Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-RAY
CF-Cache-Status
Accept-Ranges
Link
X-XSS-Protection
Pragma
ETag
Expect-CT
X-Powered-By
Via
Age
X-Cache
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
P3P
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
Alt-Svc
X-UA-Compatible
X-Served-By
X-Timer
X-Request-Id
X-Download-Options
Access-Control-Allow-Headers
X-Varnish
Access-Control-Allow-Methods
X-Xss-Protection
Access-Control-Allow-Credentials
X-Runtime
X-AspNet-Version
X-Adblock-Key
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Permitted-Cross-Domain-Policies
X-Check
X-Cache-Status
X-Generator
X-DNS-Prefetch-Control
X-Cacheable
Timing-Allow-Origin
X-Content-Security-Policy
X-FRAME-OPTIONS
X-Iinfo
X-Ua-Compatible
Content-Encoding
X-CDN
Feature-Policy
X-AspNetMvc-Version
Status
X-Request-ID
X-Envoy-Upstream-Service-Time
Access-Control-Expose-Headers
X-Drupal-Dynamic-Cache
Upgrade
Access-Control-Max-Age
X-Via
Keep-Alive
X-Ws-Request-Id
X-Age
X-AH-Environment
X-Robots-Tag
Request-Context
X-Turbo-Charged-By
EagleId
X-Cache-Group
X-Proxy-Cache
Server-Timing
X-Server
X-Backend
X-Hacker
Host-Header
X-Server-Powered-By
Report-To
X-Amz-Request-Id
X-Nginx-Cache-Status
X-Amz-Id-2
Grace
X-UA-Device
X-Dns-Prefetch-Control
X-Rq
X-Varnish-Cache
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-LiteSpeed-Cache
X-Page-Speed
Cf-Railgun
X-Pingback
X-OneAgent-JS-Injection
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-Device
X-CST
X-Amz-Version-Id
NEL
X-Cache-Spec
Allow
X-Vhost
X-Host
X-Backend-Server
X-WebKit-CSP
X-Server-Id
X-ASPNET-VERSION
Xkey
X-Dispatcher
EagleEye-TraceId
Surrogate-Control
X-Node
Request-Id
X-Response-Time
Content-Location
X-Akam-SW-Version
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Accept-CH
X-Ruxit-JS-Agent
X-Cache-Lookup
P3p
X-Application-Context
X-Country
X-Ac
X-Mod-Pagespeed
X-Cloud-Trace-Context
X-Readtime
X-Template
Accept-CH-Lifetime
X-Language
X-B3-TraceId
Accept-Ch-Lifetime
MS-Author-Via
X-HW
Rating
Accept-Ch
X-Url
X-Cnection
X-MS-InvokeApp
X-Origin-Cache
X-Vname
X-TtlSet
X-PC
Edge-Control
X-Clacks-Overhead
X-ESI
X-GitHub-Request-Id
X-Trace
X-Webkit-CSP
X-Middleton-Response
X-Sol
X-Middleton-Display
Response
Pagespeed
Display
X-D2id
X-Content-Type
Arr-Disable-Session-Affinity
Verso
X-Cdn-Fetch
X-Kinja-Server
X-GoogleNews-Bot
X-Exp-Variant
X-Use-Magma
X-Kinja
X-Kinja-Revision
X-Exp-Id
X-Kinja-Build
X-Powered-By-Plesk
X-Vcap-Request-Id
X-Country-Code
X-ORACLE-DMS-RID
X-Goog-Hash
X-Rack-Cache
X-ORACLE-DMS-ECID
X-Varnish-TTL
X-Navigation-Version
X-VARITI-CCR
X-Server-Name
X-Abt-Application-Version
X-FastCGI-Cache
X-Amz-Rid
Service-Worker-Allowed
X-Fastly-Request-ID
Fastly-Restarts
X-Client-IP
X-TTL
X-Buckets
X-Cached
X-MSEdge-Ref
X-Release
X-Cache-TTL
X-Element-Page-Cache
X-Dw-Request-Base-Id
X-NF-Request-ID
Cache-Tag
X-B3-TraceId-Primal
Mrf-Cache-Status
X-SharePointHealthScore
MRF-Tech
SPRequestGuid
Public-Key-Pins
Access-Control-Request-Method
RTSS
SPRequestDuration
SPIisLatency
X-Oneagent-Js-Injection
AR-CACHE
AR-ATIME
AR-PoweredBy
Ar-Sid
AR-Request-ID
X-Edge
X-Ezoic-Cdn
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
X-LLID
X-Powered-CMS
X-Upstream
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Version
S
Content-MD5
X-Jurisdiction
X-HP-Webp
X-Ttl
X-Recruiting
X-Mid
X-MCACHE
X-ECACHE
Charset
X-Kinsta-Cache
X-Mg-S
X-Origin-Upstream-Status
X-DynaTrace
X-PressLabs-Stats
X-T
X-Content-Digest
Fusion-Deployment-Id
Fusion-Content-Id
Fusion-Component-Id
Fusion-Content-Source
Cache-Tags
Fusion-Template-Id
Fusion-Source
X-Ruxit-Js-Agent
X-Accel-Expires
X-Px
Fastcgi-Cache
X-Forwarded-Proto
X-Id
X-Content-Security-Policy-Report-Only
X-Logged-In
Filters
TP-Cache
Server-Node
TP-L2-Cache
X-Litespeed-Cache
Edge-Cache-Tag
TCN
X-Amz-Server-Side-Encryption
Server-Name
Front-End-Https
MicrosoftSharePointTeamServices
X-Forwarded-For
X-Request-Processing-Time
X-Request-Received
X-Grace
Nginx-Cache
X-Correlation-Id
X-Fastcgi-Cache
X-Shield-Request-Id
X-Hits
X-Amzn-Trace-Id
X-B3-Sampled
Alternate-Protocol
X-XRDS-Location
X-Request-Handler-Origin-Region
X-Microsite
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-AppVersion
X-Activity-Id
X-Az
X-Debug
X-F-Cache
X-Server-ID
X-HS-Hub-Id
X-HS-Cache-Config
X-Amz-Replication-Status
X-HS-Combine-CSS
X-HS-Content-Id
X-Varnish-Age
X-Origin-Server
X-NWS-LOG-UUID
X-GUploader-UploadID
X-Goog-Stored-Content-Length
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Metageneration
X-Goog-Generation
Surrogate-Key
X-Rid
X-Frontend
X-Yandex-Sdch-Disable
X-Geo-Country
X-Cache-Age
X-DIS-Request-ID
Host
Section-Io-Cache
Accept-Charset
Nel
X-Ser
X-Git-Hash
X-Hostname
Realpath
X-XRDS-LOCATION
X-Daa-Tunnel
X-Time
X-Respond-Thread
X-VCache
Access-Control-Allow-Method
X-Mobile-URL
X-Upgrade-Enabled
X-RateLimit-Remaining
MS-CV
X-Source
X-Seen-By
X-LB-Cache
X-AOL-HN
Cleartype
Paypal-Debug-Id
ServerID
X-Type
X-DataDome
X-TT
X-Varnish-Backend
Payment
X-IPLB-Instance
X-Debug-Info
X-Cache-Action
X-Signature
Healthy
X-B-Cache
X-Request-Guid
X-Contextid
X-Aspnet-Duration-Ms
X-Route-Name
X-Whom
X-Providence-Cookie
X-Flags
X-Content-Options
X-Is-Crawler
X-Page-Id
X-App-Environment
X-Load-Cache
Fastcgi-Useragent
X-N
X-Cache-Key
X-FB-Debug
X-WebKit-CSP-Report-Only
X-Jobs
Cache
Node
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Erf-Bev-Bev
X-Mobile
X-Webkit-Csp
X-Rule
X-FTR-Request-ID
X-Cache-Expired-At
Refresh
X-Wix-Request-Id
X-Response-Served-From
X-Original-Request-Id
Viewport
X-Accel-Buffering
X-FireWall-Port
X-RTag
Ms-Operation-Id
DC
X-Cluster-Name
X-Cacheable-TTL
X-Content-Powered-By
Access-Control-Request-Headers
X-Tec-Api-Root
X-Tec-Api-Version
X-Tec-Api-Origin
X-Distributor
X-Framework
X-B
X-Drupal-Cache-Tags
X-HTML-Minification-Powered-By
Version
X-RemovedCookies
X-ProcessESI
X-Real-IP
VIX-Pulpo-Upstream-Status
Eomportal-Instance
VIX-Pulpo-Node
X-Cache-Control
X-Cache-Time
X-Instance
X-UUID
X-Zen-Fury
X-Tt-Trace-Tag
Referer-Policy
X-Tt-Trace-Host
X-Region
X-Page-View
X-Proxy
X-IPS-LoggedIn
Countrycode
X-Drupal-Cache-Contexts
X-Debug-IsConnected
X-Pinterest-Direct
X-Debug-IsPreview
X-FW-Serve
X-FW-Hash
X-FW-Dynamic
X-FW-Server
X-FW-Static
X-Www-Served-By
X-FW-Type
X-Cached-By
X-App-Server
Powered-By-ChinaCache
X-G
X-Nginx-Cache
X-Cache-Operation
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-User
X-Tumblr-Pixel
X-Cache-Rule
Liferay-Portal
X-Yottaa-Metrics
X-Protected-By
X-Via-JSL
Xserver
X-Yottaa-Optimizations
X-Akamai-Edgescape
X-Cache-Hit
X-Environment-Context
X-L-Path
Section-Io-Origin-Status
Section-Io-Id
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
X-Varnish-Grace
X-Device-Type
X-Pass-Why
SRV
Server-Info
X-Varnish-Ttl
DynaTrace
CF-IPCountry
GEO-INFO
X-User-Agent
X-Adobe-Loc
X-Adobe-Content
X-TEC-API-ROOT
X-TA-CDN-Provider
X-TEC-API-ORIGIN
X-TEC-API-VERSION
X-Varnish-Server
X-Tumblr-Pixel-2
Cache-Status
From-Origin
Retry-After
X-Mode
Webserver
Ec-Rule-Version
X-Hl-Ver
X-UPSTREAM-Address
X-Handled-By
Frame-Options
X-Endurance-Cache-Level
Meta-Geo
X-RN-RSRV
X-ES-SERVER
X-Backend-Name
Cache-Tv-Group
X-FB-TRIP-ID
X-Request-Time
X-ProxyCache-Key
X-ProxyCache-Status
X-Pubstack
X-Varnishpool
X-Be
X-Cache-Server
X-Uri
X-Storage
Apigw-Requestid
X-PCL
Country
X-BYPASS-REASON
X-OCL
X-Soup
X-MP-GENERATED-AT
TWC-Locale-Group
TWC-GeoIP-LatLong
TWC-GeoIP-Country
TWC-Device-Class
TWC-Privacy
Webcakes-Region
X-Labrador-Cache-Channel
X-AWS-Id
X-LJ-Flow-ID
X-Access
Webcakes-App-Version
TWC-Connection-Speed
Webcakes-App-Name
X-Proxy-Build
X-NYM-Debug-Backend
X-PHP-Host
Cache-Name
X-Origin-Date
X-Origin-Hint
X-No-Session
Decoy-Debug-Key
Fastly-SSL
Property-Id
Decoy-Debug-TTL
Decoy-Debug-Status
X-Proto
Selected-Fe
X-VWS-Id
X-WA-Info
X-Via-Fastly
X-Ratelimit-Limit
X-UA-Device-Type
X-Timing-Wait
X-S-Maxage
X-Format
X-Info
X-Section
X-R9-Blue-Green-Version
X-Human
X-Server-W
Azure-Version
Azure-SiteName
X-Say-Cacheable
Azure-InstanceId
Azure-RegionName
X-Say-TTL
Azure-SlotName
X-Loop
X-ApacheServer
X-Sql-Count
X-LAGOON
X-Zipkin-Id
Protected
X-GG-Cache-Date
Mn-Server-Ip
X-SayCDN-TTL
X-Proxy-Cache-Status
X-PERF
X-Routing-Service
X-TNCMS
X-Proxied
X-Sql-Duration-Ms
X-Web-Node
X-Storefront-Renderer-Rendered
Uber-Trace-Id
X-Hosted-By
X-Sorting-Hat-ShopId
X-Shopify-Stage
X-Alternate-Cache-Key
X-Sorting-Hat-PodId
X-Hyper-Cache
X-Cache-TTL-Remaining
X-ShopId
X-Xfnlog-Site
X-ShardId
AMP-Access-Control-Allow-Source-Origin
X-Redis-Cache
X-Status
X-Locale
X-Cache-Enabled
X-Is-Bot
X-Rendered-As
X-FW-Version
X-Content-Age
X-Site-Version
X-NWS-UUID-VERIFY
X-Cluster
X-Backend-Host
X-Microcachable
X-Azure-Ref
S-Cnection
X-SRV
X-AIR-PT
X-Cache-Grace
X-Dc
X-TT-LOGID
X-Qloud-Router
X-App-Version
X-Forwarded-Host
X-Platform
X-CSRF-Token
X-Revision
X-Via-CDN
X-Trace-Id
X-Node-Name
Akamai-GRN
Cache-Hits
ServedBy
Amp-Access-Control-Allow-Source-Origin
X-ATG-Version
X-Cache-NGX
X-Ratelimit-Remaining
X-Cache-PHP
X-EdgeConnect-Cache-Status
X-CCM
X-Varnish-Hostname
X-Debug-Cache
X-Aspnetmvc-Version
X-RCS-CacheZone
X-CACHE-KEY
X-Correlation-ID
X-Cache-Host
X-Detected-As
X-Amz-Apigw-Id
DB-Nickname
X-Amzn-RequestId
X-Akamai-Transformed
X-Amzn-Remapped-Content-Length
Who
X-B3-SpanId
X-TX-ID
Country-Code
X-Adobe-Source
X-Nc
X-CS
Filterid
X-BCube-Filmed-By
HostName
SD-X-WS
X-FTR-Backend-Server
X-FTR-Realm
X-Oss-Server-Time
X-FTR-Cache-Status
X-FTR-Balancer
X-FTR-Backend
X-Country-Code-Real
X-Oss-Storage-Class
X-Oss-Request-Id
X-Varnish-Beresp-Grace
X-Oss-Object-Type
X-FTR-DC
X-Oss-Hash-Crc64ecma
X-Ms-Request-Id
X-RateLimit-Limit
X-Time-Microsecs
X-Ms-Version
X-Origin-CC
X-From
X-Generated-On
X-Generation-Time
X-Level-Front-Cache
X-External-Request-Id
X-Destination
X-D
X-NAPM-TraceId
X-Location
X-Connection-Hash
X-CF-Lambda-Version
Expiry
Fastcgi-X-Cache-Version
DCR-Processing-Time-Ms
DCR-Decision-By
X-A
T-Server
Rendered-Blocks
Odigeo-Trace-Id
Mobile-Detection-Method
Meta-Geo-Continent
MD5-Digest
Machine
X-A-Ccd
X-A-Dam
X-B-Cookie
X-ARC
X-Cache-NE
X-CF-Lambda-Fn
X-Origin-TTL
X-Application
BehaviorPad-Version
X-A-Dcw
X-A-Dgt
X-A-Wwc
X-Aed
X-Varnish-Beresp-Ttl
X-Varnish-Cache-Hits
X-ScT
X-Session-Fingerprint
X-Unique-Id
X-S-Cookie
X-S
X-Rewrite-Enabled
X-Rojux
X-Trv-Group
X-Vdms-Path
X-Vtex-Processado-Em
X-Vtex-Remote-Cache
X-VG-WebServer
X-VG-WebCache
X-Vdms-Version
X-Magnolia-Registration
X-Request-UUID
X-SRCache-Key
X-PAYTM-SRV-ID
X-PBS-Appsvrname
X-Owner
X-Processor
X-Varnish-Beresp-Status
Backend
X-Backend-TTL
X-ServerID
X-EC-Lua
X-Tumblr-Pixel-3
Cache-Host
CacheControlHeader
X-TrackingId
X-Thanos
X-Cache-Bucket
X-Cms-Context
AKAMAI
X-Azure-Ref-OriginShield
X-Thinkindot-L3
Cf-Device-Type
Arc-Version
X-OVcl-Cache
Release
Host-ID
Server-Host
PB-RID
PB-PID
X-OVcl
Pagetype
Path
Gh-Request-Id
Ssr
Thinkindot-Control
UCS
V-Age
X-GEO
Fastly-Backend-Name
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
Content-Disposition
X-Bip
X-Is-Gdpr
X-Has-Esi
X-Fetched-On
X-FC-Vary-Parameters
X-Device-Os
X-Amz-Meta-S3cmd-Attrs
X-JWT-State
X-GeoIP-City
X-Geo-Header
X-Policy
X-Core-Value
X-DynaTrace-JS-Agent
X-Reqid
NGX
X-GeoIP
Sever-Int
X-GoCache-CacheStatus
X-Nginx-Cache-Key
X-Rebelmouse-Surrogate-Control
True-Client-Country-4JS
X-VG-TLSProxy
Server-Ext
X-NU-AKA-ACS-Version
On-Server
X-Node-Id
X-VServer
X-Origin
NM-Fastcgi-Cache
X-Li-Pop
Origin
X-Li-Fabric
X-IP
X-HS-Content-Campaign-Id
X-Irp-Debug
Platform
X-Ratelimit-Reset
X-Rebelmouse-Cache-Control
Server-Hostname
Vix-Hermes-Req-Id
X-DefElseHash
X-Cache-Info
X-SVT-ORM-VERSION
X-Branch-Name
X-LI-UUID
X-Mvc-Supplant-Cachable
X-DefHash
X-Cache-Tags
X-Scheme
X-Micro-Cache
X-Clientip
X-SIPLIST1
X-Skip-Cache
X-SVT-ORM-RULES
X-Origin-Expires
X-Developer
X-Developers
Wxu-Next-Region
X-Varnish-Hits
Wxu-Next-Hostname
Wxu-Next-Commit
X-Generated-In
X-Platform-Server
X-Varnish-CookieINHashed-On
X-Varnish-CookieHashed-On
X-DPWN-IS-SECURE
X-Dispatcher-Server
X-Fastly-Backend
X-Fastly-Cache
X-Variation
X-Var-Ttl
X-Varnish-Remaining-TTL
X-Epic-Correlation-Id
CDN-RequestId
CDN-RequestCountryCode
CDN-Uid
DSUID
Fastly-SIE
Esi-Enabled
CDN-EdgeStorageId
CDN-CachedAt
X-B3-Traceid
X-Unique-ID
Adler-Geo
C-Via
CDN-Cache
Fastly-SWR
CDN-PullZone
Magicmarker
Location
IsBot
Is-Eu
X-Tb
X-Sucuri-ID
User-Cache-Control
X-FTR-Expires
Locid
X-Eu-Site
X-Block-Status
X-VarnishDD-TTL
X-Gamma-Serve
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
Apple-News-Services-Handled
X-Esi-Check
X-Backend-State
X-Fmm-Version
X-User
X-Request-URI
X-Swa-Ws
X-APP-VERSION
X-CGP
X-Clara-WADP
X-Request-Host
X-Loc
Apple-News-Services-Request-Url
X-Envoy-Decorator-Operation
X-Cache-Debug
X-Cache-Id
X-Csrf-Jwt
NGB
X-Gen-Mode
Fastly-Drupal-HTML
X-Hnp-Log
X-Old-Content-Length
X-Method
X-Air-Hostname
X-Goog-Meta-Goog-Reserved-File-Mtime
X-Gzip
Ha-Gx-Prefs
X-WADP-Cache
X-Cdn-Forward
X-HN
X-Hash
HA-Ipaddr
X-Origin-Response-Time
L5d-Success-Class
L
CDCHOST
X-Aicache-OS
Rt-Fastcgi-Cache
X-Generated-By
Xc-Version
Web-Mar-Node
PFcat
X-LB-ID
Cf-Bgj
X-ID
X-NewRelic-App-Data
X-Wikidot-Static-Cache
X-Slack-Backend
Tracecode
X-Planisys-CDN-TTL
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Wikidot-Backend
X-Servername
Cmstype
X-PF-Uncompressing
Cmsid
X-Via-Poph
X-Via-Popv
X-Via-Popn
X-Edge-Location-Klb
Req-Svc-Chain
X-Mvc-Supplant-OutputCached
X-Varnish-Url
X-Kraken-Routeconfig-Destination
X-Kraken-Loop-Name
X-Server-Lifecycle-Phase
X-Instrumentation
Svr
Kp-EeAlive
X-Served-From
SR-User-Adfree
X-Cache-Var-Map
Pics-Label
Instruction
X-Cache-Var
Url
X-Refresh
A
X-Vgn-Hpd-Reason
X-CUA
Lfy
M-TraceId
X-Matched-Rule
Sid
X-TraceId
Geo-Info
Viewtype
Cross-Origin-Opener-Policy
X-Webkit-CSP-Report-Only
X-Cdn-Origin
X-SaId
VivaBuild
X-PHP-Backend
Arc-Country
X-Sn-Servicetimems
Cache-Key
CloudFront-Viewer-Country
X-Cache-Expires
X-NGENIX-Cache
X-JoinUs
X-Cache-Backend
TDXMobile
MIME-Version
X-NCache
X-Tb-Optimization-Total-Bytes-Saved
X-Edge-Location
Pramga
SID
DataCenter
X-Cache-Date
X-Core-Mission
X-DC
X-Vc
X-Srv
X-NC
Content-Secure-Policy
Server-ID
X-Extlb
X-Servedbyhost
X-CLOUD-TRACE-CONTEXT
X-Request-Start
X-Service
NtCoent-Length
X-CDN-Forward
X-Internal-Host
X-Wa
X-FireWall-Protection
X-Error
CACHE
X-Bc-Bl
Tcn
Geoip-Latitude
Source
GeoIp-Country-Code
X-Vcl-Version
X-Varnish-Cacheable
X-B3-Spanid
X-Forwarded-Site
FSS-Cache
X-HS-Status
X-LI-Proto
X-Req
Surrogated-Key
X-Response-By
X-Via-NSCOPI
X-Proxy-Upstream
X-Air-Source
X-Esi
X-Geo
LB
Memcached
X-Newrelic-Synthetics
X-VHOST
X-VC-Cache
X-Date
X-Accel-Expires-Debug
X-PJAX-URL
We-Hiring
Mail-Subject
X-Proxy-Cachei7
X-Li-Proto
Resin-Trace
Xkeyi7
X-LiteSpeed-Cache-Control
Upgrade-Insecure-Requests
X-HOST
X-CCDN-CacheTTL
X-Hcs-Proxy-Type
X-Viewer-Country
X-Sigma-Backend
HitType
Server-Ttl
X-CCDN-Origin-Time
N-Cache
X-BBXSRF
X-Rocket-Build-Number
Env
X-Sigma
GeoIP-Country-Code
Hostname
GeoIP-Latitude
X-VCL-Version
Request-ID
X-Zone
CF-Cached-On
X-App
X-RAMCache
Memory
X-RSL
X-Cs
X-TIM-N
X-Men
X-MSEdge-Features
X-MSEdge-Flight
Time
X-RPS
X-WA
X-DB
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Cache-2
X-DI
X-APP
X-DSS
X-RPM
X-DW
X-ServedByHost
X-Svr
X-Cc-Req-Id
X-Varnish-Authentication
X-Cache-ASPX
D-Cc-Upstream
S-Rt
X-Contensis-Viewer-Groups
X-Cc-Via
XServer
X-ZONE
VNS-Cache
Server-Id
CPC-Cache
X-Action
X-Air-Trace-Id
CPC-Age
ProcessTime
VNS-Age
X-Mg-Request-UUID
X-UA
X-Cache-Remote
X-HostName
Cteonnt-Length
Srv
X-Oss-Cdn-Auth
X-Cache-Config
X-Gdpr
Mime-Version
X-FPC
X-API-Version
X-Origin-Time
My-App
State
X-Region-Sid
Fastcgi-Cache-TTL
X-Nyt-Route
X-Server-IP
X-Fpc
Cross-Origin-Window-Policy
Ohc-File-Size
X-Swift-Error
X-Provided-By
X-Dynatrace-Js-Agent
X-Sucuri-Cache
X-FORWARDED-FOR
Cache-Provider
X-Depends-On
X-CF-Powered-By
W
X-Minions-Version
X-Akamai-Pragma-Client-IP
X-Cdn-Request-ID
X-BACKEND-TTL
X-NodeID
X-Cache-Ttl
X-CSRF-TOKEN
X-UnsetCookies
CDN
X-URL
X-TIME
X-Check-Cacheable
X-VC
X-Erf-Stays-Bingo-Pdp-Web
X-Ftr-Cache-Host
X-SN
X-Dw-Trace-Id
X-Xrds-Location
X-Host-Name
X-Cache-Type
X-Client-Ip
Ohc-Cache-HIT
X-ServerName
Cf-Ipcountry
X-Fastly-Request-Id
Cdn
X-Hello
X-Flog
X-ABtesting
X-Webstats-RespID
Proxy-Connection
X-SD-PageType
X-SB
X-Parent-Response-Time
OT-Force-Account-Verify
Dnion-Transfer-Encoding
X-Orig-Expires
X-Tenant
X-Fastly-Backend-Reqs
X-Pad
X-Shop-Environment
Media-Length
X-NGINX-Cache
X-ND-Cache
Vha6-Origin
X-Pf-Uncompressing
X-Oracle-DMS-ECID
X-Presslabs-Stats
X-BBC-Edge-Cache-Status
X-Snapshot-Date
X-Forwarded-Path
X-Varnish-URL
WZWS-RAY
EpKe-Alive
X-Cache-Tag
X-Air-Pt
X-Via-PopN
X-Cluster-Node
X-Render-Time
X-LiteSpeed-Tag
X-ElasticPress-Search
X-Via-PopH
X-Via-PopV
PICS-Label
Epwk-X-Cache
X-Traceid
Warning
X-Vcache
X-Akamai-ERRuleID
X-Akamai-ERPolicy
X-Acquia-Application-UUID
Xet-Cookie
X-Acquia-Application-Trace
X-Acquia-Site
X-Acquia-Purge-Tags
X-Ftr-Request-Id
X-Ms-Meta-Staticbatchstarttime
X-MiniProfiler-Ids
X-Varnish-Beresp-TTL
X-Request-URL
X-BBC-Origin-Response-Status
X-Lb-Id
X-Ms-Meta-Originalurl
X-Ua
CountryCode
Datacenter
X-Apw-Access-Token
X-Apw-Hits
X-C
X-Apw-Access-Object
X-Yottaa-OS
X-Pjax-Url
X-Redis-Count
X-Mg-Request-Id
X-Cache-Status-Check
Environment
X-Redis-Duration-Ms
X-Apw-Access-Action
X-Storefront-Renderer-Verified
Phost
X-Worker
X-Auto-Login
Ohc-Response-Time
X-ElasticPress-Query
X-Debug-Cache-Fetch
X-Debug-Cache-Store
Inserted-Into-Cache-At
X-B3-Parentspanid
X-Litespeed-Cache-Control
Content-Script-Type
Content-Style-Type
Processtime
X-Amz-Meta-Cb-Modifiedtime
NnCoection
X-Tid
URI