sql-Count
TWC-Connection-Speed
TWC-GeoIP-Country
TWC-Device-Class
X-R9-Blue-Green-Version
X-AWS-Id
TWC-Locale-Group
X-BYPASS-REASON
TWC-GeoIP-LatLong
X-ProxyCache-Status
Property-Id
S-Rt
X-Ms-Version
Cross-Origin-Window-Policy
X-PHP-Host
Web-Mar-Node
X-VWS-Id
X-Proto
X-ProxyCache-Key
X-Ms-Request-Id
X-LJ-Flow-ID
Webcakes-App-Name
X-Varnish-Beresp-Grace
X-Soup
X-Content-Age
X-Skip-Cache
X-Via-Fastly
X-Edge-Location
X-IPLB-Instance
X-GeoCode
X-Forwarded-Host
X-Server-W
X-PHP-Backend
TWC-Privacy
X-UA-Device-Type
X-IPLB-Request-ID
Webcakes-App-Version
Webcakes-Region
X-Origin-Hint
X-Cluster
X-Locale
X-Labrador-Cache-Channel
X-GeoCountry
CDN-Uid
CDN-CachedAt
CDN-Cache
CDN-EdgeStorageId
Node
CDN-RequestCountryCode
Cache-Name
CDN-PullZone
X-TIME
X-Proxied
X-No-Session
X-LAGOON
X-Extlb
X-JoinUs
X-Routing-Service
X-LSADC-Cache
X-Urbn-Context-Path
X-Handled-By
X-Site-Version
Cache-Hits
X-Cluster-Node
X-Zipkin-Id
X-Detected-As
X-Xfnlog-Site
X-SaId
X-Urbn-Site-Id
Locale
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Selected-Fe
Mime-Version
X-Proxy-Build
X-Ua
X-Timing-Wait
Mn-Server-Ip
WP-Super-Cache
DB-Nickname
Fastcgi-Useragent
ServerID
Liferay-Portal
X-Hl-Ver
X-FB-TRIP-ID
X-Tumblr-Pixel-3
X-Tec-Api-Version
X-Times
X-Request-Time
ServedBy
X-Tec-Api-Root
X-Tec-Api-Origin
Xserver
X-Redis-Cache
X-Optimistic-Header
X-Cache-Debug
X-XRDS-LOCATION
X-Air-Hostname
X-Air-Source
X-Air-Trace-Id
X-CACHE-AGE
X-Loop
X-TNCMS
Upgrade-Insecure-Requests
X-Buckets
Source
X-Generated-By
X-GEO
X-Origin-Date
X-NWS-UUID-VERIFY
X-Akamai-Transformed
X-Presslabs-Stats
X-Mg-Request-UUID
Countrycode
X-Varnish-Hits
CF-Cached-On
X-Uri
X-Director
X-Pass-Why
X-Varnish-Beresp-Ttl
X-Tid
X-Cdn
X-Tx-Id
X-Storage
X-TA-CDN-Provider
Xet-Cookie
X-Webkit-CSP-Report-Only
X-ARC
Frame-Options
X-Origin-CC
X-DC
X-Origin-TTL
X-FireWall-Port
X-Newrelic-Synthetics
X-Varnish-Ttl
X-Service
X-Varnish-Cache-Hits
X-ECache
X-Sorting-Hat-PodId
X-ShardId
X-Esi
X-App-Version
X-Trace-ID
X-Alternate-Cache-Key
X-ShopId
X-Shopify-Stage
X-Sorting-Hat-ShopId
X-Storefront-Renderer-Rendered
X-Varnish-Hostname
SID
X-Datadog-Sampled
Environment
X-Datadog-Parent-Id
X-Datadog-Trace-Id
X-B3-Spanid
X-Endurance-Cache-Level
X-Datadog-Sampling-Priority
Cache-Tv-Group
X-Request-Host
X-AIR-PT
X-Frame-Option
X-External-Request-Id
X-B-Cookie
Gannett-Cam-Experience-Id
X-Nyt-Route
DCR-Decision-By
X-INCAP-ABP
X-Loc
X-ServerID
X-Mid
A
BehaviorPad-Version
DCR-Processing-Time-Ms
X-Mobile-URL
X-Gdpr
Candidate-Md5Url
Edge-Cache
Meta-Geo-Continent
Rendered-Blocks
Req-Svc-Chain
X-BCube-Filmed-By
Release
Redirect-Candidate
X-CMSURLCustom
X-Cache-NE
X-Cache-Info
Sslversion
Surrogated-Key
Thinkindot-CacheControl-Type
Thinkindot-Control
X-A-Ccd
Thinkindot-CacheControl
TDXMobile
T-Server
X-A-Dcw
X-A-Dam
X-A-Dgt
X-Core-Value
X-A-Wwc
Lang
X-Aed
X-Destination
X-Developer
X-Ec-GeoHdr
X-Ec-Fail
Host-ID
MD5-Digest
X-Bc-Bl
X-A
Origin
WWW-Authenticate
X-BBC-Edge-Cache-Status
X-Application
X-D
Ngx.Var.Host
Odigeo-Trace-Id
X-Epic-Correlation-Id
X-Platform-Router
X-SRCache-Key
X-Vdms-Version
X-VG-TLSProxy
X-Platform-Cluster
X-Platform-Processor
X-Vdms-Path
X-S-Maxage
X-TIM-N
Server-Info
X-Origin-Time
X-S-Cookie
X-S
X-ScT
X-Thinkindot-L3
X-We-Are-Hiring
X-Rojux
Xc-Version
X-Processor
X-Sn-Servicetimems
X-Ec-Custom-Error
Memcached
X-SVT-ORM-RULES
X-Fmm-Version
DSUID
Decoy-Debug-TTL
Decoy-Debug-Status
Decoy-Debug-Key
X-SD-PageType
X-Gamma-Serve
Fastly-GeoIP-CountryCode
Fastly-Backend-Name
X-Developers
X-Sigma
X-Sigma-Backend
X-DefElseHash
X-WA-Info
X-VServer
X-Cdn-Origin
X-Cdn-Srv
X-WADP-Cache
State
X-WP-CF-Super-Cache-Active
X-Cache-Bucket
Server-Host
X-Clara-WADP
X-Core-Mission
X-Auto-Login
Magicmarker
X-DefHash
X-Test
X-Pubstack
X-CUA
X-Varnish-Remaining-TTL
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
X-SVT-ORM-VERSION
Country-Code
X-JWT-State
X-Rocket-Build-Number
Vix-Hermes-Req-Id
X-Restarts
X-Is-Gdpr
X-SB
X-Akamai-Device-Characteristics
X-HS-Content-Campaign-Id
X-Httpd
X-Generated-On
X-Location
X-Origin-Response-Time
X-RM-Cache-TTL
X-Old-Content-Length
X-NodeID
X-Served-From
X-Req
X-Platform-Server
X-Level-Front-Cache
X-Has-Esi
X-Human
Click-Count-Action-Start
Tube-Got-Eval
X-GeoIP-City
Click-Count-Error
Cluster
X-Worker
Tube-Get-Contents
X-Geo-Header
Tube-Return
Tube-Got-Results
Apple-News-Services-Request-Url
Apple-News-Services-Host
C-Via
Apple-News-Services-Parsed-Url
Cache-Host
Apple-News-Services-Handled
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
Section-Io-Id
Section-Origin-Responded
X-Vmg-Version
X-Conf
X-Varnish-Beresp-Status
X-App
X-Pool
AKAMAI
Cache-Key
CloudFront-Viewer-Country
X-Fetched-On
Ssr
X-Bip
Svr
X-Ad-Defer-Variation
X-Thanos
X-Slack-Backend
X-LB-NoCache
X-Request-Start
X-Hnp-Log
X-Hash
X-GeoIP-Region-Code
X-Gzip
X-Minions-Version
X-Nananana
X-Node-Id
X-Origin
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Accel-Expires-Debug
X-Planisys-CDN-TTL
X-GeoIP-Country-Code
X-GeoIP
X-Var-Ttl
X-Date
X-Variation
X-Cache-Id
X-Cache-Backend
X-Wix-Viewer-Type
X-Up
X-Dispatcher-Number
X-Scale
X-Gen-Mode
X-Fastly-Backend
X-Esi-Check
X-DPWN-IS-SECURE
X-Block-Status
X-Cache-FS-Status
NM-Fastcgi-Cache
Mail-Subject
L
Origin-CC
Origin-EX
Producers
Platform
Pics-Label
Kp-EeAlive
Is-Eu
CacheControlHeader
Cache-Provider
X-Accel-Buffering
CDCHOST
Cmsid
Gh-Request-Id
Cmstype
Server-Ext
Adler-Geo
Sever-Int
Server-Hostname
Web-Mar-Region
We-Hiring
User-Cache-Control
X-Parent-Response-Time
X-Owner
X-Qloud-Router
X-Op-Id-All
X-NCache
X-Nginx-Cache-Key
X-Men
Cdn
X-Forwarded-Site
X-Org
X-HN
X-Varnishpool
X-V-Cache
X-Dispatcher-Server
X-Region-Sid
X-Mvc-Supplant-Cachable
Machine
X-Refresh
NGX
Datacenter
X-Server-IP
X-VarnishDD-TTL
X-Slack-Shared-Secret-Outcome
On-Server
X-Platform
X-FC-Vary-Parameters
X-Ckpd-Fst-Backend
X-Azure-Ref-OriginShield
Wxu-Next-Region
Wxu-Next-Commit
Wxu-Next-Hostname
X-Device-Os
X-Irp-Debug
X-Cached-By
X-Cache-Tags
X-CacheTTL
Fastly-SSL
PFcat
X-CSRF-Token
X-Server-ID
Ha-Gx-Prefs
X-Via-Popv
HA-Ipaddr
Canary
X-CGP
X-Csrf-Jwt
L5d-Success-Class
X-Via-Popn
X-Eu-Site
X-Via-Poph
X-Cache-Date
X-Servedbyhost
Env
X-Mvc-Supplant-OutputCached
HostName
X-HA-Backend
X-Aicache-OS
GeoIP-Latitude
X-Client-Ip
Cdncip
X-Cache-Remote
X-RCS-CacheZone
Server-ID
X-AK-Request-ID
X-Tb-Optimization-Total-Bytes-Saved
Cdnsip
X-Microcachable
X-VC
X-Mly-Id
X-APP-VERSION
X-Gateway-Cache-Status
X-Gateway-Cache-Key
X-API-Version
X-Fpc
X-Gateway-Request-Id
X-Wa
X-DataCenter
X-Gateway-Skip-Cache
X-LB-ID
X-ZONE
X-Zone
Load-Balancing
Cache
X-Generated-In
Time
X-Nc
Memory
X-Fastly-Cache
Request-ID
X-Webkit-CSP
X-Check-Cacheable
X-Via-NSCOPI
X-ND-Cache
X-Instance-Name
X-Origin-Expires
Eomportal-Instance
X-Vc
X-Vgn-Hpd-Ssi
X-Vgn-Hpd-Cached
X-Vgn-Hpd-Variations-Key
Ngx-Var-Key
X-Response-By
X-Micro-Cache
X-HS-Status
X-Release
OT-Force-Account-Verify
X-Correlation-ID
Locid
X-From
X-Hcs-Proxy-Type
Expect-Staple
X-FL-EDGE
Srvid
X-CCDN-CacheTTL
X-FL-QIT-DEBUG
X-CCDN-Origin-Time
X-NewRelic-App-Data
X-VCL-Version
Hostname
X-Api-Version
X-Cache-Enabled
X-CS
X-Via-CDN
IsBot
X-Request-URI
X-SIPLIST1
NtCoent-Length
X-Via-Edge
Edge-Copy-Time
X-Edge-Pop
X-Via-SSL
AMP-Access-Control-Allow-Source-Origin
X-CSRF-TOKEN
X-Cache-NGX
X-Info
X-NGINX-Cache
X-Provided-By
Srv
X-Via-JSL
GeoIp-Country-Code
Uri
True-Client-Ip
X-MCACHE
X-Srv
XkeyRZ
X-Proxy-CacheRZ
X-Debug-Cache-Store
X-Lambda-Id
X-Debug-Cache-Fetch
X-Amz-Meta-Cb-Modifiedtime
X-Nf-Request-Id
Location
True-Client-IP
X-B3-SpanId
X-Dc
X-EC-Lua
X-Render-Time
X-Vtex-Remote-Cache
Sid
X-Air-Pt
VNS-Cache
Path
VNS-Age
X-Vcl-Version
Servername
X-Cache-Expires
GeoIP-Country-Code
X-Edge-POP
CPC-Age
CPC-Cache
X-Cs
X-Oss-Hash-Crc64ecma
X-Oss-Object-Type
X-Oss-Server-Time
X-Oss-Request-Id
X-Oss-Storage-Class
Resin-Trace
X-TH-Server
X-Fastly-Country-Code
X-VCT
Cross-Origin-Opener-Policy-Report-Only
X-RateLimit-Reset
Fastly-Drupal-Html
X-CLOUD-TRACE-CONTEXT
Traceparent
X-Moov-T
X-Moov-Xdn-Version
CDN
X-ATG-Version
Esi-Enabled
X-MSEdge-Features
X-Varnish-Authentication
X-MSEdge-Flight
X-Contensis-Viewer-Groups
X-Cache-ASPX
LB
X-Viewer-Country
X-Cdn-Request-ID
X-Scheme
X-Accel-Version
X-TX-ID
X-Pod-Name
X-PERF
M-TraceId
Timeexpire
X-ApacheServer
YJS-ID
X-Varnish-Beresp-TTL
X-Upstream-Ct
X-Akamai-Pragma-Client-IP
X-Upstream-Ht
X-RateLimit-Remaining-Second
X-Datadome
X-FPC
Powered-By
X-CF-Lambda-Fn
X-RateLimit-Limit-Second
X-Datacenter
FSS-Cache
X-Udemy-Cache-App-Namespace
X-Cdn-Cache-Status
Rip
X-Cache-Type
X-CF-Lambda-Version
CountryCode
X-PAYTM-SRV-ID
X-NAPM-TraceId
X-WA
HIT
Sm-Log-Id
X-Service-Response-Time
X-Lb-Id
X-SERVER-NAME
X-Github-Request-Id
X-Geo
XServer
X-Srcache-Fetch-Status
X-CACHE-KEY
X-NC
Tracecode
True-Client-Country-4JS
Proxy-Connection
V-Age
X-Srcache-Store-Status
Server-Id
RNT-Time
X-Wikidot-Static-Cache
X-Clientip
Ohc-File-Size
N-Cache
RNT-Machine
X-Wikidot-Backend
X-ID
X-Hyper-Cache
X-CDN-Cache-Status
XM
X-Bl-Debug
ENV
X-TraceId
X-Shop-Environment
X-Orig-Expires
X-Forwarded-Path
X-LiteSpeed-Cache-Control
X-Tenant
Epwk-X-Cache
X-ServedByHost
X-VG-WebCache
Yjs-Id
X-Cdn-Forward
X-B3-Trace-ID
X-B3-Parentspanid
Ngx
X-MP-GENERATED-AT
Geoip-Latitude
X-Ha-Backend
WZWS-RAY
X-M-Reqid
X-M-Log
Content-Style-Type
X-MiniProfiler-Ids
Content-Script-Type
X-Dw-Trace-Id
User-Agent
X-Swift-Error
X-Serial
Ec-Rule-Version
X-Lb-Nocache
X-Vgn-Hpd-Reason
X-App-Name
X-Cdn-Diag
X-Fastly-Backend-Reqs
X-Via-PopN
X-Via-PopH
X-Via-PopV
X-Qnm-Cache
X-Policy
X-B3-ParentSpanId
X-Amz-Meta-Opti
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
Inserted-Into-Cache-At
X-Wp-Cf-Super-Cache
X-TT-LOGID
X-Lsadc-Cache
Serverid
X-UA
X-F-Status
X-Wp-Cf-Super-Cache-Cache-Control
Lb
X-Ramcache
X-Acquia-Purge-Tags
X-Acquia-Application-Trace
X-Acquia-Site
X-Acquia-Application-UUID
X-Mid-Debug-Cache-Key
X-Request-URL
X-Connection-Hash
X-UP
X-Mid-Debug-Cache-Disk
X-Stale
Pramga
Expiry
X-Cache-Ngx
Req-ID
My-App
X-LiteSpeed-Tag
X-Th-Server
MIME-Version
Cneonction
X-IPS-Cached-Response
Warning
X-Snapshot-Date