Threat Level: green Handler on Duty: Russ McRee

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-UA-Compatible
X-Xss-Protection
CF-Ray
X-Served-By
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Generator
X-Cache-Status
X-Check
X-DNS-Prefetch-Control
X-Cacheable
X-Envoy-Upstream-Service-Time
X-FRAME-OPTIONS
Timing-Allow-Origin
X-Iinfo
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Content-Encoding
Access-Control-Expose-Headers
X-Dns-Prefetch-Control
Server-Timing
Upgrade
X-XSS-PROTECTION
X-CDN
Status
X-Request-ID
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Amz-Id-2
Request-Context
X-Via
X-Turbo-Charged-By
X-AH-Environment
X-Backend
X-Cache-Group
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-Hacker
X-Proxy-Cache
X-UA-Device
X-Server
X-Vhost
X-Rq
X-Server-Powered-By
Allow
X-Age
X-Ws-Request-Id
X-Varnish-Cache
X-Dispatcher
X-Amz-Version-Id
EagleId
P3p
Nel
Grace
X-LiteSpeed-Cache
Cf-Apo-Via
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
Cf-Railgun
X-Page-Speed
X-Device
EagleEye-TraceId
X-Aws-Lambda-Call-Status
X-Swift-SaveTime
X-Swift-CacheTime
X-Pingback
Ali-Swift-Global-Savetime
X-OneAgent-JS-Injection
X-Host
X-Node
Accept-CH
X-Backend-Server
X-CST
Surrogate-Control
X-Cache-Lookup
X-WebKit-CSP
X-Server-Id
X-Nginx-Cache-Status
Accept-CH-Lifetime
X-Readtime
Permissions-Policy
X-Akam-SW-Version
X-Nginx-Upstream-Cache-Status
Request-Id
X-Application-Context
X-Content-Security-Policy-Report-Only
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Cloud-Trace-Context
X-Ua-Compatible
X-Trace
X-Response-Time
X-HW
X-Edge
Content-Location
X-Clacks-Overhead
X-Mod-Pagespeed
Xkey
Rating
X-Midtier
X-ESI
X-Url
X-Amz-Server-Side-Encryption
X-ECACHE
X-Ruxit-Js-Agent
X-Ruxit-JS-Agent
X-Mcache
X-Oneagent-Js-Injection
X-Country
X-Upstream
X-Vcap-Request-Id
Cache-Tag
X-MS-InvokeApp
X-D2id
X-Rack-Cache
X-Use-Magma
Verso
X-GoogleNews-Bot
X-Kinja
X-Exp-Variant
X-Exp-Id
X-Kinja-Revision
X-Cdn-Fetch
X-Element-Page-Cache
X-Kinja-Build
X-Kinja-Server
X-Litespeed-Cache
X-Powered-By-Plesk
Accept-Ch
Edge-Control
X-PC
X-Vname
X-TtlSet
RTSS
Fastly-Restarts
X-Cache-TTL
Accept-Ch-Lifetime
X-Ac
X-Webkit-CSP
Origin-Trial
X-VARITI-CCR
X-Navigation-Version
Service-Worker-Allowed
X-Abt-Application-Version
X-Country-Code
X-Goog-Hash
X-WebKit-CSP-Report-Only
X-Cached
X-Browser-Type
X-Amz-Rid
Pagespeed
X-GitHub-Request-Id
Display
X-Middleton-Display
X-Sol
X-Aspnetmvc-Version
X-Ttl
X-Varnish-TTL
Cross-Origin-Opener-Policy
X-Dw-Request-Base-Id
X-SharePointHealthScore
SPRequestGuid
X-Server-Name
X-B3-TraceId
X-Mg-S
X-Amzn-Trace-Id
X-Content-Type
X-Powered-CMS
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-Kinja-CCPA
X-Instrumentation
Arr-Disable-Session-Affinity
AR-SID
AR-Request-ID
AR-PoweredBy
AR-ATIME
X-Middleton-Response
Response
SPRequestDuration
SPIisLatency
X-ORACLE-DMS-RID
X-ORACLE-DMS-ECID
X-Cache-Key
X-NWS-LOG-UUID
X-Version
Pinterest-Generated-By
X-Pinterest-Rid
Pinterest-Version
AR-CACHE
X-HP-Trace-Id
X-HP-Webp
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Jurisdiction
X-NF-Request-ID
X-Times
X-Accel-Expires
Cache-Tags
X-Cnection
X-T
X-Fastly-Request-ID
Cache-Status
Nginx-Cache
Front-End-Https
Edge-Cache-Tag
X-Server-ID
X-MSEdge-Ref
X-Ser
X-Hits
X-Client-IP
X-RateLimit-Remaining
X-FastCGI-Cache
X-Px
Public-Key-Pins
X-B3-Traceid
Mrf-Cache-Status
X-B3-TraceId-Primal
MRF-Tech
X-Recruiting
Payment
X-LLID
X-Frontend
X-Request-Received
X-Request-Processing-Time
Server-Node
X-RateLimit-Limit
X-Ua-Browser
X-Fastcgi-Cache
X-Shield-Request-Id
X-DIS-Request-ID
S
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Goog-Metageneration
X-GUploader-UploadID
TP-Cache
MicrosoftSharePointTeamServices
Access-Control-Request-Method
Content-MD5
X-Amz-Apigw-Id
X-Amzn-RequestId
X-HS-Cache-Config
X-Content-Digest
X-HS-Content-Id
X-HS-Combine-CSS
X-HS-Hub-Id
X-LB-Cache
X-Distributor
X-Protected-By
X-Microsite
X-Request-Handler-Origin-Region
Realpath
Access-Control-Allow-Method
X-Page-Id
X-FB-Debug
Fastcgi-Cache
TP-L2-Cache
Accept-Charset
X-Cluster-Name
X-Forwarded-For
X-Geo-Country
X-PressLabs-Stats
X-Rid
X-Ezoic-Cdn
X-Hostname
X-B3-Sampled
X-Webkit-Csp
X-Seen-By
X-Ratelimit-Remaining
X-Daa-Tunnel
X-Aspnet-Version
X-Goog-Stored-Content-Length
X-Ua-Device
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
Cleartype
X-TTL
Referer-Policy
X-Newrelic-App-Data
Cross-Origin-Resource-Policy
X-Mobile
TCN
DC
X-Envoy-Decorator-Operation
X-Webkit-CSP-Report-Only
Count-Hit
X-Correlation-Id
X-Content-Options
X-Varnish-Backend
X-Origin-Cache
X-Debug-Info
X-Ratelimit-Limit
X-Logged-In
X-App-Server
X-Hosted-By
X-Contextid
X-Varnish-Grace
X-Git-Hash
X-Is-Crawler
X-IPS-LoggedIn
X-Grace
X-Aspnet-Duration-Ms
Surrogate-Key
X-Amz-Replication-Status
X-App-Environment
X-Providence-Cookie
X-Flags
X-Fb-Rlafr
X-Route-Name
X-Request-Guid
X-Revision
X-Azure-Ref
Frame-Options
X-TT
X-TEC-API-ORIGIN
X-Edge-Location-Klb
X-Kinsta-Cache
X-Amz-Meta-S3cmd-Attrs
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Origin-Server
X-Forwarded-Proto
X-Client-Ip
Retry-After
WPO-Cache-Message
X-Wix-Request-Id
Alternate-Protocol
X-F-Cache
WPO-Cache-Status
X-Whom
X-RateLimit-Reset
Healthy
X-Magnolia-Registration
Charset
Section-Io-Cache
X-Akamai-Edgescape
X-Backend-Name
X-XRDS-Location
Viewport
MS-Author-Via
X-Id
X-Proxy-Cache-Info
X-App-Version
X-COUNTRY
X-B
Paypal-Debug-Id
SRV
X-Activity-Id
X-Az
X-AppVersion
ServerID
X-N
X-Www-Served-By
X-Language
Akamai-GRN
Host
Filterid
X-Cache-Rule
SD-X-WS
X-ARC
VIX-Pulpo-Node
X-Response-Served-From
X-Original-Request-Id
VIX-Pulpo-Upstream-Status
X-Http-Reason
X-Cache-Grace
X-Rule
X-Rocket-Nginx-Serving-Static
X-Instance
X-Edge-Location
X-Varnish-Server
X-Varnish-Age
X-Akamai-Request-ID2
X-User-Agent
X-UUID
X-Status
Protected
Front
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Jobs
X-L-Path
X-Region
X-Is-Bot
X-Unique-Id
X-Rendered-As
X-Page-View
Country
X-FW-Type
X-Environment-Context
X-FW-Version
X-Cacheable-TTL
Fastly-SIE
Fastly-SWR
X-FW-Dynamic
X-Framework
X-FW-Static
Amp-Access-Control-Allow-Source-Origin
From-Origin
X-FW-Server
X-FW-Serve
X-FW-Hash
Server-Name
X-Datadog-Trace-Id
X-Adobe-Loc
X-Cache-Time
Access-Control-Request-Headers
X-Type
X-Adobe-Content
X-Load-Cache
X-Time
X-Trace-Id
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-EdgeConnect-Cache-Status
X-G
X-ProcessESI
X-Tumblr-Pixel
X-Tumblr-Pixel-0
X-Tumblr-Pixel-1
X-Tumblr-User
X-RemovedCookies
X-DataDome
X-Cache-Age
X-Proxy
X-Cache-Control
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-Mg-Request-UUID
Refresh
X-Datadog-Sampled
X-Amzn-Remapped-Content-Length
X-CDN-Forward
X-Xrds-Location
X-Debug-IsPreview
X-Debug-IsConnected
Content-Disposition
X-Vcache
X-Signature
X-B-Cache
X-ECache
X-Drupal-Cache-Tags
X-Source
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Backend
X-Tec-Api-Origin
X-Nf-Request-Id
Countrycode
X-Tec-Api-Version
Accept-Language
X-Tec-Api-Root
Xet-Cookie
X-DynaTrace
X-Generated-By
Version
Webserver
X-HTML-Minification-Powered-By
X-Erf-Web-Scheduler
CF-IPCountry
X-Nginx-Cache
X-Servername
X-XRDS-LOCATION
X-DynaTrace-JS-Agent
X-Httpd
X-Tt-Trace-Host
Url
X-Tt-Trace-Tag
X-Mode
Xserver
X-Upgrade-Enabled
X-Storage
GEO-INFO
X-Device-Type
X-NYM-Debug-Backend
X-Oracle-Dms-Ecid
X-Content-Powered-By
X-Template
X-Content-Age
X-Tb
X-Cache-Action
X-Cache-Operation
X-GeoCountry
X-GeoCode
Onion-Location
Azure-RegionName
Azure-InstanceId
X-Director
S-Rt
X-SayCDN-TTL
X-Oracle-Dms-Rid
X-Urbn-Site-Id
X-SaId
X-Urbn-Context-Path
X-Varnish-Cache-Hits
Load-Balancing
Meta-Geo
X-JoinUs
X-Rewrite-Enabled
Azure-Version
X-UPSTREAM-Address
X-Say-TTL
X-Say-Cacheable
Azure-SlotName
X-Proto
Filters
X-LAGOON
X-ServerID
Azure-SiteName
Locale
X-Cluster-Node
X-PHP-Host
Uber-Trace-Id
X-Container-Uri
X-RM-Cache-TTL
X-Labrador-Cache-Channel
X-Soup
X-Forwarded-Host
X-Tt-Logid
X-Git-Commit
Fastcgi-Useragent
X-Varnish-Hostname
X-ID
X-VC-Cache
OT-Force-Account-Verify
X-Varnish-Ttl
X-Sql-Duration-Ms
X-LSADC-Cache
X-Generation-Time
X-Ms-Request-Id
X-Ms-Version
X-Cache-Server
X-Sql-Count
X-Detected-As
X-Adobe-Source
X-Served-From
X-VCT
Web-Mar-Node
Node
TWC-Connection-Speed
Property-Id
Mn-Server-Ip
X-Logging-Id
X-R9-Blue-Green-Version
X-Proxied
X-Origin-Hint
X-RCS-CacheZone
X-Zipkin-Id
X-Skip-Cache
X-Zen-Fury
X-Routing-Service
X-Lambda-Id
X-FB-TRIP-ID
TWC-Privacy
TWC-GeoIP-LatLong
TWC-GeoIP-Country
Webcakes-App-Name
Webcakes-App-Version
X-Extlb
X-Debug
Webcakes-Region
TWC-Device-Class
TWC-Locale-Group
X-URL
DB-Nickname
X-MCACHE
X-Format
X-Tumblr-Pixel-2
X-Tumblr-Pixel-3
X-Proxy-Build
Selected-Fe
X-Timing-Wait
X-B3-SpanId
X-Sucuri-Cache
X-Fetched-On
X-Uri
X-TimeS
X-Rn-Rsrv
X-Drupal-Cache-Contexts
X-Sucuri-ID
X-Tncms
X-Loop
X-Hcs-Proxy-Type
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-Cache-Hit
X-Srv
X-Endurance-Cache-Level
Liferay-Portal
Source
Cross-Origin-Window-Policy
X-Redis-Cache
X-Ua
X-MP-GENERATED-AT
X-Fastly-Request-Id
CDN-RequestId
X-Origin-Date
Fastly-Drupal-HTML
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
Section-Io-Id
Section-Io-Origin-Status
X-Varnish-Hits
X-Cache-Expired-At
X-Ratelimit-Reset
X-S
Upgrade-Insecure-Requests
X-Pass-Why
X-Real-IP
X-Origin-TTL
X-Origin-CC
X-Cache-TTL-Remaining
X-Akamai-Transformed
X-UA-Device-Type
Content-Secure-Policy
X-Node-Name
X-Newrelic-Synthetics
X-Pubstack
X-NGENIX-Cache
X-CACHE-AGE
X-Via-JSL
X-Correlation-ID
X-Server-W
X-Hl-Ver
NGB
CDN-RequestPullCode
X-RTag
Ms-Operation-Id
CDN-RequestPullSuccess
CDN-Uid
MS-CV
X-GEO
CDN-PullZone
CDN-RequestCountryCode
X-Handled-By
CDN-EdgeStorageId
CDN-Cache
X-CSRF-Token
CDN-CachedAt
X-Xfnlog-Site
X-Cms-Context
X-Optimistic-Header
X-Reqid
X-IPLB-Instance
X-Restarts
X-IPLB-Request-ID
Apigw-Requestid
X-Cache-Type
ServedBy
WP-Super-Cache
X-CGP
X-External-Request-Id
X-Ec-GeoHdr
X-Eu-Site
X-Conf
X-CF-Lambda-Fn
X-Cache-NE
BehaviorPad-Version
X-CacheTTL
X-Cdn-Diag
X-ProxyCache-Status
X-CF-Lambda-Version
X-Ec-Custom-Error
X-No-Session
X-Date
X-Csrf-Jwt
X-Cache-Host
X-BYPASS-REASON
X-ProxyCache-Key
X-Debug-Cache-Fetch
X-Dispatcher-Number
X-D
X-Developer
X-Destination
X-Debug-Cache-Store
X-Ec-Fail
X-Bl-Debug
We-Hiring
MD5-Digest
W
Meta-Geo-Continent
N-Cache
Mail-Subject
Magicmarker
L5d-Success-Class
Lang
X-A
Web-Mar-Region
VNS-Cache
Ngx.Var.Host
Surrogated-Key
Redirect-Candidate
Sslversion
Rendered-Blocks
T-Server
Origin-Agent-Cluster
VNS-Age
Vix-Hermes-Req-Id
Odigeo-Trace-Id
True-Client-Country-4JS
L
X-A-Ccd
Cache-Provider
DCR-Decision-By
DCR-Processing-Time-Ms
X-Application
CPC-Cache
CPC-Age
Candidate-Md5Url
X-BCube-Filmed-By
X-Bc-Bl
X-B-Cookie
X-Aed
Fastly-Backend-Name
HA-Ipaddr
X-A-Dgt
X-A-Dcw
X-A-Dam
Ha-Gx-Prefs
Gh-Request-Id
Fastly-GeoIP-CountryCode
X-Accel-Expires-Debug
Gannett-Cam-Experience-Id
X-A-Wwc
Canary
X-Epic-Correlation-Id
X-SD-PageType
X-Nyt-Route
X-Presslabs-Stats
X-Datadome
Server-Host
X-Vtex-Remote-Cache
X-Wikidot-Backend
X-AIR-PT
X-Request-Host
X-We-Are-Hiring
X-S-Cookie
X-Wikidot-Static-Cache
X-Rojux
X-Origin-Time
X-ScT
X-Orig-Expires
X-Var-Ttl
X-Worker
X-Shop-Environment
Xc-Version
X-Vdms-Version
X-Tenant
X-Vdms-Path
X-Gdpr
X-SRCache-Key
X-FC-Vary-Parameters
X-Forwarded-Path
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Parent-Response-Time
X-Viewer-Country
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Fastly-Backend
X-Vcl-Version
Cache-Name
X-Varnishpool
X-Refresh
X-Varnish-CookieINHashed-On
X-Request-Time
X-Varnish-Remaining-TTL
X-Alternate-Cache-Key
X-Accel-Buffering
X-ApacheServer
X-App
X-Thinkindot-L3
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Thinkindot-Control
X-SVT-ORM-VERSION
TDXMobile
X-Sn-Servicetimems
X-Sorting-Hat-ShopId
X-Storefront-Renderer-Rendered
X-SVT-ORM-RULES
X-Shopify-Stage
X-ShopId
X-Up
X-Variation
X-S-Maxage
X-App-Name
X-Thanos
X-ShardId
X-Server-IP
X-Test
X-Varnish-CookieHashed-On
X-Bip
X-Level-Front-Cache
X-Irp-Debug
X-INCAP-ABP
X-Human
X-Loc
X-Mid
X-Node-Id
X-Nitro-Cache
X-Mvc-Supplant-Cachable
X-Mly-Id
X-Hash
X-DefElseHash
X-Geo-Header
X-Generated-On
X-Sorting-Hat-PodId
X-Esi-Check
X-DPWN-IS-SECURE
X-GeoIP-Country-Code
X-DefHash
X-Gzip
X-GeoIP-Region-Code
X-Core-Value
X-NodeID
X-Policy
X-Platform
X-Cache-Debug
X-Cache-Id
X-Cache-Bucket
X-Vmg-Version
X-Qloud-Router
X-Pool
X-VG-WebCache
X-BBC-Edge-Cache-Status
X-Cache-Info
X-PERF
X-CMSURLCustom
X-Core-Mission
X-Org
X-Old-Content-Length
X-Clientip
X-Owner
X-PAYTM-SRV-ID
X-Cdn-Origin
X-Wix-Viewer-Type
X-VG-TLSProxy
X-Auto-Login
Fastly-SSL
Expect-Staple
Environment
Host-ID
Is-Eu
Memcached
Machine
Datacenter
Cmstype
X-LJ-Flow-ID
X-Cluster
X-AWS-Id
X-VWS-Id
AKAMAI
Cmsid
Cf-Device-Type
Origin
Adler-Geo
Producers
Platform
Req-Svc-Chain
Release
AMP-Access-Control-Allow-Source-Origin
X-Tx-Id
User-Cache-Control
X-TIME
X-From
Apple-News-Services-Request-Url
CDCHOST
X-Device-Os
CloudFront-Viewer-Country
X-Block-Status
Apple-News-Services-Parsed-Url
X-Gen-Mode
X-Nananana
X-Cdn-Srv
X-Proxy-Cache-Status
X-Nginx-Cache-Key
Server-Hostname
X-Origin
X-Dispatcher-Server
X-Fmm-Version
X-Forwarded-Site
Country-Code
Apple-News-Services-Handled
Sever-Int
X-Origin-Response-Time
X-Clara-WADP
Apple-News-Services-Host
X-WADP-Cache
X-VServer
NM-Fastcgi-Cache
Esi-Enabled
X-Has-Esi
X-Hnp-Log
X-Is-Gdpr
X-GeoIP
X-WA-Info
X-Akamai-Device-Characteristics
X-Mvc-Supplant-OutputCached
X-JWT-State
Server-Ext
DSUID
X-Cache-Status-Check
Cache-Hits
Origin-EX
X-Section
Server-Info
X-LB-NoCache
X-Op-Id-All
Wxu-Next-Commit
Memory
Time
Origin-CC
Hostname
Wxu-Next-Hostname
X-Cache-Enabled
Ssr
C-Via
X-NCache
Wxu-Next-Region
Pics-Label
X-Instance-Name
X-Access
X-Dc
X-PHP-Backend
X-API-Version
X-FTR-Request-ID
X-Amz-Meta-Cb-Modifiedtime
X-Scale
X-Micro-Cache
Server-ID
NGX
X-Via-Fastly
X-HA-Backend
X-CACHE-GROUP
X-TIM-N
X-AB
X-B3-Spanid
X-Tb-Optimization-Total-Bytes-Saved
X-Internal-Host
Cdn-Requestid
X-Cs
X-Vgn-Hpd-Reason
X-Air-Trace-Id
X-Wp-Cf-Super-Cache-Active
X-Varnish-Beresp-Grace
X-Geo-Region
X-Varnish-Beresp-Ttl
X-Air-Source
X-Air-Hostname
X-Platform-Cluster
X-Platform-Processor
X-Platform-Router
Location
X-Buckets
X-Azure-Ref-OriginShield
X-ZONE
X-Webkit-Csp-Report-Only
X-Accel-Version
X-Zone
IsBot
X-SIPLIST1
GeoIP-Latitude
X-Backend-Instance
X-WP-CF-Super-Cache-Active
X-Fpc
X-TraceId
Sid
X-Is-Desktop
X-Origin-Expires
X-Microcachable
X-Browser-Name
X-B3-Parentspanid
X-Is-Mobile
X-Github-Request-Id
X-Is-Tablet
X-Tcp-Rtt
X-Web-Node
X-Is-Supported-Browser
Cache-Host
XM
X-DataCenter
YJS-ID
CF-Ctrl
X-DC
PFcat
Uri
X-Cached-By
X-VarnishDD-TTL
X-Info
Resin-Trace
X-HN
X-Pod-Name
X-LiteSpeed-Cache-Control
X-TA-CDN-Provider
X-Ad-Defer-Variation
True-Client-Ip
User-Agent
X-VCache
X-Via-Edge
Edge-Copy-Time
GeoIP-Country-Code
Srvid
Locid
X-Via-CDN
X-Via-SSL
X-NGINX-Cache
Epwk-X-Cache
X-Hyper-Cache
X-Site-Version
X-Nitro-Rev
X-Locale
X-FL-QIT-DEBUG
X-FL-EDGE
X-Nitro-Cache-From
A
X-Frame-Option
Cdn
GeoIp-Country-Code
XServer
X-Geo
X-Moov-Xdn-Version
X-Contensis-Viewer-Groups
X-Service
X-Moov-T
X-Webstats-RespID
X-FireWall-Port
X-CS
X-Cache-ASPX
X-ATG-Version
X-CSRF-TOKEN
X-NewRelic-App-Data
X-Varnish-Authentication
X-MSEdge-Features
X-Datacenter
SID
Cache-Key
X-VC
True-Client-IP
X-MSEdge-Flight
X-Origin-Cache-Key
X-TRACE-ID
NtCoent-Length
X-FTR-Cache-Status
X-FTR-Expires
X-FTR-Balancer
X-FTR-Backend
Path
X-FTR-Backend-Server
X-Upstream-Ct
X-Edge-Server
X-Pad
Cdn-Request-Time
X-Upstream-Ht
Cdn-Host
Fastly-Drupal-Html
X-Country-Code-Real
X-Vercel-Cache
X-Vercel-Id
X-FPC
Tcn
X-HostName
LB
Req-ID
M-TraceId
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
State
X-NMSegId
X-LiteSpeed-Tag
X-SRV
WZWS-RAY
X-HS-Content-Campaign-Id
X-Platform-Server
X-Api-Version
X-APP-VERSION
Cf-Ipcountry
X-Cdn-Request-ID
CountryCode
Lb
X-AK-Request-ID
Cdnsip
Cdncip
Cluster
X-Amz-Meta-Opti
X-Ad-Load-Variation
X-Release
X-WP-CF-Super-Cache-Cookies-Bypass
X-Air-Pt
X-Esi
X-Vgn-Hpd-Cached
X-Fastly-Cache
X-Vgn-Hpd-Variations-Key
X-Vgn-Hpd-Ssi
X-NWS-UUID-VERIFY
Content-Script-Type
X-Cache-Ttl
X-Branch-Name
Content-Style-Type
X-Scope-Id
X-M-Log
Pramga
X-Cache-Remote
X-Rocket-Build-Number
X-Request-Start
X-Generated-In
X-M-Reqid
X-Traceid
WebServer
X-Wp-Cf-Super-Cache-Cache-Control
X-Sigma
X-Wp-Cf-Super-Cache
X-Sigma-Backend
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-Wp-Cf-Super-Cache-Cookies-Bypass
Yak-Timeinfo
X-Proxy-CacheRZ
X-Varnish-Beresp-Status
X-Shield-Cache-Expires
X-Qnm-Cache
Cache
XkeyRZ
Proxy-Connection
X-HS-Status
X-Provided-By
X-CACHE-KEY
X-UA
CDN
X-GoCache-CacheStatus
X-GeoIP-City
Geoip-Latitude
X-Cdn-Forward
X-Gamma-Serve
Srv
X-Request-URI
X-Tim-N
X-Cache-Date
X-Akamai-Pragma-Client-IP
X-Scheme
Edge-Cache
X-Lb-Cache
X-Render-Time
CF-Cached-On
X-TH-Server
HostName
X-Cdn-Cache-Status
X-Ha-Backend
X-Vc
Ohc-File-Size
X-User
X-RN-RSRV
Server-Id
X-TT-LOGID
X-Via-Poph
X-Via-Popn
Tube-Return
X-V-Cache
X-Servedbyhost
V-Age
X-Cache-FS-Status
X-Via-Popv
Tube-Got-Results
Click-Count-Error
Click-Count-Action-Start
X-Aicache-OS
Tube-Get-Contents
X-CUA
X-B3-Trace-ID
Tube-Got-Eval
Cache-Tv-Group
Ngx
X-Lb-Nocache
X-Req
X-Edge-POP
X-Acquia-Purge-Cdn-Unconfigured
PICS-Label
X-Acquia-Purge-Tags
X-Acquia-Application-UUID
X-Acquia-Application-Trace
X-Wa
X-Dw-Trace-Id
X-Acquia-Site
X-Fastly-Backend-Reqs
X-EC-Lua
X-LB-ID
Env
X-SB
X-Nc
X-Via-Ucdn
X-TX-ID
Yjs-Id
Mime-Version
X-Sucuri-Id
X-Miniprofiler-Ids
Vha6-Origin
X-Cached-Since
X-ElasticPress-Query
X-Snapshot-Date
X-Fastly-Cache-Hits
CACHE-MISS-TO-ORIGIN
Inserted-Into-Cache-At
X-Litespeed-Cache-Control
Log-Origin
X-CF-Cache-Header-Cache-Control
X-CF-Cache-Header-Vary
X-VCL-Version
Kp-EeAlive
X-RAMCache
Cneonction
X-Udemy-Cache-App-Namespace