Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
Accept-Ranges
Link
Pragma
ETag
Expect-CT
X-Powered-By
X-XSS-Protection
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
Alt-Svc
X-UA-Compatible
X-Served-By
X-Xss-Protection
X-Timer
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Request-Id
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Request-ID
X-Check
X-Cache-Status
X-Generator
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
P3p
X-Content-Security-Policy
X-FRAME-OPTIONS
X-Iinfo
Status
Content-Encoding
Feature-Policy
X-AspNetMvc-Version
X-CDN
Upgrade
Access-Control-Expose-Headers
X-Envoy-Upstream-Service-Time
X-Ua-Compatible
X-Drupal-Dynamic-Cache
Access-Control-Max-Age
X-Via
Keep-Alive
X-Robots-Tag
Server-Timing
X-Dns-Prefetch-Control
Request-Context
X-Ws-Request-Id
X-Server
X-AH-Environment
X-Age
X-Hacker
X-Turbo-Charged-By
X-Proxy-Cache
X-Server-Powered-By
X-Cache-Group
X-Backend
Host-Header
EagleId
X-Nginx-Cache-Status
X-Amz-Request-Id
X-Amz-Id-2
Report-To
X-Rq
X-UA-Device
X-Varnish-Cache
Grace
X-Page-Speed
X-LiteSpeed-Cache
X-Swift-SaveTime
X-Swift-CacheTime
Ali-Swift-Global-Savetime
X-Device
X-Pingback
X-Server-Id
EagleEye-TraceId
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Vhost
Cf-Railgun
X-Amz-Version-Id
X-Host
X-OneAgent-JS-Injection
X-Dispatcher
NEL
X-CST
X-Node
Allow
Surrogate-Control
X-Cache-Spec
X-WebKit-CSP
Request-Id
X-Backend-Server
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Response-Time
X-Akam-SW-Version
X-Readtime
Xkey
Accept-CH
X-HW
X-Country
Content-Location
X-Ac
X-Application-Context
Accept-Ch-Lifetime
X-Language
X-Ruxit-JS-Agent
Rating
X-Template
MS-Author-Via
X-Webkit-CSP
X-Url
X-Cache-Lookup
X-Mod-Pagespeed
X-Cloud-Trace-Context
X-B3-TraceId
Edge-Control
X-Vname
X-TtlSet
X-PC
X-Clacks-Overhead
X-ESI
X-MS-InvokeApp
Accept-Ch
X-Trace
X-GitHub-Request-Id
X-Content-Type
Fastly-Restarts
X-Varnish-TTL
X-Cnection
X-Origin-Cache
X-Rack-Cache
Accept-CH-Lifetime
X-ASPNET-VERSION
X-D2id
X-Use-Magma
X-Kinja-Revision
X-Kinja-Server
X-Kinja-Build
Arr-Disable-Session-Affinity
X-Cdn-Fetch
X-Exp-Id
X-GoogleNews-Bot
X-Kinja
X-Exp-Variant
X-Country-Code
Verso
X-Goog-Hash
X-VARITI-CCR
X-Cached
X-Server-Name
X-Vcap-Request-Id
X-Powered-By-Plesk
X-Navigation-Version
Cache-Tag
X-Client-IP
X-Amz-Rid
X-Abt-Application-Version
X-FastCGI-Cache
Service-Worker-Allowed
X-Fastly-Request-ID
Response
X-Middleton-Display
X-Middleton-Response
X-Buckets
Pagespeed
X-Sol
Display
X-ORACLE-DMS-ECID
RTSS
Access-Control-Request-Method
X-Ttl
X-Element-Page-Cache
X-Cache-TTL
X-MSEdge-Ref
X-Powered-CMS
X-NF-Request-ID
X-Dw-Request-Base-Id
Public-Key-Pins
X-Upstream
X-Version
X-Oneagent-Js-Injection
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Edge
S
X-Kinsta-Cache
X-LLID
X-Litespeed-Cache
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
SPRequestDuration
SPIisLatency
X-TTL
X-Ruxit-Js-Agent
Realpath
X-Accel-Expires
X-SharePointHealthScore
SPRequestGuid
X-Px
X-T
X-Jurisdiction
X-HP-Webp
X-Release
X-Correlation-Id
X-MCACHE
X-Mid
X-Forwarded-Proto
X-PressLabs-Stats
X-Mg-S
X-ECACHE
Charset
X-Content-Security-Policy-Report-Only
X-Edge-Location-Klb
X-Recruiting
X-Shield-Request-Id
X-Ezoic-Cdn
TP-Cache
TP-L2-Cache
Edge-Cache-Tag
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
Fastcgi-Cache
X-Id
X-Amz-Server-Side-Encryption
X-Content-Digest
X-Request-Received
X-Request-Processing-Time
Filters
Cache-Tags
X-DynaTrace
Content-MD5
Server-Node
X-Logged-In
Alternate-Protocol
X-Kraken-Routeconfig-Destination
X-ORACLE-DMS-RID
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
Front-End-Https
X-Forwarded-For
Nginx-Cache
X-XRDS-LOCATION
Server-Name
X-WebKit-CSP-Report-Only
X-Origin-Upstream-Status
X-Amzn-Trace-Id
Fusion-Component-Id
Fusion-Content-Source
AR-Request-ID
Fusion-Content-Id
Ar-Sid
Fusion-Source
AR-PoweredBy
AR-ATIME
Fusion-Deployment-Id
AR-CACHE
Fusion-Template-Id
X-Origin-Server
X-Grace
X-Fastcgi-Cache
X-Contextid
X-Geo-Country
X-Amz-Replication-Status
X-Rid
TCN
X-F-Cache
X-Activity-Id
X-AppVersion
Host
X-Az
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Stored-Content-Length
X-GUploader-UploadID
X-HS-Hub-Id
X-HS-Content-Id
X-HS-Cache-Config
X-Goog-Metageneration
X-Goog-Generation
X-HS-Combine-CSS
X-Cache-Key
Cleartype
X-Frontend
X-Www-Served-By
X-Protected-By
Section-Io-Cache
X-Hostname
X-LB-Cache
X-Debug-Info
X-Ser
MicrosoftSharePointTeamServices
X-Erf-Bev-Bev
X-Browser-Type
X-Erf-Bev-Bev-Is-Generated
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-Request-Handler-Origin-Region
X-Microsite
X-Page-Id
X-Cache-Age
X-Varnish-Age
X-RateLimit-Remaining
X-Git-Hash
Accept-Charset
X-Respond-Thread
X-Aspnetmvc-Version
X-Hits
X-Source
X-Upgrade-Enabled
X-DIS-Request-ID
ServerID
X-Mobile-URL
Paypal-Debug-Id
X-NWS-LOG-UUID
X-N
X-Content-Options
X-Varnish-Backend
X-Signature
X-Varnish-Grace
X-B-Cache
X-Route-Name
X-Providence-Cookie
X-Request-Guid
X-Is-Crawler
X-B3-Sampled
X-XRDS-Location
X-Flags
X-Aspnet-Duration-Ms
X-Whom
X-FB-Debug
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
Payment
Healthy
Access-Control-Allow-Method
Nel
X-TT
X-Cache-Action
X-App-Environment
X-Seen-By
X-VCache
Viewport
Node
X-CACHE-GROUP
X-AOL-HN
X-Daa-Tunnel
X-Type
X-Load-Cache
Fastcgi-Useragent
Version
MS-CV
X-Server-ID
DC
X-Mobile
X-Cache-Expired-At
Filterid
X-IPLB-Instance
X-Distributor
X-Webkit-Csp
X-HTML-Minification-Powered-By
X-Yandex-Sdch-Disable
X-Cache-Control
DynaTrace
X-FireWall-Port
Retry-After
X-Original-Request-Id
X-Response-Served-From
X-Debug
X-Instance
X-Jobs
Refresh
X-Real-IP
X-Accel-Buffering
X-RemovedCookies
X-UUID
X-Tumblr-User
X-Tumblr-Pixel
X-Tumblr-Pixel-1
X-ProcessESI
X-Varnish-Server
NGB
X-Tumblr-Pixel-0
X-Proxy-Cache-Status
X-Tt-Trace-Host
X-Tt-Trace-Tag
Ms-Operation-Id
SRV
X-RTag
X-IPS-LoggedIn
X-Page-View
X-Ab
X-Region
X-Device-Type
X-Debug-IsConnected
X-Content-Powered-By
X-Debug-IsPreview
X-Proxy
Access-Control-Request-Headers
X-Framework
X-Cluster-Name
Cache
X-Cacheable-TTL
X-Cache-Time
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
Uber-Trace-Id
X-B
Frame-Options
X-Wix-Request-Id
X-G
X-Adobe-Loc
X-Adobe-Content
X-User-Agent
X-FW-Dynamic
X-Zen-Fury
X-FW-Hash
X-FW-Serve
X-FW-Server
X-FW-Static
X-FW-Type
Countrycode
Section-Io-Origin-Time-Seconds
X-Time
Section-Io-Id
Section-Io-Origin-Status
X-Cache-Hit
Section-Origin-Responded
Surrogate-Key
Cache-Status
X-Nginx-Cache
X-Vgn-Hpd-Reason
X-Oracle-Dms-Rid
X-App-Version
Eomportal-Instance
X-Drupal-Cache-Tags
AMP-Access-Control-Allow-Source-Origin
X-NGENIX-Cache
Country
X-Azure-Ref
X-Is-Bot
X-Rendered-As
X-App-Server
X-TA-CDN-Provider
X-EdgeConnect-Cache-Status
X-RateLimit-Limit
S-Cnection
X-Rule
CF-IPCountry
X-Drupal-Cache-Contexts
X-Cache-Rule
X-Mg-Request-UUID
Liferay-Portal
X-Ms-Version
Referer-Policy
X-Ms-Request-Id
X-JoinUs
X-Proxy-Build
X-RN-RSRV
X-SaId
X-Timing-Wait
Xserver
X-UPSTREAM-Address
Selected-Fe
Meta-Geo
From-Origin
X-Varnishpool
X-Tumblr-Pixel-2
X-Yottaa-Metrics
X-Yottaa-Optimizations
X-ES-SERVER
Country-Code
X-Pubstack
X-Alternate-Cache-Key
SD-X-WS
Protected
X-Cached-By
ServedBy
X-R9-Blue-Green-Version
X-PHP-Backend
X-Cache-TTL-Remaining
X-Backend-Host
X-Shopify-Stage
X-Via-Fastly
X-No-Session
X-Cache-Server
X-ShopId
X-Handled-By
X-Sorting-Hat-PodId
X-Storefront-Renderer-Rendered
X-Loop
X-TNCMS
X-Sorting-Hat-ShopId
X-ShardId
X-Endurance-Cache-Level
X-Xfnlog-Site
X-Say-TTL
X-Human
X-Say-Cacheable
X-S-Maxage
Cache-Tv-Group
X-SayCDN-TTL
Decoy-Debug-Status
Decoy-Debug-Key
X-Varnish-Hostname
X-LAGOON
X-LJ-Flow-ID
Azure-SiteName
Azure-RegionName
Azure-InstanceId
Azure-SlotName
Azure-Version
X-OCL
X-Request-Time
Cache-Name
Decoy-Debug-TTL
Fastly-SSL
TWC-Locale-Group
Webcakes-App-Version
TWC-GeoIP-LatLong
TWC-Privacy
Webcakes-App-Name
X-Cache-PHP
X-Server-W
Akamai-GRN
TWC-GeoIP-Country
TWC-Device-Class
X-VWS-Id
Property-Id
Webcakes-Region
X-Proto
X-Be
TWC-Connection-Speed
X-Origin-Hint
X-PCL
X-NYM-Debug-Backend
X-AWS-Id
X-Node-Name
X-L-Path
X-Environment-Context
X-Cache-Operation
X-Labrador-Cache-Channel
X-Access
X-Section
X-CACHE-KEY
X-Sql-Count
X-Redis-Cache
X-Sql-Duration-Ms
X-ProxyCache-Status
X-PHP-Host
X-Dc
X-ProxyCache-Key
X-BYPASS-REASON
X-Backend-Name
X-Format
X-RCS-CacheZone
X-Status
X-Origin-Date
X-Hl-Ver
Apigw-Requestid
X-Hyper-Cache
X-FB-TRIP-ID
X-Akamai-Edgescape
X-GG-Cache-Date
X-ApacheServer
X-Hosted-By
X-PERF
X-Uri
X-UA-Device-Type
Mn-Server-Ip
X-Adobe-Source
X-Varnish-Beresp-Grace
X-CDN-Forward
X-Web-Node
X-Content-Age
X-MP-GENERATED-AT
X-WA-Info
X-Trace-Id
X-ATG-Version
X-B3-SpanId
X-Ua-Device
X-FW-Version
X-Cache-Enabled
X-Revision
X-SRV
X-Soup
X-CSRF-Token
X-Mode
X-Edge-Location
Amp-Access-Control-Allow-Source-Origin
X-ServerID
X-Time-Microsecs
Backend
X-Info
Who
X-Tumblr-Pixel-3
X-Bc-Bl
X-Cache-Type
X-TT-LOGID
X-Varnish-Ttl
X-Cache-NGX
X-Varnish-Beresp-Status
X-Datadome
X-CS
X-Microcachable
X-Akamai-Transformed
X-Debug-Cache
X-Storage
X-Detected-As
X-Platform
X-Routing-Service
X-Zipkin-Id
X-Proxied
X-APP-VERSION
X-CLOUD-TRACE-CONTEXT
X-Azure-Ref-OriginShield
X-Cache-Host
Web-Mar-Node
DataCenter
X-Via-JSL
X-Amzn-Remapped-Content-Length
X-Amz-Apigw-Id
X-Aws-Lambda-Call-Status
X-Amzn-RequestId
X-Varnish-Cache-Hits
X-Generation-Time
X-Unique-ID
X-Extlb
X-Locale
Server-Info
X-Varnish-Hits
Geo-Info
X-Ratelimit-Limit
X-Pass-Why
Cross-Origin-Opener-Policy
X-DataDome
OT-Force-Account-Verify
X-Site-Version
X-AIR-PT
X-Ratelimit-Remaining
X-Origin-CC
X-Origin-TTL
X-B3-Traceid
X-Cluster-Node
DCR-Decision-By
Expiry
Fastcgi-X-Cache-Version
DCR-Processing-Time-Ms
X-Vdms-Version
MD5-Digest
Meta-Geo-Continent
X-Thanos
X-VG-WebCache
M-TraceId
Fastly-Backend-Name
Host-ID
X-Vdms-Path
CDCHOST
Apple-News-Services-Parsed-Url
Apple-News-Services-Request-Url
BehaviorPad-Version
Apple-News-Services-Host
Apple-News-Services-Handled
X-Vtex-Remote-Cache
X-Vtex-Processado-Em
A
X-Sucuri-ID
X-VG-WebServer
CDN-RequestCountryCode
CDN-RequestId
CDN-Uid
CDN-PullZone
CDN-EdgeStorageId
CDN-Cache
CDN-CachedAt
Content-Disposition
Odigeo-Trace-Id
X-PBS-Appsvrname
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-PAYTM-SRV-ID
X-Processor
X-Cache-NE
X-B-Cookie
X-BCube-Filmed-By
X-Bip
X-Cache-Bucket
X-NAPM-TraceId
X-Location
X-From
X-External-Request-Id
X-D
X-Developer
X-Core-Value
X-Generated-On
X-Level-Front-Cache
X-Cms-Context
X-Geo-Header
X-Connection-Hash
X-ARC
X-Proxy-Upstream
Surrogated-Key
T-Server
X-S-Cookie
X-A
Rendered-Blocks
X-Destination
X-Session-Fingerprint
Mobile-Detection-Method
X-Service
X-ScT
X-A-Ccd
X-A-Dam
X-A-Dcw
X-A-Dgt
X-A-Wwc
X-Aed
X-Ratelimit-Reset
X-Request-URI
X-S
X-Rojux
X-Rewrite-Enabled
X-SRCache-Key
X-Application
X-Air-Trace-Id
X-Air-Source
X-Magnolia-Registration
X-EC-Lua
User-Cache-Control
X-TX-ID
X-Air-Hostname
Ec-Rule-Version
X-Parallel-Accel
X-Cluster
X-Varnish-Beresp-Ttl
Tcn
X-Tb
GEO-INFO
Count-Hit
Pagetype
X-Clientip
X-Developers
X-Date
X-Epic-Correlation-Id
X-Fmm-Version
X-Fastly-Cache
Memcached
X-Clara-WADP
X-Envoy-Decorator-Operation
PFcat
X-Forwarded-Site
X-Branch-Name
X-Backend-State
X-Accel-Expires-Debug
UCS
Server-Host
X-Aicache-OS
X-Cache-Info
X-Cache-Debug
Req-Svc-Chain
Path
X-Hash
X-Scheme
X-Served-From
X-Request-UUID
X-Request-Host
X-Req
X-TrackingId
X-Var-Ttl
X-WADP-Cache
X-VG-TLSProxy
X-VarnishDD-TTL
X-Varnish-Url
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
Location
X-HN
X-Has-Esi
X-GoCache-CacheStatus
X-Generated-By
X-Is-Gdpr
X-JWT-State
X-Platform-Server
X-Origin
X-NU-AKA-ACS-Version
X-Men
X-Gamma-Serve
X-Micro-Cache
CacheControlHeader
Esi-Enabled
Cache-Host
Fastly-SWR
Fastly-SIE
AKAMAI
X-Amz-Meta-S3cmd-Attrs
Gh-Request-Id
Cmstype
Cmsid
X-Servername
X-Cache-Grace
X-NWS-UUID-VERIFY
Upgrade-Insecure-Requests
X-Device-Os
Arc-Version
Fastly-Drupal-HTML
X-Mvc-Supplant-Cachable
X-Origin-Expires
C-Via
X-Old-Content-Length
Wxu-Next-Hostname
Vix-Hermes-Req-Id
Arc-Country
True-Client-Country-4JS
We-Hiring
Wxu-Next-Commit
Wxu-Next-Region
X-LI-UUID
X-Owner
X-Li-Fabric
X-Cache-Tags
DSUID
X-Cache-Id
X-Esi-Check
X-Generated-In
X-Gen-Mode
X-Fastly-Backend
Cf-Device-Type
X-CGP
X-Block-Status
X-Gzip
Cache-Key
X-Csrf-Jwt
X-Eu-Site
X-DPWN-IS-SECURE
Webserver
X-Hnp-Log
X-HS-Content-Campaign-Id
X-Irp-Debug
X-Li-Pop
X-Policy
Origin
NM-Fastcgi-Cache
NGX
X-VC-Cache
Ha-Gx-Prefs
Thinkindot-Control
Platform
Pics-Label
X-Variation
PB-RID
HA-Ipaddr
X-Viewer-Country
L5d-Success-Class
L
Kp-EeAlive
Is-Eu
State
My-App
Mail-Subject
X-Wikidot-Backend
X-Wikidot-Static-Cache
X-Thinkindot-L3
PB-PID
X-Rocket-Build-Number
TDXMobile
X-RateLimit-Limit-Second
Adler-Geo
Svr
X-RateLimit-Remaining-Second
X-Sigma-Backend
X-Sigma
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
Thinkindot-CacheControl-Type
X-Slack-Backend
Thinkindot-CacheControl
X-Forwarded-Host
Source
X-FC-Vary-Parameters
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
X-Fetched-On
X-Minions-Version
Fastcgi-Cache-TTL
X-DefHash
X-Via-NSCOPI
X-SIPLIST1
X-Varnish-CookieHashed-On
X-Skip-Cache
X-Nginx-Cache-Key
X-User
X-Varnish-CookieINHashed-On
X-Varnish-Remaining-TTL
X-PF-Uncompressing
X-Loc
X-GeoIP
X-GeoIP-City
X-VServer
X-Qloud-Router
X-DefElseHash
Locid
V-Age
VNS-Age
VNS-Cache
CPC-Cache
IsBot
Server-Ext
Server-Hostname
CPC-Age
Sever-Int
Release
X-TraceId
SID
Url
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Mvc-Supplant-OutputCached
X-TEC-API-ORIGIN
X-TEC-API-ROOT
X-TEC-API-VERSION
X-Unique-Id
X-Vc
X-Via-Popn
X-OVcl
X-Via-Popv
NtCoent-Length
X-PJAX-URL
X-OVcl-Cache
X-Via-Poph
Cache-Hits
X-Zone
X-Ua
S-Rt
X-Shop-Environment
X-Orig-Expires
X-Tenant
Cf-Bgj
DB-Nickname
X-Forwarded-Path
X-Refresh
Powered-By-ChinaCache
X-Backend-TTL
Magicmarker
Cross-Origin-Window-Policy
X-Cache-Ttl
X-Geo
XServer
X-NC
Geoip-Latitude
X-Internal-Host
GeoIp-Country-Code
X-LB-ID
X-Ftr-Request-Id
MIME-Version
X-ID
X-Dispatcher-Server
X-Conf
X-Method
Memory
Time
X-NCache
HostName
Content-Secure-Policy
X-GEO
WebServer
X-BBC-Edge-Cache-Status
X-ZONE
X-Ckpd-Fst-Backend
X-Srv
X-HP-Trace-Id
X-TIME
X-IP
X-Worker
Server-ID
Ssr
X-Li-Proto
X-Servedbyhost
X-Auto-Login
X-Dynatrace
X-Newrelic-Synthetics
X-LSADC-Cache
LB
X-V-Cache
X-Nc
Hostname
X-Vcl-Version
X-NewRelic-App-Data
X-Rocket-Nginx-Serving-Static
X-Render-Time
X-M-Log
X-Trv-Group
X-M-Reqid
X-Qnm-Cache
X-HostName
X-Platform-Cluster
Resin-Trace
X-DC
X-APP
X-Node-Id
X-Tb-Optimization-Total-Bytes-Saved
X-Platform-Processor
X-Platform-Router
X-Origin-Response-Time
Env
X-Cache-Remote
X-SD-PageType
X-Wa
X-Tx-Id
X-FTR-Request-ID
X-Traceid
Ohc-File-Size
X-MSEdge-Features
X-Cdn-Forward
X-MSEdge-Flight
Environment
X-Datadog-Parent-Id
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
Sid
X-CACHE-AGE
X-WA
X-Via-CDN
X-Reqid
X-HITS
X-App
X-VHOST
X-Varnish-Beresp-TTL
X-DynaTrace-JS-Agent
X-VCL-Version
X-Cache-Config
X-API-Version
X-Gdpr
X-Nyt-Route
X-Origin-Time
X-NodeID
X-Via-Ucdn
X-BBC-Origin-Response-Status
X-ServerName
Viewtype
X-Pod-Name
Cluster
X-Server-IP
X-Edge-Pop
VivaBuild
CF-Cached-On
Rt-Fastcgi-Cache
X-Correlation-ID
Datacenter
Candidate-Md5Url
X-Wix-Viewer-Type
Machine
X-ND-Cache
X-ElasticPress-Query
Cf-Ipcountry
X-HS-Status
X-ServedByHost
X-LI-Proto
Server-Id
Web-Mar-Region
X-Cs
X-Akamai-Pragma-Client-IP
N-Cache
X-Cache-Var
X-Cache-Var-Map
FSS-Cache
On-Server
CDN
X-Dynatrace-Js-Agent
X-CCM
X-Oss-Request-Id
X-Oss-Object-Type
X-Oss-Server-Time
X-FTR-Backend
X-Oss-Hash-Crc64ecma
X-FTR-Balancer
X-FTR-DC
Proxy-Connection
X-Country-Code-Real
X-FTR-Backend-Server
X-FTR-Realm
X-FTR-Cache-Status
X-Oss-Storage-Class
X-NGINX-Cache
X-Swa-Ws
Xc-Version
GeoIP-Country-Code
X-Check-Cacheable
GeoIP-Latitude
Mime-Version
X-URL
WZWS-RAY
X-Lb-Id
Tracecode
X-Xrds-Location
X-Esi
X-CSRF-TOKEN
Ohc-Cache-HIT
X-Via-PopH
X-Via-PopN
X-IN-APIGATEWAYSSL
X-Fastly-Backend-Reqs
X-Via-PopV
X-Pjax-Url
X-Fastly-Request-Id
X-CUA
X-VC
X-Cache-Backend
X-IN-APIGATEWAY
X-Varnish-Cacheable
Onion-Location
WWW-Authenticate
X-Swift-Error
Servername
X-EIG-Tracking-Id
Cdn
X-ECache
Cteonnt-Length
CountryCode
SR-User-Adfree
X-SN
Instruction
X-FTR-Expires
URI
X-Region-Sid
X-Webkit-CSP-Report-Only
X-Depends-On
X-Vcache
X-Provided-By
CACHE
X-Cache-ASPX
X-UnsetCookies
X-FORWARDED-FOR
Server-Ttl
X-Varnish-Authentication
X-LiteSpeed-Cache-Control
X-Contensis-Viewer-Groups
X-Air-Pt
Srv
X-TIM-N
X-Fastly-Cache-Hits
Shield-Pop
X-DW
X-RPM
X-Action
X-DB
X-DSS
X-DI
CloudFront-Viewer-Country
ServerName
Ohc-Response-Time
X-Request-Start
X-StackifyID
Redirect-Candidate
X-Fpc
X-RPS
X-RSL
X-Tid
X-Acquia-Site
X-Dw-Trace-Id
X-Yottaa-OS
X-Acquia-Application-Trace
X-Pf-Uncompressing
X-Pad
X-Core-Mission
Lfy
X-Snapshot-Date
Warning
X-ElasticPress-Search
X-Acquia-Application-UUID
W
X-Cache-Expires
WP-Super-Cache
X-SB
X-Webstats-RespID
X-Matched-Rule
X-Acquia-Purge-Tags
X-Apw-Access-Action
X-Apw-Access-Token
X-Sn-Servicetimems
X-Apw-Access-Object
Content-Script-Type
X-Varnish-URL
Xet-Cookie
X-FPC
PICS-Label
X-Apw-Hits
Content-Style-Type
X-CCDN-Origin-Time
X-Cdn-Origin
X-MiniProfiler-Ids
X-Tt-Logid
Vha6-Origin
X-C
X-RAMCache
X-Cdn-Request-ID
X-CCDN-CacheTTL
X-TH-Server
X-Hcs-Proxy-Type
X-Mg-Request-Id
X-Cache-Status-Check