Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-UA-Compatible
X-Xss-Protection
X-Served-By
CF-Ray
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-FRAME-OPTIONS
X-Envoy-Upstream-Service-Time
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-Dns-Prefetch-Control
X-Drupal-Dynamic-Cache
Feature-Policy
Server-Timing
X-Content-Security-Policy
Access-Control-Expose-Headers
X-XSS-PROTECTION
Content-Encoding
Status
X-CDN
Upgrade
X-Request-ID
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Amz-Id-2
X-Via
Request-Context
X-Turbo-Charged-By
X-Backend
X-Cache-Group
X-AH-Environment
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-Hacker
X-Proxy-Cache
X-UA-Device
X-Vhost
X-Server
X-Rq
X-Server-Powered-By
Allow
X-Ws-Request-Id
X-Age
X-Varnish-Cache
X-Dispatcher
EagleId
X-Amz-Version-Id
P3p
Nel
X-LiteSpeed-Cache
Grace
Cf-Apo-Via
Cf-Railgun
X-Page-Speed
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
EagleEye-TraceId
X-Aws-Lambda-Call-Status
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Pingback
X-OneAgent-JS-Injection
X-Host
X-WebKit-CSP
X-Node
X-Cache-Lookup
X-CST
X-Server-Id
Accept-CH
X-Backend-Server
Surrogate-Control
X-Readtime
Permissions-Policy
X-Nginx-Cache-Status
X-Nginx-Upstream-Cache-Status
X-Akam-SW-Version
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Request-Id
X-Application-Context
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
X-Ua-Compatible
Accept-CH-Lifetime
X-Response-Time
X-HW
X-Trace
Xkey
X-Edge
Content-Location
X-Ruxit-JS-Agent
X-Clacks-Overhead
X-Mod-Pagespeed
Accept-Ch-Lifetime
Rating
Accept-Ch
X-Oneagent-Js-Injection
X-Midtier
X-Amz-Server-Side-Encryption
X-ESI
X-Url
X-ECACHE
X-Mcache
Cache-Tag
X-Country
X-MS-InvokeApp
X-Upstream
X-Rack-Cache
X-Vcap-Request-Id
X-D2id
X-Powered-By-Plesk
Verso
X-Kinja-Server
X-Use-Magma
X-GoogleNews-Bot
X-Exp-Id
X-Cdn-Fetch
X-Exp-Variant
X-Kinja
X-Kinja-Build
X-Kinja-Revision
X-Element-Page-Cache
Edge-Control
X-WebKit-CSP-Report-Only
X-Vname
X-PC
X-TtlSet
RTSS
Service-Worker-Allowed
X-Ac
X-Country-Code
Origin-Trial
X-Ruxit-Js-Agent
X-VARITI-CCR
X-Navigation-Version
X-GitHub-Request-Id
Fastly-Restarts
X-Goog-Hash
X-Abt-Application-Version
X-Cache-TTL
X-Varnish-TTL
X-Litespeed-Cache
X-Browser-Type
X-Aspnetmvc-Version
X-Cached
X-Amz-Rid
X-Kinja-CCPA
X-Webkit-CSP
Cross-Origin-Opener-Policy
X-Sol
Pagespeed
Display
X-Middleton-Display
X-Server-Name
X-Dw-Request-Base-Id
X-NWS-LOG-UUID
X-Amzn-Trace-Id
SPRequestGuid
X-SharePointHealthScore
X-ORACLE-DMS-RID
X-ORACLE-DMS-ECID
X-Powered-CMS
SPRequestDuration
SPIisLatency
X-Erf-Bev-Bev
X-Content-Type
X-Times
X-Server-Lifecycle-Phase
X-Erf-Bev-Bev-Is-Generated
X-Kraken-Loop-Name
X-Instrumentation
AR-PoweredBy
AR-SID
AR-Request-ID
AR-ATIME
X-Cache-Key
X-Mg-S
X-Pinterest-Rid
Pinterest-Generated-By
Pinterest-Version
X-Fastly-Request-ID
Arr-Disable-Session-Affinity
Response
X-Middleton-Response
X-Ttl
X-B3-Traceid
X-Version
X-FastCGI-Cache
X-Client-IP
X-Jurisdiction
X-HP-Webp
X-HP-Trace-Id
X-Cnection
X-Ser
Nginx-Cache
AR-CACHE
X-Accel-Expires
Cache-Tags
X-T
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-B3-TraceId
Cache-Status
Edge-Cache-Tag
X-NF-Request-ID
Front-End-Https
X-Hits
X-MSEdge-Ref
X-Px
Public-Key-Pins
X-RateLimit-Remaining
X-Recruiting
Payment
X-Request-Processing-Time
X-LLID
X-Request-Received
X-Frontend
X-B3-TraceId-Primal
Mrf-Cache-Status
X-Ua-Browser
MRF-Tech
S
Server-Node
X-Shield-Request-Id
X-TTL
X-RateLimit-Limit
X-PressLabs-Stats
X-DIS-Request-ID
X-GUploader-UploadID
X-Goog-Metageneration
Content-MD5
X-Daa-Tunnel
MicrosoftSharePointTeamServices
Access-Control-Request-Method
X-Amzn-RequestId
X-Amz-Apigw-Id
TP-Cache
X-Content-Digest
X-Protected-By
Realpath
X-HS-Cache-Config
X-Request-Handler-Origin-Region
X-HS-Combine-CSS
X-HS-Hub-Id
X-Distributor
X-Microsite
X-HS-Content-Id
Fastcgi-Cache
Access-Control-Allow-Method
X-FB-Debug
X-Forwarded-For
X-LB-Cache
X-Ratelimit-Remaining
X-Page-Id
X-Cluster-Name
Accept-Charset
X-Rid
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Server-ID
X-Geo-Country
X-Aspnet-Version
TP-L2-Cache
X-Fastcgi-Cache
X-Ua-Device
X-Hostname
X-B3-Sampled
X-Ezoic-Cdn
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Storage-Class
X-Goog-Generation
X-Seen-By
Count-Hit
Cross-Origin-Resource-Policy
Cleartype
X-Correlation-Id
X-Ratelimit-Limit
TCN
X-Newrelic-App-Data
Referer-Policy
X-App-Server
X-Webkit-CSP-Report-Only
X-Kinsta-Cache
X-Mobile
X-Edge-Location-Klb
X-Logged-In
X-Content-Options
X-Varnish-Backend
DC
X-Hosted-By
X-Origin-Cache
X-Git-Hash
X-Id
X-Contextid
X-Request-Guid
X-Debug-Info
X-Amz-Replication-Status
X-Route-Name
X-Providence-Cookie
X-Aspnet-Duration-Ms
X-Fb-Rlafr
X-Is-Crawler
X-Flags
X-Revision
X-Grace
Surrogate-Key
X-IPS-LoggedIn
X-App-Environment
Frame-Options
X-TT
X-Varnish-Grace
Retry-After
X-Amz-Meta-S3cmd-Attrs
X-Envoy-Decorator-Operation
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Forwarded-Proto
X-F-Cache
X-Azure-Ref
X-Xrds-Location
Section-Io-Cache
X-Magnolia-Registration
X-Wix-Request-Id
X-Whom
X-RateLimit-Reset
Healthy
X-COUNTRY
Charset
X-Origin-Server
Alternate-Protocol
MS-Author-Via
X-Akamai-Edgescape
X-Proxy-Cache-Info
X-App-Version
Viewport
X-Backend-Name
X-Language
X-Www-Served-By
WPO-Cache-Status
WPO-Cache-Message
X-Az
X-Activity-Id
Paypal-Debug-Id
X-B
X-AppVersion
SRV
Amp-Access-Control-Allow-Source-Origin
X-Varnish-Server
Filterid
X-Datadog-Sampling-Priority
VIX-Pulpo-Upstream-Status
X-Http-Reason
X-Original-Request-Id
X-Response-Served-From
VIX-Pulpo-Node
X-Cache-Rule
X-Datadog-Parent-Id
X-Datadog-Trace-Id
Host
X-Client-Ip
SD-X-WS
X-DataDome
X-Rule
X-Akamai-Request-ID2
X-N
Server-Name
X-Instance
Front
X-User-Agent
X-UUID
X-Nf-Request-Id
X-Cache-Grace
Country
Akamai-GRN
X-Edge-Location
X-Environment-Context
X-ARC
X-Cacheable-TTL
From-Origin
X-EdgeConnect-Cache-Status
Protected
X-Region
X-Unique-Id
X-Varnish-Age
X-Jobs
X-Status
X-L-Path
X-Page-View
ServerID
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Adobe-Loc
Fastly-SWR
X-Adobe-Content
Fastly-SIE
X-FW-Static
X-Tumblr-Pixel
X-Rocket-Nginx-Serving-Static
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Tumblr-User
X-Rendered-As
X-Is-Bot
X-FW-Hash
X-FW-Dynamic
X-FW-Serve
X-FW-Server
X-FW-Type
X-Framework
X-FW-Version
X-Load-Cache
X-RemovedCookies
X-Yottaa-Metrics
X-Vcache
X-Cache-Time
X-Type
X-Yottaa-Optimizations
X-G
X-ProcessESI
X-Proxy
X-Trace-Id
Access-Control-Request-Headers
X-Datadog-Sampled
X-Mg-Request-UUID
Content-Disposition
X-XRDS-Location
X-Debug-IsPreview
X-Debug-IsConnected
X-Signature
X-Amzn-Remapped-Content-Length
X-B-Cache
X-ECache
X-URL
X-Time
X-CDN-Forward
X-Cache-Control
X-Tec-Api-Origin
X-Tec-Api-Root
X-Tec-Api-Version
Backend
X-WP-CF-Super-Cache
X-WP-CF-Super-Cache-Cache-Control
X-Erf-Web-Scheduler
Refresh
Countrycode
X-Drupal-Cache-Tags
X-DynaTrace
Accept-Language
Xet-Cookie
X-Cache-Age
X-Servername
X-Httpd
X-Nginx-Cache
X-Generated-By
CF-IPCountry
X-DynaTrace-JS-Agent
Url
X-Source
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-HTML-Minification-Powered-By
X-Mode
X-Template
Webserver
X-Device-Type
X-NYM-Debug-Backend
Xserver
X-Content-Powered-By
X-Storage
Version
GEO-INFO
X-Content-Age
Onion-Location
S-Rt
X-XRDS-LOCATION
OT-Force-Account-Verify
X-UPSTREAM-Address
X-LAGOON
X-GeoCode
Locale
X-Director
Load-Balancing
Filters
X-Cache-Action
X-SaId
X-Rewrite-Enabled
X-GeoCountry
X-Urbn-Site-Id
Meta-Geo
X-Generation-Time
X-Cache-Operation
X-Urbn-Context-Path
X-JoinUs
X-Say-TTL
X-Rn-Rsrv
X-SayCDN-TTL
X-ServerID
X-Say-Cacheable
X-Cluster-Node
X-Git-Commit
X-MCACHE
X-Varnish-Cache-Hits
X-Forwarded-Host
X-Soup
X-Varnish-Hostname
X-Container-Uri
X-VC-Cache
X-Detected-As
X-Ms-Request-Id
X-Tb
X-Adobe-Source
X-Lambda-Id
X-RM-Cache-TTL
Azure-Version
Web-Mar-Node
X-Served-From
X-Sql-Count
Azure-SlotName
Azure-SiteName
X-Tncms
Azure-InstanceId
Azure-RegionName
X-Loop
X-Sql-Duration-Ms
X-Ms-Version
X-PHP-Host
X-Proto
X-Tt-Logid
X-Cache-Server
X-CCDN-CacheTTL
X-Labrador-Cache-Channel
X-VCT
X-Hcs-Proxy-Type
X-CCDN-Origin-Time
X-Logging-Id
Node
X-RCS-CacheZone
Mn-Server-Ip
X-R9-Blue-Green-Version
DB-Nickname
X-Zipkin-Id
X-Cache-Hit
X-Format
X-Skip-Cache
X-Routing-Service
X-Extlb
X-Tumblr-Pixel-2
X-Proxied
X-Tumblr-Pixel-3
X-FB-TRIP-ID
TWC-Locale-Group
TWC-GeoIP-LatLong
X-Uri
TWC-GeoIP-Country
TWC-Privacy
X-Debug
X-Fetched-On
TWC-Device-Class
X-Timing-Wait
X-Proxy-Build
X-Ua
Uber-Trace-Id
Webcakes-App-Name
Webcakes-Region
X-Origin-Hint
Webcakes-App-Version
Fastcgi-Useragent
TWC-Connection-Speed
Property-Id
Cross-Origin-Window-Policy
Selected-Fe
X-LSADC-Cache
X-Webkit-Csp
X-Zen-Fury
X-Endurance-Cache-Level
X-Redis-Cache
Source
X-Sucuri-Cache
X-Sucuri-ID
CDN-RequestId
X-B3-SpanId
X-Oracle-Dms-Ecid
X-Srv
X-Oracle-Dms-Rid
X-Drupal-Cache-Contexts
Section-Io-Origin-Status
X-Upgrade-Enabled
X-Ratelimit-Reset
Section-Io-Origin-Time-Seconds
Section-Io-Id
Section-Origin-Responded
X-NGENIX-Cache
X-TimeS
X-CACHE-AGE
X-Newrelic-Synthetics
X-S
X-MP-GENERATED-AT
X-Origin-Date
X-Pass-Why
X-Varnish-Hits
Fastly-Drupal-HTML
Liferay-Portal
X-Origin-TTL
X-Origin-CC
X-Cache-Expired-At
Upgrade-Insecure-Requests
X-Real-IP
X-Akamai-Transformed
X-FTR-Request-ID
NGB
X-Handled-By
X-GEO
X-Cache-TTL-Remaining
X-TIME
X-UA-Device-Type
X-Hl-Ver
X-ID
X-Optimistic-Header
X-Node-Name
Apigw-Requestid
X-Cache-Type
X-Reqid
X-Cms-Context
X-Varnish-Ttl
X-Xfnlog-Site
CDN-Cache
CDN-RequestCountryCode
X-Restarts
CDN-RequestPullCode
CDN-RequestPullSuccess
CDN-Uid
ServedBy
CDN-PullZone
X-Via-JSL
CDN-CachedAt
CDN-EdgeStorageId
X-Pubstack
Ms-Operation-Id
MS-CV
X-BYPASS-REASON
X-ProxyCache-Key
X-No-Session
X-ProxyCache-Status
X-Tx-Id
X-Cache-Host
X-RTag
X-Parent-Response-Time
WP-Super-Cache
X-Server-W
Candidate-Md5Url
X-Aed
Canary
X-BCube-Filmed-By
X-App
X-B-Cookie
X-Bl-Debug
X-Application
X-App-Name
X-Bc-Bl
X-Ec-Custom-Error
X-Debug-Cache-Fetch
X-VWS-Id
X-Debug-Cache-Store
X-LJ-Flow-ID
X-IPLB-Instance
X-IPLB-Request-ID
X-Cache-NE
X-D
X-CF-Lambda-Fn
X-CGP
X-Conf
X-CacheTTL
X-Csrf-Jwt
X-Cluster
X-AWS-Id
X-External-Request-Id
X-Eu-Site
X-Fastly-Backend
X-FC-Vary-Parameters
X-Forwarded-Path
X-Epic-Correlation-Id
X-Ec-GeoHdr
X-Destination
BehaviorPad-Version
X-Developer
X-Dispatcher-Number
X-Ec-Fail
X-Gdpr
Gannett-Cam-Experience-Id
MD5-Digest
Magicmarker
Meta-Geo-Continent
N-Cache
Ngx.Var.Host
T-Server
X-Tenant
True-Client-Country-4JS
L
X-Slack-Shared-Secret-Outcome
L5d-Success-Class
X-SRCache-Key
Vix-Hermes-Req-Id
Surrogated-Key
X-Vdms-Path
Rendered-Blocks
X-We-Are-Hiring
X-Worker
Xc-Version
Content-Secure-Policy
Redirect-Candidate
X-Vtex-Remote-Cache
Origin-Agent-Cluster
Odigeo-Trace-Id
X-Vdms-Version
Sslversion
X-Viewer-Country
Server-Host
X-Slack-Backend
Lang
X-A-Dam
X-A-Dcw
X-A-Ccd
X-A
X-CF-Lambda-Version
Fastly-SSL
X-A-Dgt
X-A-Wwc
X-Nyt-Route
DCR-Decision-By
DCR-Processing-Time-Ms
X-Orig-Expires
X-Origin-Time
X-Request-Host
Web-Mar-Region
W
X-S-Cookie
X-ScT
Ha-Gx-Prefs
X-Shop-Environment
HA-Ipaddr
X-Rojux
X-SD-PageType
X-CSRF-Token
X-Accel-Buffering
Release
X-Alternate-Cache-Key
X-Cdn-Diag
TDXMobile
VNS-Cache
Thinkindot-CacheControl
X-Cdn-Origin
Req-Svc-Chain
Thinkindot-CacheControl-Type
VNS-Age
X-Cache-Info
Thinkindot-Control
X-Cache-Bucket
We-Hiring
X-Accel-Expires-Debug
X-Cache-Debug
X-Bip
X-Mly-Id
X-Storefront-Renderer-Rendered
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Thanos
X-Test
X-Sn-Servicetimems
X-Shopify-Stage
X-Request-Time
X-Refresh
X-S-Maxage
X-Server-IP
X-ShopId
X-ShardId
X-Thinkindot-L3
X-Up
X-VServer
X-Vmg-Version
X-Wikidot-Backend
X-Wikidot-Static-Cache
Host-ID
X-Wix-Viewer-Type
X-VG-WebCache
X-VG-TLSProxy
X-Variation
X-Var-Ttl
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Varnishpool
X-Varnish-Remaining-TTL
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-GeoIP-Region-Code
X-GeoIP-Country-Code
X-Geo-Header
X-Hash
X-Human
X-Level-Front-Cache
X-Irp-Debug
X-Generated-On
X-DPWN-IS-SECURE
X-Core-Mission
X-CMSURLCustom
X-Core-Value
X-Date
X-DefHash
X-DefElseHash
X-Loc
X-Mid
X-PAYTM-SRV-ID
X-Owner
X-Platform
X-Policy
X-Qloud-Router
X-Pool
X-Org
X-Old-Content-Length
X-Mvc-Supplant-Cachable
Producers
X-Nananana
X-Nitro-Cache
X-NodeID
X-Node-Id
X-Clientip
X-BBC-Edge-Cache-Status
CPC-Age
Is-Eu
X-AB
Adler-Geo
Cmstype
X-Correlation-ID
Cmsid
Gh-Request-Id
X-Proxy-Cache-Status
Datacenter
Environment
Expect-Staple
Fastly-Backend-Name
CPC-Cache
Fastly-GeoIP-CountryCode
Cf-Device-Type
Mail-Subject
AKAMAI
Cache-Provider
X-Micro-Cache
Origin
Platform
X-Vcl-Version
User-Cache-Control
X-Cache-Status-Check
Apple-News-Services-Handled
Apple-News-Services-Request-Url
Apple-News-Services-Host
X-Cache-Id
X-Akamai-Device-Characteristics
X-Clara-WADP
X-Block-Status
DSUID
X-Auto-Login
X-Datadome
CDCHOST
X-Gzip
CloudFront-Viewer-Country
X-ApacheServer
Country-Code
X-Cdn-Srv
X-PERF
Sever-Int
X-Forwarded-Site
X-Fmm-Version
Cache-Name
NM-Fastcgi-Cache
X-INCAP-ABP
Server-Hostname
X-Gen-Mode
X-GeoIP
X-Hnp-Log
X-From
Server-Ext
X-Esi-Check
X-Mvc-Supplant-OutputCached
X-Origin
X-Nginx-Cache-Key
X-Origin-Response-Time
Apple-News-Services-Parsed-Url
Esi-Enabled
X-WADP-Cache
X-WA-Info
Machine
X-Device-Os
X-Dispatcher-Server
X-B3-Spanid
X-Geo-Region
X-Op-Id-All
X-NCache
X-LB-NoCache
X-Section
Wxu-Next-Commit
Wxu-Next-Hostname
NGX
Server-Info
X-Instance-Name
X-AIR-PT
Ssr
X-Access
Wxu-Next-Region
Pics-Label
X-Cache-Enabled
C-Via
X-Amz-Meta-Cb-Modifiedtime
X-API-Version
AMP-Access-Control-Allow-Source-Origin
X-TraceId
X-Is-Gdpr
Memcached
X-JWT-State
X-Dc
Server-ID
X-Has-Esi
X-CACHE-GROUP
X-Vgn-Hpd-Reason
X-Via-Fastly
X-Accel-Version
X-HA-Backend
Time
Hostname
Memory
X-Varnish-Beresp-Ttl
X-Buckets
X-Varnish-Beresp-Grace
IsBot
X-Tcp-Rtt
X-Is-Desktop
X-SIPLIST1
Origin-CC
Cache-Hits
X-Browser-Name
X-Is-Supported-Browser
X-Is-Tablet
X-Is-Mobile
X-Scale
Origin-EX
X-Platform-Router
X-Platform-Processor
X-PHP-Backend
X-Wp-Cf-Super-Cache-Active
X-TIM-N
Cdn-Requestid
X-Platform-Cluster
X-ZONE
Sid
X-Fastly-Request-Id
X-Air-Trace-Id
Location
X-Tb-Optimization-Total-Bytes-Saved
X-Air-Source
X-Air-Hostname
CF-Ctrl
X-B3-Parentspanid
YJS-ID
X-Zone
X-Backend-Instance
X-Internal-Host
X-Cached-By
X-WP-CF-Super-Cache-Active
X-Fpc
Resin-Trace
X-Azure-Ref-OriginShield
X-Cs
X-DC
X-Frame-Option
GeoIP-Latitude
Epwk-X-Cache
X-Hyper-Cache
X-Presslabs-Stats
X-TA-CDN-Provider
X-Origin-Expires
X-Origin-Cache-Key
Cache-Host
Uri
X-DataCenter
X-Microcachable
X-LiteSpeed-Cache-Control
X-Esi
True-Client-Ip
X-VC
X-Service
XM
X-NGINX-Cache
X-Webstats-RespID
X-Info
X-Nitro-Rev
X-Nitro-Cache-From
X-Site-Version
X-Web-Node
LB
X-Locale
GeoIP-Country-Code
X-Pod-Name
X-CSRF-TOKEN
X-VarnishDD-TTL
GeoIp-Country-Code
X-HN
PFcat
X-FTR-Backend-Server
X-FTR-Balancer
X-FTR-Cache-Status
X-FTR-Expires
X-FTR-Backend
X-Country-Code-Real
X-VCache
X-Cache-Ttl
X-Ad-Defer-Variation
Cdn
X-CS
XServer
User-Agent
X-NewRelic-App-Data
X-Edge-Server
X-FL-EDGE
Edge-Copy-Time
X-Via-CDN
A
X-Via-SSL
True-Client-IP
Srvid
X-FL-QIT-DEBUG
Locid
NtCoent-Length
X-Via-Edge
Cdn-Request-Time
Cdn-Host
X-Datacenter
X-Geo
WZWS-RAY
X-Vercel-Cache
Req-ID
WebServer
X-SRV
X-NMSegId
M-TraceId
X-Vercel-Id
X-TRACE-ID
SID
X-Pad
X-Moov-Xdn-Version
X-FireWall-Port
X-Moov-T
X-MSEdge-Flight
X-FPC
X-Cache-ASPX
X-MSEdge-Features
Fastly-Drupal-Html
X-Ad-Load-Variation
X-Varnish-Authentication
X-Contensis-Viewer-Groups
X-ATG-Version
X-HostName
Tcn
Pramga
X-Scope-Id
X-LiteSpeed-Tag
Cache-Key
X-Request-Start
X-M-Reqid
Cluster
X-M-Log
X-Api-Version
X-Cdn-Request-ID
CountryCode
X-APP-VERSION
Cf-Ipcountry
X-Air-Pt
X-AK-Request-ID
X-Varnish-Beresp-Status
X-Request-URI
Cdncip
X-Shield-Cache-Expires
X-Qnm-Cache
Content-Style-Type
X-Amz-Meta-Opti
X-NWS-UUID-VERIFY
Content-Script-Type
Cdnsip
Path
X-Branch-Name
HostName
X-Cache-Date
Edge-Cache
X-Wp-Cf-Super-Cache-Cookies-Bypass
X-Proxy-CacheRZ
Yak-Timeinfo
X-Platform-Server
State
Cache-Tv-Group
X-TH-Server
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-HS-Content-Campaign-Id
XkeyRZ
X-Planisys-CDN-TTL
X-WP-CF-Super-Cache-Cookies-Bypass
X-Rebelmouse-Cache-Control
X-Upstream-Ht
X-Upstream-Ct
X-CACHE-KEY
X-Rebelmouse-Surrogate-Control
CDN
X-Tim-N
X-Akamai-Pragma-Client-IP
Click-Count-Action-Start
X-Fastly-Cache
Geoip-Latitude
X-Render-Time
X-B3-Trace-ID
X-Vgn-Hpd-Ssi
X-Vgn-Hpd-Cached
X-Vgn-Hpd-Variations-Key
X-Wa
X-Nc
X-Via-Popv
X-Cdn-Forward
Srv
X-SB
X-V-Cache
X-Req
X-Wp-Cf-Super-Cache
X-Wp-Cf-Super-Cache-Cache-Control
X-Release
X-LB-ID
Tube-Got-Results
Tube-Return
Tube-Got-Eval
Tube-Get-Contents
Proxy-Connection
Click-Count-Error
X-Servedbyhost
X-Via-Poph
X-Cache-FS-Status
Wpo-Cache-Message
X-Acquia-Purge-Cdn-Unconfigured
Wpo-Cache-Status
X-Via-Popn
X-Aicache-OS
X-Lb-Cache
X-Men
V-Age
X-Vary
X-User
On-Server
MIME-Version
X-Dw-Trace-Id
X-Rocket-Build-Number
X-Sigma
X-Cache-Remote
X-Ha-Backend
X-VCL-Version
X-Generated-In
X-HS-Status
X-Sigma-Backend
CF-Cached-On
Ohc-File-Size
Lb
X-Traceid
Server-Id
X-TT-LOGID
X-Fastly-Backend-Reqs
X-CUA
Cache
Ohc-Cache-HIT
X-Acquia-Purge-Tags
X-Acquia-Site
PICS-Label
X-Lb-Nocache
X-EC-Lua
X-Acquia-Application-UUID
X-Via-Ucdn
X-Acquia-Application-Trace
Ngx-Var-Key
X-Iplb-Instance
X-UA
Yjs-Id
X-Iplb-Request-Id
Warning
My-App
X-Scheme
X-Gamma-Serve
X-Fastly-Cache-Hits
X-Litespeed-Cache-Control
X-CF-Cache-Header-Cache-Control
X-CF-Cache-Header-Vary
Ngx
Log-Origin
X-Miniprofiler-Ids
X-RAMCache
X-ElasticPress-Query
X-Udemy-Cache-App-Namespace
Cneonction
Inserted-Into-Cache-At
X-GeoIP-City
X-Snapshot-Date
X-GoCache-CacheStatus
X-Cached-Since
Vha6-Origin
CACHE-MISS-TO-ORIGIN