Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
X-XSS-Protection
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-Served-By
X-UA-Compatible
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Xss-Protection
X-Ua-Compatible
X-Cache-Status
X-Request-ID
X-DNS-Prefetch-Control
X-Generator
X-Cacheable
Timing-Allow-Origin
X-Content-Security-Policy
X-Iinfo
Content-Encoding
X-CDN
X-AspNetMvc-Version
Feature-Policy
X-Envoy-Upstream-Service-Time
Status
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
X-Via
Access-Control-Max-Age
Keep-Alive
X-Ws-Request-Id
X-Age
X-Turbo-Charged-By
X-Robots-Tag
X-AH-Environment
Request-Context
X-Proxy-Cache
EagleId
X-Cache-Group
Server-Timing
X-Backend
X-Hacker
X-Server
Report-To
X-Amz-Request-Id
Host-Header
X-Server-Powered-By
X-Amz-Id-2
Grace
X-Nginx-Cache-Status
X-UA-Device
X-Rq
X-Varnish-Cache
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Page-Speed
X-LiteSpeed-Cache
Cf-Railgun
X-Pingback
X-OneAgent-JS-Injection
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
NEL
X-Amz-Version-Id
X-Cache-Spec
X-Dns-Prefetch-Control
X-WebKit-CSP
X-Device
Allow
X-CST
Xkey
X-Vhost
X-Backend-Server
X-Host
X-Server-Id
EagleEye-TraceId
Request-Id
Surrogate-Control
X-Dispatcher
X-Node
Content-Location
X-Response-Time
X-Ruxit-JS-Agent
X-Akam-SW-Version
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Accept-CH
P3p
X-ASPNET-VERSION
X-Ac
X-Application-Context
X-Template
X-Country
Accept-CH-Lifetime
X-Language
X-Cache-Lookup
X-Mod-Pagespeed
X-Readtime
Accept-Ch
MS-Author-Via
X-B3-TraceId
Accept-Ch-Lifetime
X-Cloud-Trace-Context
Rating
X-Origin-Cache
X-Cnection
X-HW
X-MS-InvokeApp
X-Url
X-Vname
X-PC
X-TtlSet
X-Clacks-Overhead
X-GitHub-Request-Id
Edge-Control
X-ESI
X-ORACLE-DMS-ECID
X-Trace
X-Sol
X-Middleton-Response
X-Middleton-Display
Response
X-Content-Type
Pagespeed
Display
X-D2id
X-GoogleNews-Bot
X-Use-Magma
X-Kinja-Server
X-Kinja-Build
X-Kinja
Arr-Disable-Session-Affinity
X-Kinja-Revision
X-Exp-Variant
X-Exp-Id
X-Cdn-Fetch
Verso
X-Vcap-Request-Id
X-ORACLE-DMS-RID
X-Goog-Hash
X-Buckets
X-FastCGI-Cache
X-Rack-Cache
X-Country-Code
X-Varnish-TTL
X-Server-Name
X-Navigation-Version
Service-Worker-Allowed
X-VARITI-CCR
X-Powered-By-Plesk
X-Abt-Application-Version
X-Amz-Rid
X-Fastly-Request-ID
X-Client-IP
X-Cache-TTL
X-Pinterest-Rid
Pinterest-Version
Pinterest-Generated-By
X-TTL
X-Webkit-CSP
Fastly-Restarts
X-Release
X-MSEdge-Ref
SPRequestGuid
X-SharePointHealthScore
X-Litespeed-Cache
X-Element-Page-Cache
X-Dw-Request-Base-Id
X-Cached
SPRequestDuration
SPIisLatency
X-NF-Request-ID
Public-Key-Pins
X-Oneagent-Js-Injection
RTSS
X-B3-TraceId-Primal
Mrf-Cache-Status
MRF-Tech
Access-Control-Request-Method
X-SRCache-Fetch-Status
AR-CACHE
AR-PoweredBy
X-SRCache-Store-Status
AR-Request-ID
AR-ATIME
Ar-Sid
X-Edge
X-LLID
X-Powered-CMS
X-Origin-Upstream-Status
X-Ezoic-Cdn
X-Upstream
Content-MD5
Cache-Tag
X-Px
Fusion-Content-Id
Fusion-Deployment-Id
Fusion-Component-Id
Fusion-Template-Id
Fusion-Content-Source
Fusion-Source
X-HP-Webp
X-Jurisdiction
X-Version
S
X-ECACHE
X-MCACHE
X-Mid
X-Mg-S
X-Recruiting
X-Ttl
Charset
X-Content-Digest
X-PressLabs-Stats
X-Amz-Server-Side-Encryption
Fastcgi-Cache
X-Kinsta-Cache
X-T
X-Id
Cache-Tags
MicrosoftSharePointTeamServices
Front-End-Https
X-Content-Security-Policy-Report-Only
Filters
X-Debug
X-Grace
X-Logged-In
Server-Node
X-Accel-Expires
Edge-Cache-Tag
X-DynaTrace
X-Forwarded-Proto
X-Correlation-Id
X-Forwarded-For
TCN
X-Pinterest-Direct
Server-Name
TP-L2-Cache
X-XRDS-LOCATION
TP-Cache
X-Amzn-Trace-Id
Nginx-Cache
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
Surrogate-Key
X-Request-Received
X-Request-Processing-Time
X-Varnish-Age
X-Yandex-Sdch-Disable
X-B3-Sampled
X-Shield-Request-Id
X-Microsite
X-Request-Handler-Origin-Region
X-Ser
X-Hits
X-AppVersion
X-Az
X-Activity-Id
X-Amz-Replication-Status
X-F-Cache
X-DIS-Request-ID
X-HS-Cache-Config
X-HS-Combine-CSS
X-HS-Hub-Id
X-HS-Content-Id
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Generation
X-GUploader-UploadID
X-Goog-Metageneration
X-Kinja-Server-Push
X-Origin-Server
X-Fastcgi-Cache
Accept-Charset
X-Geo-Country
X-Git-Hash
Cache
X-Respond-Thread
Alternate-Protocol
X-Rid
X-FTR-Request-ID
X-LB-Cache
X-Frontend
X-XRDS-Location
X-Cache-Key
Section-Io-Cache
X-Upgrade-Enabled
Host
X-DataDome
Powered-By-ChinaCache
X-Time
Access-Control-Allow-Method
X-Mobile-URL
X-Seen-By
X-Cache-Age
MS-CV
Paypal-Debug-Id
X-VCache
Healthy
X-NWS-LOG-UUID
X-AOL-HN
Cleartype
X-Type
X-TT
X-Whom
X-Content-Options
X-Varnish-Backend
X-IPLB-Instance
X-Ruxit-Js-Agent
X-App-Environment
ServerID
X-Is-Crawler
X-Providence-Cookie
X-Request-Guid
X-Aspnet-Duration-Ms
X-Server-ID
X-Jobs
X-Route-Name
Payment
X-Flags
X-Cache-Action
X-Signature
X-WebKit-CSP-Report-Only
X-B-Cache
X-Page-Id
Fastcgi-Useragent
X-Source
X-Debug-Info
X-Hostname
X-Load-Cache
X-N
X-Daa-Tunnel
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Mobile
X-FB-Debug
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Erf-Bev-Bev
X-Via-JSL
Refresh
Nel
Version
X-Akamai-Edgescape
X-Cached-By
Realpath
X-Original-Request-Id
X-Wix-Request-Id
X-Accel-Buffering
X-Rule
X-Contextid
X-Response-Served-From
Viewport
X-Framework
X-Drupal-Cache-Tags
X-Proxy
DC
X-Cacheable-TTL
X-Cache-Rule
X-Cache-Operation
Node
X-ProcessESI
X-Zen-Fury
X-RateLimit-Remaining
X-RemovedCookies
X-RTag
Ms-Operation-Id
Access-Control-Request-Headers
X-Real-IP
X-Instance
X-Cache-Time
X-B
X-HTML-Minification-Powered-By
X-Distributor
X-Region
Eomportal-Instance
X-Drupal-Cache-Contexts
Referer-Policy
X-Page-View
X-UUID
X-FW-Hash
X-FW-Server
X-FW-Static
X-FW-Type
X-Yottaa-Metrics
VIX-Pulpo-Node
X-Cache-Expired-At
Countrycode
X-Cluster-Name
VIX-Pulpo-Upstream-Status
X-Yottaa-Optimizations
X-FW-Serve
X-FW-Dynamic
X-Content-Powered-By
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Cache-Control
X-G
DynaTrace
X-IPS-LoggedIn
X-Cache-Hit
X-Tumblr-Pixel-1
X-Tumblr-User
X-Tumblr-Pixel-0
X-L-Path
X-Environment-Context
X-Tumblr-Pixel
Liferay-Portal
X-Ratelimit-Limit
X-FireWall-Port
Server-Info
X-Pass-Why
X-App-Server
GEO-INFO
X-User-Agent
Ec-Rule-Version
Xserver
From-Origin
X-Varnish-Ttl
Webserver
X-Tumblr-Pixel-2
Section-Origin-Responded
X-Protected-By
Section-Io-Id
X-Ratelimit-Remaining
Section-Io-Origin-Time-Seconds
X-Node-Name
Section-Io-Origin-Status
CF-IPCountry
Protected
SRV
X-Www-Served-By
X-Cache-Server
X-Backend-Name
X-UPSTREAM-Address
X-RN-RSRV
X-Mode
Frame-Options
Meta-Geo
X-Handled-By
X-Hl-Ver
X-ES-SERVER
X-Locale
X-FB-TRIP-ID
X-Endurance-Cache-Level
Cache-Tv-Group
X-Site-Version
X-Varnishpool
X-Labrador-Cache-Channel
X-Nginx-Cache
X-Hyper-Cache
X-NYM-Debug-Backend
X-Be
X-Uri
X-PHP-Host
X-Web-Node
X-Soup
X-Storage
X-Origin-Hint
Property-Id
X-Timing-Wait
TWC-Connection-Speed
Selected-Fe
X-Origin-Date
TWC-Device-Class
TWC-Locale-Group
X-Proto
Webcakes-Region
X-Human
Decoy-Debug-Key
TWC-Privacy
Cache-Name
Webcakes-App-Version
Country
Fastly-SSL
X-UA-Device-Type
Cache-Status
TWC-GeoIP-LatLong
Webcakes-App-Name
X-Redis-Cache
X-Revision
Decoy-Debug-TTL
X-Pubstack
Decoy-Debug-Status
TWC-GeoIP-Country
X-Adobe-Loc
X-MP-GENERATED-AT
X-Proxy-Build
X-Adobe-Content
X-Debug-IsConnected
X-Say-Cacheable
Azure-InstanceId
Azure-Version
Azure-SlotName
Azure-SiteName
X-S-Maxage
Azure-RegionName
X-Server-W
X-Section
X-SayCDN-TTL
X-Say-TTL
X-Debug-IsPreview
X-Sql-Count
X-Cache-Grace
X-Via-Fastly
X-ProxyCache-Status
X-ProxyCache-Key
X-Request-Time
X-Amz-Meta-S3cmd-Attrs
X-Sql-Duration-Ms
X-AIR-PT
X-Access
X-Hosted-By
X-PCL
X-OCL
X-FW-Version
X-TNCMS
X-Loop
X-Format
X-BYPASS-REASON
X-No-Session
X-Forwarded-Host
X-WA-Info
Retry-After
X-Cluster
X-VWS-Id
X-R9-Blue-Green-Version
X-LAGOON
X-AWS-Id
X-TT-LOGID
X-ApacheServer
X-LJ-Flow-ID
X-Device-Type
X-Status
X-PERF
Mn-Server-Ip
X-Shopify-Stage
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-Alternate-Cache-Key
X-ShardId
X-Cache-TTL-Remaining
X-Storefront-Renderer-Rendered
X-ShopId
X-Routing-Service
X-Zipkin-Id
X-Proxied
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-CCM
AMP-Access-Control-Allow-Source-Origin
X-Rendered-As
X-Xfnlog-Site
X-Is-Bot
X-Qloud-Router
Apigw-Requestid
X-Varnish-Grace
X-Dc
X-Info
S-Cnection
X-Varnish-Server
X-SRV
X-FTR-Realm
X-Via-CDN
Cache-Hits
X-FTR-DC
X-FTR-Backend
X-Country-Code-Real
X-FTR-Cache-Status
X-FTR-Backend-Server
X-FTR-Balancer
X-Cache-Enabled
X-FTR-Expires
X-Detected-As
X-Content-Age
X-Cdn
X-Cache-Host
X-Microcachable
X-Platform
X-GG-Cache-Date
X-Amzn-RequestId
X-EdgeConnect-Cache-Status
X-Amzn-Remapped-Content-Length
X-Amz-Apigw-Id
Uber-Trace-Id
X-Azure-Ref
X-Air-Hostname
X-CSRF-Token
X-Proxy-Cache-Status
X-Backend-Host
Tracecode
X-Aspnetmvc-Version
X-Cache-Var-Map
X-CLOUD-TRACE-CONTEXT
SD-X-WS
X-Cache-Var
X-DynaTrace-JS-Agent
X-Time-Microsecs
X-NWS-UUID-VERIFY
Akamai-GRN
X-App-Version
X-ServerID
X-ATG-Version
X-Unique-Id
X-Backend-TTL
Amp-Access-Control-Allow-Source-Origin
X-Oss-Object-Type
X-Oss-Hash-Crc64ecma
X-Tb
X-Oss-Request-Id
X-Trace-Id
X-Oss-Storage-Class
X-Oss-Server-Time
HostName
X-RCS-CacheZone
X-GEO
X-BCube-Filmed-By
Backend
ServedBy
X-Varnish-Hostname
X-Cache-Backend
DSUID
X-Cache-PHP
X-Cache-NGX
X-Akamai-Transformed
X-Correlation-ID
X-Debug-Cache
BehaviorPad-Version
X-Device-Os
X-Application
X-Aed
X-A-Wwc
X-A-Dgt
X-CF-Lambda-Version
X-B-Cookie
X-Magnolia-Registration
X-CF-Lambda-Fn
X-ARC
X-Cache-NE
X-D
X-Connection-Hash
X-Destination
DCR-Processing-Time-Ms
Machine
Rendered-Blocks
Lfy
SR-User-Adfree
X-External-Request-Id
MD5-Digest
Release
Meta-Geo-Continent
Mobile-Detection-Method
Odigeo-Trace-Id
Path
T-Server
Thinkindot-CacheControl
Expiry
X-A-Ccd
DCR-Decision-By
X-A-Dam
X-A
Thinkindot-Control
Instruction
DB-Nickname
Thinkindot-CacheControl-Type
Fastcgi-X-Cache-Version
X-A-Dcw
X-GeoIP-City
X-S
X-S-Cookie
X-ScT
X-Cdn-Forward
X-Rewrite-Enabled
X-Request-UUID
X-Owner
X-PAYTM-SRV-ID
X-PBS-Appsvrname
X-Processor
X-Session-Fingerprint
X-SRCache-Key
X-VG-WebServer
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
Xc-Version
X-VG-WebCache
X-Vdms-Version
X-Thinkindot-L3
X-Trv-Group
X-Vdms-Path
X-Origin-TTL
X-Rojux
X-Matched-Rule
X-Generated-On
X-Location
X-From
X-Fetched-On
X-Level-Front-Cache
X-Origin-CC
X-Generation-Time
Arc-Version
PB-PID
PB-RID
X-B3-SpanId
X-Sucuri-ID
X-GeoIP
C-Via
X-Cache-Bucket
X-Tumblr-Pixel-3
X-Geo-Header
Fastly-Backend-Name
CacheControlHeader
X-NAPM-TraceId
Cf-Device-Type
X-TrackingId
Host-ID
Gh-Request-Id
X-VServer
X-Thanos
UCS
X-Reqid
X-FC-Vary-Parameters
X-Micro-Cache
X-Mvc-Supplant-Cachable
X-OVcl
X-OVcl-Cache
X-Node-Id
X-JWT-State
X-Irp-Debug
Server-Host
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Bip
X-Skip-Cache
X-HS-Content-Campaign-Id
X-Azure-Ref-OriginShield
X-Has-Esi
Pagetype
X-Is-Gdpr
AKAMAI
X-TA-CDN-Provider
X-TX-ID
X-Ms-Request-Id
X-Ms-Version
X-CS
X-Varnish-Cache-Hits
X-APP-VERSION
X-CACHE-KEY
X-VarnishDD-TTL
X-Varnish-Remaining-TTL
X-Clientip
X-CGP
X-NewRelic-App-Data
X-Csrf-Jwt
X-Varnish-CookieINHashed-On
X-DefElseHash
X-Wikidot-Backend
X-CUA
X-DefHash
X-Developer
X-Backend-State
X-Adobe-Source
On-Server
Wxu-Next-Region
Wxu-Next-Hostname
Wxu-Next-Commit
NGX
Content-Disposition
X-Cache-Info
X-Wikidot-Static-Cache
X-Cache-Id
X-Developers
CloudFront-Viewer-Country
X-Cache-Tags
X-Esi-Check
X-Li-Pop
X-LI-UUID
X-Li-Fabric
X-IP
X-Swa-Ws
X-HN
X-Scheme
X-Nginx-Cache-Key
X-Request-Host
X-Policy
X-Origin-Expires
X-Origin
X-Old-Content-Length
X-Gzip
X-User
X-Varnish-CookieHashed-On
X-Fastly-Backend
X-Eu-Site
V-Age
X-DPWN-IS-SECURE
X-B3-Traceid
Cache-Host
X-Variation
X-Var-Ttl
X-Varnish-Beresp-Grace
X-Generated-In
X-Generated-By
X-Dispatcher-Server
X-Branch-Name
Locid
Magicmarker
Location
Platform
Is-Eu
Sever-Int
Server-Hostname
X-Cms-Context
X-Fastly-Cache
PFcat
NM-Fastcgi-Cache
X-Core-Value
Server-Ext
HA-Ipaddr
L5d-Success-Class
Ssr
Ha-Gx-Prefs
Adler-Geo
User-Cache-Control
X-Platform-Server
X-Request-URI
X-Ratelimit-Reset
X-Origin-Response-Time
X-NU-AKA-ACS-Version
X-EC-Lua
X-Varnish-Hits
X-GoCache-CacheStatus
X-Hnp-Log
Vix-Hermes-Req-Id
Cf-Bgj
X-SIPLIST1
X-Sn-Servicetimems
L
IsBot
X-WADP-Cache
X-Varnish-Beresp-Status
X-Gamma-Serve
X-Method
X-Hash
X-Slack-Backend
X-Varnish-Beresp-Ttl
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
CDN-RequestId
CDN-Uid
Pramga
X-Clara-WADP
CDCHOST
CDN-RequestCountryCode
CDN-PullZone
CDN-CachedAt
CDN-Cache
Rt-Fastcgi-Cache
Fastly-SIE
X-Block-Status
X-Gen-Mode
True-Client-Country-4JS
Web-Mar-Node
X-Fmm-Version
Fastly-SWR
CDN-EdgeStorageId
X-Envoy-Decorator-Operation
X-Cdn-Origin
X-Erf-Stays-Bingo-Pdp-Web
X-ID
X-Loc
Sid
X-Core-Mission
X-Aicache-OS
X-Servername
Origin
X-LB-ID
Apple-News-Services-Host
Apple-News-Services-Handled
Apple-News-Services-Parsed-Url
X-Cache-Debug
Fastly-Drupal-HTML
X-Cache-Date
X-Goog-Meta-Goog-Reserved-File-Mtime
Apple-News-Services-Request-Url
X-VG-TLSProxy
X-Cache-Expires
X-Dynatrace
X-Mvc-Supplant-OutputCached
X-PF-Uncompressing
X-NCache
X-Nc
X-Varnish-Url
Esi-Enabled
X-Via-Popn
Url
X-Unique-ID
X-Via-Poph
X-Via-Popv
X-Request-Start
X-Refresh
Who
X-CACHE-GROUP
X-Oracle-Dms-Rid
Country-Code
X-NC
X-Cache-Remote
Pics-Label
Geo-Info
X-FireWall-Protection
X-Epic-Correlation-Id
X-Response-By
X-Varnish-Cacheable
X-TraceId
S-Rt
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
Tcn
Xkeyi7
X-Tb-Optimization-Total-Bytes-Saved
Req-Svc-Chain
X-Proxy-Cachei7
Source
Content-Secure-Policy
X-Webkit-Csp
X-Host-Name
N-Cache
X-BBXSRF
X-Error
X-B3-Spanid
X-Srv
Cmstype
X-Cache-2
Geoip-Latitude
GeoIp-Country-Code
X-HostName
Cmsid
Cross-Origin-Window-Policy
Ohc-File-Size
X-Webkit-CSP-Report-Only
Filterid
X-Cc-Req-Id
X-Cc-Via
D-Cc-Upstream
X-Varnish-Authentication
X-Contensis-Viewer-Groups
HitType
X-HS-Status
Kp-EeAlive
Svr
X-Cache-ASPX
X-Served-From
Server-Ttl
Cteonnt-Length
X-DC
X-Sucuri-Cache
X-RateLimit-Limit
A
Cache-Key
Viewtype
X-Svr
X-LiteSpeed-Cache-Control
X-Vcl-Version
VivaBuild
X-URL
X-Servedbyhost
X-Wa
X-Li-Proto
M-TraceId
X-Server-IP
MIME-Version
X-CDN-Forward
X-Air-Source
Cross-Origin-Opener-Policy
X-Cache-Config
X-Nyt-Route
Arc-Country
X-API-Version
X-Gdpr
NGB
X-FPC
X-Vgn-Hpd-Reason
X-Esi
X-Origin-Time
TDXMobile
X-Cs
CACHE
Server-ID
X-LI-Proto
Resin-Trace
Server-Id
X-RAMCache
X-VC
X-SN
X-Newrelic-Synthetics
X-HOST
NtCoent-Length
X-Webstats-RespID
X-Check-Cacheable
X-WA
X-ServedByHost
X-SB
X-NodeID
X-Viewer-Country
SID
Ohc-Cache-HIT
Request-ID
X-Vc
X-Geo
X-UA
Hostname
X-CCDN-Origin-Time
X-RSL
X-CCDN-CacheTTL
X-RPS
Cache-Provider
X-TIM-N
X-Service
X-VCL-Version
X-Internal-Host
Mime-Version
X-Hcs-Proxy-Type
X-DB
X-NGINX-Cache
X-RPM
X-DW
X-DSS
X-DI
X-SD-PageType
X-PHP-Backend
X-JoinUs
DataCenter
X-SaId
X-NGENIX-Cache
GeoIP-Country-Code
Srv
X-Edge-Location
X-Render-Time
GeoIP-Latitude
XServer
ProcessTime
X-Action
X-Via-NSCOPI
X-App
FSS-Cache
X-Provided-By
X-Extlb
X-Forwarded-Site
X-BBC-Edge-Cache-Status
EpKe-Alive
X-Ua
CF-Cached-On
X-FTR-Cache-Host
X-TIME
X-Fpc
X-Oss-Cdn-Auth
X-Worker
X-Auto-Login
Upgrade-Insecure-Requests
Processtime
W
X-CF-Powered-By
X-Dynatrace-Js-Agent
LB
X-Proxy-Upstream
X-Region-Sid
X-VC-Cache
X-Cluster-Node
X-PJAX-URL
X-Req
X-Depends-On
X-Date
Proxy-Connection
X-Bc-Bl
We-Hiring
Surrogated-Key
X-Accel-Expires-Debug
Memcached
X-FORWARDED-FOR
Mail-Subject
X-HITS
X-Cdn-Request-ID
X-CSRF-TOKEN
X-BACKEND-TTL
X-UnsetCookies
X-Fastly-Backend-Reqs
X-RateLimit-Limit-Second
CDN
X-Parent-Response-Time
X-Dw-Trace-Id
Cdn
Datacenter
X-RateLimit-Remaining-Second
Env
X-MSEdge-Features
X-APP
X-Ftr-Cache-Host
X-ZONE
X-MSEdge-Flight
X-Client-Ip
X-CACHE-AGE
X-Swift-Error
X-Hello
X-BBC-Origin-Response-Status
X-Flog
X-ABtesting
X-IN-APIGATEWAYSSL
Time
Memory
X-Cache-Tag
X-IN-APIGATEWAY
Dnion-Transfer-Encoding
X-Rocket-Build-Number
PICS-Label
X-Sigma
X-Sigma-Backend
X-Men
X-Fastly-Request-Id
X-Air-Trace-Id
X-Akamai-Pragma-Client-IP
VNS-Age
CPC-Cache
X-Oracle-DMS-ECID
VNS-Cache
X-Presslabs-Stats
Media-Length
CPC-Age
X-Zone
X-Pad
X-Acquia-Purge-Tags
X-Acquia-Site
X-Acquia-Application-UUID
X-Pf-Uncompressing
X-Acquia-Application-Trace
Vha6-Origin
OT-Force-Account-Verify
Epwk-X-Cache
X-Via-PopV
X-ND-Cache
X-LiteSpeed-Tag
X-Via-PopN
X-Via-PopH
Cf-Ipcountry
WZWS-RAY
X-Varnish-Beresp-TTL
X-Varnish-URL
X-ElasticPress-Query
X-MiniProfiler-Ids
X-Csrf-Token
X-Akamai-ERPolicy
X-Request-URL
X-Akamai-ERRuleID
X-Snapshot-Date
X-Ms-Meta-Staticbatchstarttime
X-Ms-Meta-Originalurl
X-Request-Url
Content-Script-Type
X-Vcache
Content-Style-Type
X-Lb-Id
Xet-Cookie
X-ElasticPress-Search
CountryCode
X-Redis-Duration-Ms
X-Litespeed-Cache-Control
X-Redis-Count
X-Amz-Meta-Cb-Modifiedtime
X-Tid
X-Traceid
X-ServerName
X-Debug-Cache-Store
X-Debug-Cache-Fetch
URI
Phost
X-B3-Parentspanid
NnCoection
Inserted-Into-Cache-At
X-Storefront-Renderer-Verified
Ohc-Response-Time
X-C
Environment