Threat Level: green Handler on Duty: Russell Eubanks

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
Content-Length
X-Frame-Options
Strict-Transport-Security
X-Content-Type-Options
Accept-Ranges
Last-Modified
X-XSS-Protection
X-Powered-By
Pragma
CF-Cache-Status
CF-RAY
Link
ETag
Expect-CT
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
X-UA-Compatible
X-Cache-Hits
X-Amz-Cf-Pop
X-Amz-Cf-Id
Referrer-Policy
X-Served-By
X-Varnish
Alt-Svc
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Download-Options
X-Request-Id
X-AspNet-Version
Access-Control-Allow-Credentials
X-Runtime
X-Drupal-Cache
X-Adblock-Key
X-Check
X-Cache-Status
Content-Security-Policy-Report-Only
X-Generator
X-Request-ID
X-Permitted-Cross-Domain-Policies
X-Cacheable
X-DNS-Prefetch-Control
X-Template
X-Language
Timing-Allow-Origin
X-Iinfo
X-AspNetMvc-Version
X-FRAME-OPTIONS
X-Buckets
Status
Upgrade
X-Content-Security-Policy
Content-Encoding
X-CDN
Access-Control-Expose-Headers
Access-Control-Max-Age
X-Xss-Protection
X-Kinja-Server-Push
Keep-Alive
X-Turbo-Charged-By
X-Drupal-Dynamic-Cache
X-Pass-Why
X-Cache-Group
Xkey
X-AH-Environment
X-Envoy-Upstream-Service-Time
CF-Ray
X-Via
X-Backend
X-Server
X-Age
X-Amz-Id-2
X-Amz-Request-Id
X-Robots-Tag
X-Ws-Request-Id
X-Server-Powered-By
X-Page-Speed
X-Pingback
EagleId
X-Proxy-Cache
X-Hacker
X-UA-Device
X-Nginx-Cache-Status
Request-Context
X-Varnish-Cache
Feature-Policy
Server-Timing
P3p
Cf-Railgun
Grace
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Amz-Version-Id
X-Ua-Compatible
Report-To
X-LiteSpeed-Cache
X-Rq
X-OneAgent-JS-Injection
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-WebKit-CSP
X-Server-Id
X-Device
X-Host
X-Origin-Cache
X-Response-Time
EagleEye-TraceId
X-Ac
X-Node
Surrogate-Control
Content-Location
X-Cloud-Trace-Context
X-Vhost
X-Backend-Server
X-Readtime
Request-Id
X-Dispatcher
X-Origin-Upstream-Status
X-Cnection
X-Application-Context
X-Cache-Lookup
X-HW
X-Ruxit-JS-Agent
Fusion-Component-Id
Fusion-Content-Id
Fusion-Template-Id
Fusion-Source
Fusion-Content-Source
X-ORACLE-DMS-ECID
NEL
X-Mod-Pagespeed
X-DataDome
X-ORACLE-DMS-RID
X-Dns-Prefetch-Control
X-Rack-Cache
Rating
Edge-Control
X-Country
X-Clacks-Overhead
X-Akam-SW-Version
Pinterest-Generated-By
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Allow
X-TTL
X-Country-Code
Accept-Ch
X-FTR-Request-ID
X-DynaTrace
X-Instart-Request-ID
X-Varnish-TTL
X-Goog-Hash
X-TtlSet
X-Vname
X-PC
Verso
Content-MD5
Accept-Ch-Lifetime
X-ESI
Service-Worker-Allowed
X-Powered-By-Plesk
X-Url
X-Forwarded-Proto
X-Version
X-MS-InvokeApp
X-GitHub-Request-Id
X-Cdn-Fetch
X-Kinja-Server
X-Kinja
X-Kinja-Build
X-GoogleNews-Bot
X-Exp-Variant
X-Use-Magma
X-Kinja-Revision
X-Exp-Id
X-B3-TraceId
RTSS
X-Vcache
Edge-Cache-Tag
X-Server-Name
X-D2id
X-Debug
X-Abt-Application-Version
X-Px
Ar-Sid
AR-PoweredBy
AR-CACHE
AR-Request-ID
AR-ATIME
X-Amz-Server-Side-Encryption
SPRequestGuid
Charset
X-NF-Request-ID
X-Cached
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-TEC-API-VERSION
Response
Display
X-Middleton-Display
X-Middleton-Response
X-Sol
Pagespeed
X-Vcap-Request-Id
X-Accel-Expires
X-MSEdge-Ref
X-Navigation-Version
X-Amz-Rid
Arr-Disable-Session-Affinity
TCN
X-SharePointHealthScore
X-Fastcgi-Cache
X-Powered-CMS
Pinterest-Version
X-Pinterest-Rid
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-Cdn
X-VARITI-CCR
X-Trace
Public-Key-Pins
X-Fastly-Request-ID
Cache-Tag
X-Client-IP
Nginx-Cache
Realpath
MS-Author-Via
X-Edge-O15-RID
Access-Control-Request-Method
X-Ser
X-Server-ID
X-DynaTrace-JS-Agent
X-Shard
X-Mrf-Section-Lastmod
X-Mrf-Item-Lastmod
Mrf-Cache-Status
X-B3-TraceId-Primal
MRF-Tech
SPIisLatency
SPRequestDuration
X-Content-Type
S
X-Id
X-Upstream
X-Ezoic-Cdn
X-Amzn-Trace-Id
X-Hp-Webp
X-Grace
X-Forwarded-For
X-T
X-Amz-Meta-S3cmd-Attrs
X-Jurisdiction
Nel
X-Hits
Front-End-Https
Fastcgi-Cache
X-Recruiting
X-Aspnet-Version
DynaTrace
X-Cache-TTL
X-Varnish-Age
ServerID
X-Element-Page-Cache
X-Content-Digest
MicrosoftSharePointTeamServices
X-Node-Name
X-Mobile-URL
X-FTR-Cache-Status
X-FTR-Balancer
X-FTR-Realm
X-FTR-DC
X-FTR-Backend
X-Country-Code-Real
X-FTR-Expires
X-FTR-Backend-Server
X-DIS-Request-ID
X-Dw-Request-Base-Id
NR-ENABLED
Server-Node
X-HS-Combine-CSS
X-HS-Hub-Id
X-HS-Content-Id
X-HS-Cache-Config
X-Goog-Stored-Content-Encoding
X-Goog-Generation
X-Goog-Storage-Class
X-Goog-Metageneration
X-Goog-Stored-Content-Length
X-Frontend
X-GUploader-UploadID
Powered
TP-Cache
TP-L2-Cache
Alternate-Protocol
X-Logged-In
Server-Name
X-CST
X-Correlation-Id
AMP-Access-Control-Allow-Source-Origin
X-Amz-Apigw-Id
X-Amzn-RequestId
X-XRDS-Location
Upgrade-Insecure-Requests
X-Request-Received
X-Request-Processing-Time
X-Microsite
X-Request-Handler-Origin-Region
Backend-Timing
X-ATS-Timestamp
X-Cache-Hit
X-Content-Options
Fastly-Restarts
X-User-Agent
X-Content-Security-Policy-Report-Only
X-F-Cache
Refresh
X-Rid
X-Zen-Fury
X-Origin-Server
X-Akamai-Edgescape
X-Page-Id
X-Varnish-Grace
X-Revision
X-Type
X-FTR-Cache-Host
X-Content-Powered-By
X-LB-Cache
X-XRDS-LOCATION
X-B
X-B3-Sampled
PB-PID
X-Geo-Country
PB-RID
Arc-Version
X-Mobile-Rewrite
X-URL
X-Az
X-Activity-Id
X-AppVersion
Cache-Status
X-Kinsta-Cache
X-N
X-Cache-Age
X-Cache-Action
X-TT
X-AOL-HN
X-Instance
X-B-Cache
X-Signature
X-WebKit-CSP-Report-Only
X-Tumblr-Pixel-0
X-Jobs
X-Debug-Info
X-Time
X-Load-Cache
X-Tumblr-Pixel
X-Tumblr-User
Access-Control-Allow-Method
X-FB-Debug
X-App-Environment
X-Framework
Actual-Object-TTL
Paypal-Debug-Id
X-Request-Guid
X-Shield-Request-Id
X-Cached-By
X-Pad
X-PHP-Backend
X-Git-Hash
Fastcgi-Useragent
DC
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-RateLimit-Remaining
X-Webkit-Csp
X-Amz-Replication-Status
X-Varnish-Backend
Surrogate-Key
Host-Header
X-IPLB-Instance
MS-CV
X-Contextid
X-Erf-Bev-Bev
X-Erf-Bev-Bev-Is-Generated
X-ATG-Version
X-WA-Info
X-NWS-LOG-UUID
Host
X-Webapp-Samesite-None-Activated-N
X-FastCGI-Cache
X-Analytics
X-SS-Set-Cookie
FilterID
X-Cache-Key
X-ORACLE-APMCS-REQUEST-ID
X-ORACLE-APMCS-TAG
X-Via-JSL
X-Accel-Buffering
X-Host-Name
Tracecode
X-Response-Served-From
X-Kong-Upstream-Latency
X-Mobile
NGB
X-Kong-Proxy-Latency
Payment
X-Cluster
X-B3-Traceid
X-Cache-NE
Frame-Options
X-Varnish-Server
WPE-Backend
X-FW-Serve
Source
X-Region
X-FW-Hash
X-FW-Server
Xserver
X-FW-Static
Eomportal-Instance
X-Origin-Response-Time
X-FW-Type
X-Varnish-Hostname
X-Tumblr-Pixel-1
Filters
X-GeoIP
X-Cache-2
Cache-Tv-Group
X-Tumblr-Pixel-2
X-IPS-LoggedIn
X-Adobe-Content
X-Adobe-Loc
X-Cache-Enabled
Retry-After
X-Hostname
X-Srv
X-EdgeConnect-Cache-Status
X-Rendered-As
X-Cache-Rule
X-RequestSource
X-Is-Bot
X-Cacheable-TTL
X-Cache-Operation
X-Seen-By
X-TX-ID
X-Presslabs-Stats
X-NewRelic-App-Data
Server-Info
X-Cache-TTL-Remaining
X-RemovedCookies
Liferay-Portal
X-ProcessESI
Cleartype
Accept-CH
X-App-Server
X-L-Path
Ms-Operation-Id
X-RTag
X-Environment-Context
X-Source
X-FireWall-Port
X-Endurance-Cache-Level
X-Dc
Datacenter
X-Upgrade-Enabled
X-Handled-By
X-HTML-Minification-Powered-By
X-Cache-Server
From-Origin
X-VCache
X-CACHE-KEY
X-UA
X-APP-VERSION
Accept-CH-Lifetime
X-Backend-Name
X-Esi
Srv
Accept-Charset
X-PressLabs-Stats
Cache
X-Wix-Request-Id
X-Cache-Control
X-RN-RSRV
Meta-Geo
X-Cache-Var
X-Path-Route
X-Cache-Var-Map
X-ES-SERVER
X-Section
OT-Force-Account-Verify
X-Proxy-Build
X-UUID
X-Tb
X-Timing-Wait
X-Format
Selected-Fe
X-Access
X-Shopify-Generated-Cart-Token
X-NYM-Debug-Backend
X-Goog-Meta-Goog-Reserved-File-Mtime
X-OCL
X-ShopId
X-Sorting-Hat-PodId
X-Sorting-Hat-ShopId
X-PCL
X-Origin
X-ShardId
X-Shopify-Stage
X-EIG-Tracking-Id
Azure-Version
Cache-Tags
Azure-SiteName
Azure-RegionName
Akamai-GRN
Azure-InstanceId
Mn-Server-Ip
X-Akamai-Request-ID
X-Request-Time
X-Proto
X-Content-Age
X-Cache-Config
X-Alternate-Cache-Key
X-FC-Vary-Parameters
Azure-SlotName
Version
Healthy
X-Status
X-Cluster-Node
X-BYPASS-REASON
X-Debug-Cache
X-FW-Dynamic
X-Hosted-By
X-Hl-Ver
X-Generated-By
X-AWS-Id
X-Akamai-Request-ID2
Ec-Rule-Version
Decoy-Debug-TTL
Decoy-Debug-Status
NGX
Node
X-Human
Now
Decoy-Debug-Key
X-JoinUs
X-ServerID
X-SayCDN-TTL
X-Say-TTL
X-Time-Microsecs
X-Vgn-Hpd-Reason
X-Web-Node
X-VWS-Id
X-Viewer-Country
X-Say-Cacheable
X-SaId
X-Proxy-Cache-Status
X-Proxy
X-LJ-Flow-ID
X-ProxyCache-Key
X-ProxyCache-Status
X-Redis-Cache
X-Qloud-Router
DB-Nickname
X-Hyper-Cache
X-Yottaa-Optimizations
X-Yottaa-Metrics
TWC-GeoIP-LatLong
TWC-Locale-Group
TWC-Privacy
Webcakes-App-Name
TWC-GeoIP-Country
TWC-Device-Class
Origin-Cache-Control
Origin-Edge-Control
Property-Id
X-RateLimit-Limit
Webcakes-App-Version
Webcakes-Region
X-Origin-Hint
X-MP-GENERATED-AT
X-Loop
X-CCM
X-BCube-Filmed-By
X-Generated
X-Soup
X-Pubstack
X-Amzn-Remapped-Content-Length
X-FB-TRIP-ID
TWC-Connection-Speed
X-Storage
Cross-Origin-Window-Policy
X-Varnish-Hits
X-TNCMS
X-Rule
X-Xfnlog-Site
X-NCache
X-R9-Blue-Green-Version
GEO-INFO
X-RCS-CacheZone
S-Rt
X-Cache-Host
X-Akamai-Transformed
X-Site-Version
X-Www-Served-By
X-IP
X-Detected-As
X-Locale
X-Unique-Id
X-Ttl
L5d-Success-Class
X-CS
Cache-Key
X-Drupal-Cache-Tags
Webserver
Cache-Name
Time
Viewport
Uber-Trace-Id
X-UA-Device-Type
X-UnsetCookies
X-Forwarded-Host
X-Backend-TTL
X-Mode
X-Whom
X-Daa-Tunnel
X-Origin-TTL
X-Origin-CC
Mime-Version
Rt-Fastcgi-Cache
X-Info
X-NGENIX-Cache
X-CDN-Forward
Content-Disposition
Accept-Language
X-Varnish-Cache-Hits
Country
X-Cache-Remote
X-B3-Spanid
X-From
Odigeo-Trace-Id
X-PERF
X-ApacheServer
ServedBy
X-CLOUD-TRACE-CONTEXT
Section-Io-Cache
X-Magnolia-Registration
X-Cluster-Name
X-Newrelic-Synthetics
X-Drupal-Cache-Contexts
X-Routing-Service
X-Zipkin-Id
X-Proxied
X-Device-Type
VIX-Pulpo-Upstream-Status
X-Microcachable
X-Geo
VIX-Pulpo-Node
X-Via-Fastly
X-TT-TIMESTAMP
Proxy-Connection
X-Uri
Cf-Ipcountry
X-EC-Lua
Ohc-File-Size
Geo-Info
HitType
X-Nc
X-Sigma-Backend
X-Sigma
X-A-Dcw
X-A-Dam
X-Rojux
X-A-Ccd
Content-Script-Type
X-Session-Fingerprint
X-S-Cookie
Xc-Version
X-ScT
X-S
X-A-Dgt
X-A-Wwc
VivaBuild
BehaviorPad-Version
Fastcgi-X-Cache-Version
Rendered-Blocks
Apple-News-Services-Handled
Mobile-Detection-Method
Access-Control-Request-Headers
Machine
MD5-Digest
Meta-Geo-Continent
T-Server
X-Twitter-Response-Tags
Apple-News-Services-Request-Url
GEO-REGION-INFO
W
X-SRCache-Key
Apple-News-Services-Parsed-Url
Viewtype
Apple-News-Services-Host
Content-Style-Type
X-A
X-Trv-Group
AsisCache
X-CF-Lambda-Fn
X-Connection-Hash
X-D
X-Destination
X-Date
X-Geo-Header
X-VG-TLSProxy
X-Request-UUID
X-Region-Sid
X-VG-WebCache
X-Transaction
X-GeoIP-Country-Code
X-CF-Lambda-Version
X-Vdms-Version
X-G
X-Rocket-Build-Number
X-External-Request-Id
X-Aed
X-Accel-Expires-Debug
X-DPWN-IS-SECURE
X-VG-WebServer
X-Vtex-Processado-Em
X-B-Cookie
X-Rewrite-Enabled
X-ARC
X-Application
X-Vtex-Remote-Cache
X-No-Session
Ohc-Cache-HIT
X-Varnish-Beresp-Ttl
X-UPSTREAM-Address
User-Cache-Control
X-Varnish-Beresp-Grace
X-Varnish-Beresp-Status
X-C
X-Edge-Location
HA-Ipaddr
IsBot
Locid
Ha-Gx-Prefs
X-Hit
Fastly-Soc-X-Request-Id
Countrycode
Fastly-SIE
X-Distil-CS
Fastly-SWR
CDCHOST
Environment
Gh-Request-Id
X-Rebelmouse-Surrogate-Control
X-Cache-ASPX
X-Cache-Debug
X-SIPLIST1
X-Wikidot-Static-Cache
X-Auto-Login
X-VC-Cache
X-Tumblr-Pixel-3
X-Eu-Site
X-App-Name
X-CGP
X-Wikidot-Backend
Powered-By
X-Contensis-Viewer-Groups
X-CUA
X-Rebelmouse-Cache-Control
X-WebServer
Server-Cache-Control
X-TrackingId
X-Varnish-Authentication
X-Clientip
X-Developers
Server-Surrogate-Control
X-Real-IP
X-Cache-Time
X-GoCache-CacheStatus
Fastly-SSL
X-Distributor
X-Epic-Correlation-Id
X-Fastly-Cache
X-Debug-Cache-Fetch
X-Dispatcher-Server
X-Debug-Cookies
X-Debug-Cache-Store
X-Debug-Log
X-FW-Version
X-GeoIP-City
X-Has-Esi
X-Hash
X-Generation-Time
X-Generated-In
X-Debug-Cache-Expiry
X-Gamma-Serve
X-Gen-Mode
X-Fetched-On
X-Clara-WADP
X-AK-Request-ID
X-Azure-Ref
X-Backend-State
X-Air-Hostname
X-Agile-Id
Web-Mar-Node
X-Agile
X-Agile-Age
X-BBXSRF
X-Bip
X-Cdn-Srv
X-Hnp-Log
X-Cms-Context
X-Cache-URL
X-Cache-Tags
X-Block-Status
X-Cache-Bucket
X-Cache-Info
X-Core-Mission
X-Irp-Debug
X-Servername
X-TH-Server
X-Thanos
X-Server-W
X-Request-URI
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Render-Time
X-TT-LOGID
X-Up
X-WADP-Cache
X-We-Are-Hiring
X-Webstats-RespID
X-VServer
X-Variation
X-Urbn-Context-Path
X-Urbn-Site-Id
X-Proxy-Upstream
X-Platform-Server
X-Li-Fabric
X-Li-Pop
X-LI-Proto
X-Labrador-Cache-Channel
X-JWT-State
X-IN-APIGATEWAYSSL
We-Hiring
X-Is-Gdpr
X-LI-UUID
X-Logging-Id
X-OVcl
X-OVcl-Cache
X-PHP-Host
X-Origin-Expires
X-Origin-Date
X-Nginx-Cache-Key
X-NX-Host
X-IN-APIGATEWAY
X-NU-AKA-ACS-Version
True-Client-Country-4JS
Server-ID
V-Age
Memcached
Server-Int
Mail-Subject
IBM-Web2-Location
Heartbleed
Kp-EeAlive
Locale
Platform
Is-Eu
Adler-Geo
Cdncip
Cache-Host
RNT-Machine
RNT-Time
Cdnsip
Request-EU
Request-Country
Country-Code
X-Trafficlayer-App-Name
X-Cache-Backend
X-Trafficlayer-App-Scope
X-Matched-Rule
X-Micro-Cache
PFcat
ServerName
X-Ms-Request-Id
X-Instart-Isnd
X-Old-Content-Length
X-Thinkindot-L3
X-Swa-Ws
X-SVT-ORM-VERSION
X-Trace-Id
X-Trafficlayer-App-Version
X-Var-Ttl
X-Cache-Expired-At
X-User
X-SVT-ORM-RULES
X-ServiceProvider
X-Core-Value
AKAMAI
X-NodeID
X-Owner
FNAC-ModuleRouting
X-Req
X-Reboot
X-Ms-Version
Fastly-Backend-Name
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Wxu-Next-Commit
Wxu-Next-Hostname
Group
Wxu-Next-Region
Server-Host
Thinkindot-Control
X-Nginx-Cache
Filterid
Cache-Hits
X-Generated-On
Pragrma
X-Internal-Host
X-SERVER
X-S-Maxage
X-Service
X-Level-Front-Cache
X-App-Version
S-Cnection
X-Refresh
X-Sucuri-Cache
X-VHOST
X-Lb-Id
X-Response-By
X-Key
RequestId
X-CSRF-TOKEN
X-Ruxit-Js-Agent
X-Location
Powered-By-ChinaCache
X-CF-Powered-By
X-Ua
X-Tb-Optimization-Total-Bytes-Saved
X-Tec-Api-Origin
X-Parent-Response-Time
X-NC
X-TA-CDN-Provider
X-Wa
X-Tec-Api-Root
X-Tec-Api-Version
X-Varnish-Cacheable
ProcessTime
Origin
X-B3-Parentspanid
X-Cdn-Forward
X-Sucuri-ID
X-Pjax-Url
User-Agent
Memory
X-BACKEND-TTL
X-Via-CDN
X-Pf-Uncompressing
X-CSRF-Token
X-Developer
X-Node-Id
SRV
X-Device-Os
X-LAGOON
X-Cache-Grace
X-Cdn-Origin
X-Sn-Servicetimems
X-Ocache
X-Server-IP
X-Correlation-ID
Geoip-City
TTL
X-NWS-UUID-VERIFY
PICS-Label
Geoip-Latitude
X-Oss-Server-Time
X-Oss-Request-Id
X-Oss-Object-Type
X-B3-SpanId
X-Oss-Storage-Class
X-Oss-Hash-Crc64ecma
X-COUNTRY
X-Cache-Status-Check
GeoIp-Country-Code
X-NGINX-Cache
On-Server
X-Vcl-Version
Hostname
X-Unique-ID
X-Request-Host
A
X-MSEdge-Features
X-MSEdge-Flight
X-Oracle-Dms-Rid
Media-Length
X-Webkit-CSP
X-Litespeed-Cache
X-Servedbyhost
X-Cdn-Request-ID
SN
X-Rocket-Nginx-Bypass
Dnion-Transfer-Encoding
Cloudfront-Viewer-Country
X-Varnish-Ttl
XServer
X-TIME
M-TraceId
Tcn
X-Via-Ucdn
X-FORWARDED-FOR
X-HS-Status
Cdn
Resin-Trace
X-Sucuri-Id
Host-ID
X-Varnish-URL
X-Ratelimit-Remaining
X-Beluga-Status
X-Beluga-Response-Time
X-ServedByHost
X-Cache-Ttl
X-Beluga-Record
X-Beluga-Trace
Esi-Enabled
Who
X-Beluga-Node
X-AIR-PT
X-Beluga-Cache-Status
X-Reqid
HostName
X-Slack-Backend
X-Policy
X-Fastly-Country-Code
CF-Cached-On
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-Planisys-CDN-TTL
X-Azure-Ref-OriginShield
X-Action
GeoIP-Country-Code
X-Request-Start
CACHE
X-VCL-Version
X-DC
X-Dispatch
X-Processor
Arc-Country
GeoIP-City
X-Server-Time
Pics-Label
Pramga
X-Cache-FS-Status
Ttl
GeoIP-Latitude
X-PAYTM-SRV-ID
X-DI
X-RPS
X-DSS
X-RPM
X-RSL
Rt-Proxy-Cache
X-DB
X-DW
X-LiteSpeed-Cache-Control
MIME-Version
X-Varnish-Url
X-Skip-Cache
NtCoent-Length
X-Fastly-Backend-Reqs
X-Hello
X-Flog
X-Bc
X-Zone
X-ND-Cache
X-ABtesting
Cdn-Request-Time
X-FPC
X-Edge-Server
X-Newrelic-App-Data
X-Ratelimit-Limit
X-PF-Uncompressing
Cdn-Host
Fastly-Drupal-HTML
X-APP
Magicmarker
X-Method
X-VarnishDD-TTL
X-HostName
X-Served-From
N-Cache
X-SRV
WebServer
X-DevSite-Last-Modified
Amp-Access-Control-Allow-Source-Origin
Cteonnt-Length
X-PJAX-URL
X-Bc-Bl
X-Swift-Error
Section-Io-Origin-Time-Seconds
X-Ftr-Cache-Host
Section-Origin-Responded
Section-Io-Id
Section-Io-Origin-Status
X-Dynatrace
X-Amzn-Remapped-Connection
Processtime
X-Backend-Host
X-BE
X-Amzn-Remapped-Date
X-Dynatrace-Js-Agent
Servername
Ohc-Response-Time
X-ID
X-Svr
X-WA
Cache-Provider
X-Be
X-Frame-Option
X-WR-MODIFICATION
X-StackifyID
X-Branch-Name
CF-IPCountry
Dynatrace
X-BC
X-ZONE
X-Aicache-OS
Cache-Cookie-Set-Idcheck
Cache-Cookie-Set-From
Lfy
Vix-Hermes-Req-Id
X-Adobe-Source
FSS-Proxy
Requestid
Cache-Cookie-Set-Lfrom
Load-Balancing
CDN
X-Fmm-Version
FSS-Cache
X-Snapshot-Date
X-LB-ID
Trailer
Fusion-Deployment-Id
X-CACHE-AGE
X-Request-Url
X-Apw-Access-Object
X-Apw-Access-Token
X-Apw-Hits
X-Apw-Access-Action
X-Tid
WZWS-RAY
Pagetype
Proxy-Firewall
V-Cache
D-Cc-Upstream
X-Cc-Req-Id
Warning
X-VC
X-Fastly-Cache-Hits
X-SB
X-Cc-Via
DSUID
X-MServer
X-Litespeed-Cache-Control
X-Configured-By
X-Hp-Ccpa-Warning
X-VCT
Cneonction
Release
X-Scheme
X-WPE-Loopback-Upstream-Addr
X-Fpc
Backend-Name
X-Powered-Y
X-Request-URL
X-Check-Cacheable
X-Varnish-Beresp-TTL
X-ElasticPress-Search
WP-Super-Cache
Correlation-Id
X-App
X-Worker
X-Fastly-Cache-Status