Threat Level: green Handler on Duty: Daniel Wesemann

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Accept-Ranges
X-XSS-Protection
Expect-CT
Pragma
X-Powered-By
X-Cache
CF-RAY
Via
Age
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
P3P
X-Cache-Hits
X-UA-Compatible
X-Served-By
CF-Ray
X-Xss-Protection
X-Download-Options
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Request-Id
X-Adblock-Key
Access-Control-Allow-Credentials
X-FRAME-OPTIONS
X-Permitted-Cross-Domain-Policies
X-AspNet-Version
Alt-Svc
X-Request-ID
X-Runtime
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-DNS-Prefetch-Control
X-Generator
X-Cache-Status
X-Check
X-Cacheable
Timing-Allow-Origin
X-Envoy-Upstream-Service-Time
X-Iinfo
X-Content-Security-Policy
X-Drupal-Dynamic-Cache
Feature-Policy
Content-Encoding
Access-Control-Expose-Headers
Status
Upgrade
X-AspNetMvc-Version
X-CDN
Access-Control-Max-Age
X-Via
Server-Timing
Request-Context
X-Dns-Prefetch-Control
X-Robots-Tag
X-Turbo-Charged-By
X-Amz-Request-Id
X-UA-Device
X-Cache-Group
X-Amz-Id-2
EagleId
X-Backend
X-AH-Environment
X-Proxy-Cache
Keep-Alive
X-Server
X-Ws-Request-Id
X-Age
Cf-Edge-Cache
Host-Header
X-Hacker
X-Vhost
X-Server-Powered-By
X-Rq
X-Varnish-Cache
X-Dispatcher
X-Amz-Version-Id
Grace
Allow
X-Swift-CacheTime
X-Swift-SaveTime
X-OneAgent-JS-Injection
Ali-Swift-Global-Savetime
P3p
X-LiteSpeed-Cache
X-Ua-Compatible
X-Page-Speed
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
Cf-Apo-Via
X-Device
Cf-Railgun
X-WebKit-CSP
Accept-CH
X-Aws-Lambda-Call-Status
X-Node
X-Pingback
EagleEye-TraceId
X-Host
X-Server-Id
X-Ruxit-JS-Agent
Surrogate-Control
X-Nginx-Cache-Status
X-Akam-SW-Version
X-Readtime
Request-Id
X-Backend-Server
Accept-Ch-Lifetime
X-Content-Security-Policy-Report-Only
X-Cache-Lookup
X-HW
X-Cloud-Trace-Context
X-Cache-Spec
X-EdgeConnect-Origin-MEX-Latency
X-Response-Time
X-EdgeConnect-MidMile-RTT
X-Application-Context
X-Trace
Permissions-Policy
X-Nginx-Upstream-Cache-Status
Fastly-Restarts
X-Litespeed-Cache
X-Edge
X-Mod-Pagespeed
X-WebKit-CSP-Report-Only
X-Country
Content-Location
X-Mcache
X-MS-InvokeApp
X-Content-Type
X-Url
X-Clacks-Overhead
X-Midtier
X-Vname
X-TtlSet
X-PC
X-Amz-Server-Side-Encryption
X-CST
Rating
RTSS
Accept-CH-Lifetime
X-ECACHE
Cache-Tag
X-ESI
X-Vcap-Request-Id
X-Rack-Cache
X-D2id
X-Element-Page-Cache
Verso
X-Exp-Variant
X-Kinja-Server
X-Kinja-Revision
X-Kinja-Build
X-Kinja
X-Use-Magma
X-Exp-Id
X-GoogleNews-Bot
X-Cdn-Fetch
Origin-Trial
X-Server-Name
X-VARITI-CCR
Service-Worker-Allowed
X-GitHub-Request-Id
X-Ac
X-Powered-By-Plesk
X-Cnection
X-Amz-Rid
X-SharePointHealthScore
SPRequestGuid
X-Client-IP
X-Navigation-Version
Xkey
Edge-Control
SPRequestDuration
SPIisLatency
X-Upstream
X-Abt-Application-Version
X-Varnish-TTL
X-Cache-TTL
Arr-Disable-Session-Affinity
X-Cached
X-B3-TraceId
X-Dw-Request-Base-Id
X-Webkit-Csp
X-Mg-S
X-Erf-Bev-Bev
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Instrumentation
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Ttl
X-NWS-LOG-UUID
X-Px
Accept-Ch
X-Sol
X-Middleton-Display
Pagespeed
Display
X-SRCache-Fetch-Status
X-SRCache-Store-Status
Access-Control-Request-Method
Edge-Cache-Tag
X-Forwarded-For
X-Correlation-Id
X-FastCGI-Cache
X-Cache-Key
X-NF-Request-ID
X-Country-Code
X-Goog-Hash
X-Ser
X-Powered-CMS
X-Id
AR-Request-ID
AR-PoweredBy
AR-CACHE
AR-ATIME
AR-SID
Content-MD5
TCN
Public-Key-Pins
Front-End-Https
X-Amzn-Trace-Id
X-Version
X-Jurisdiction
X-HP-Webp
X-HP-Trace-Id
X-T
X-MSEdge-Ref
X-Recruiting
Response
X-Middleton-Response
X-Content-Digest
X-Ratelimit-Limit
X-Accel-Expires
X-RateLimit-Remaining
TP-L2-Cache
TP-Cache
MicrosoftSharePointTeamServices
X-Shield-Request-Id
X-Fastly-Request-ID
S
Cache-Status
Nginx-Cache
X-Fastcgi-Cache
X-XRDS-Location
X-HS-Hub-Id
X-HS-Cache-Config
X-HS-Combine-CSS
X-Request-Received
Cross-Origin-Opener-Policy
X-HS-Content-Id
X-Request-Processing-Time
Server-Node
Cache-Tags
X-Ratelimit-Remaining
X-B3-TraceId-Primal
MRF-Tech
Mrf-Cache-Status
X-Daa-Tunnel
X-Hits
X-Distributor
X-PressLabs-Stats
X-LB-Cache
X-Origin-Server
X-Edge-Location-Klb
X-Kinsta-Cache
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-Ua-Browser
X-TTL
X-Ezoic-Cdn
X-Ratelimit-Reset
Fastcgi-Cache
Alternate-Protocol
X-Frontend
Filterid
X-LLID
X-Hostname
X-Microsite
X-Request-Handler-Origin-Region
X-Rid
X-Grace
Realpath
X-TEC-API-ORIGIN
Healthy
X-TEC-API-ROOT
X-TEC-API-VERSION
X-Logged-In
X-DIS-Request-ID
X-FB-Debug
Server-Name
X-Varnish-Backend
X-Git-Hash
X-Cluster-Name
X-Www-Served-By
X-Geo-Country
X-NGENIX-Cache
Payment
X-Page-Id
X-Debug-Info
Cleartype
X-Forwarded-Proto
X-Load-Cache
MS-Author-Via
DC
X-Protected-By
X-Origin-Cache
Access-Control-Allow-Method
Content-Disposition
X-B3-Sampled
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-GUploader-UploadID
X-Upgrade-Enabled
Charset
X-Goog-Metageneration
X-AppVersion
X-Activity-Id
X-Proxy
X-Az
X-DataDome
X-Seen-By
X-Times
Count-Hit
X-B3-Traceid
X-Cache-Age
X-Amz-Meta-S3cmd-Attrs
X-F-Cache
X-Fb-Rlafr
X-Amz-Replication-Status
X-B
X-Akamai-Edgescape
Cross-Origin-Resource-Policy
X-Whom
X-Type
X-Azure-Ref
Accept-Charset
X-Contextid
X-Varnish-Server
X-Revision
Paypal-Debug-Id
Surrogate-Key
X-Is-Crawler
X-Route-Name
X-Request-Guid
X-Flags
X-Providence-Cookie
X-Aspnet-Duration-Ms
X-TT
X-App-Environment
Retry-After
Viewport
X-Wix-Request-Id
X-Language
X-Hosted-By
X-Envoy-Decorator-Operation
X-ECache
X-DynaTrace
X-Cache-Control
X-B-Cache
X-Signature
X-Magnolia-Registration
X-Varnish-Grace
X-App-Server
X-Mobile
X-Source
Amp-Access-Control-Allow-Source-Origin
X-Goog-Storage-Class
X-Goog-Generation
Version
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
Host
WPO-Cache-Status
WPO-Cache-Message
X-VCache
X-Server-ID
X-Amz-Apigw-Id
X-Amzn-RequestId
Refresh
X-HTML-Minification-Powered-By
X-N
X-Cache-Rule
X-Oracle-Dms-Ecid
X-Oracle-Dms-Rid
X-Tumblr-User
X-Varnish-Age
X-Cache-Time
X-Tumblr-Pixel
X-Response-Served-From
X-Original-Request-Id
X-Tumblr-Pixel-1
Access-Control-Request-Headers
X-Tumblr-Pixel-0
X-EdgeConnect-Cache-Status
SD-X-WS
Protected
Ms-Operation-Id
X-Environment-Context
X-Cacheable-TTL
X-Content-Powered-By
MS-CV
X-Region
X-G
X-Rule
X-L-Path
X-Jobs
Referer-Policy
X-UUID
X-RTag
X-ProcessESI
X-Tt-Trace-Host
X-User-Agent
X-Tt-Trace-Tag
X-Framework
X-RemovedCookies
GEO-INFO
X-Device-Type
X-Status
X-FW-Dynamic
X-FW-Hash
X-Cache-Grace
X-Http-Reason
VIX-Pulpo-Upstream-Status
X-Backend-Name
VIX-Pulpo-Node
Akamai-GRN
From-Origin
X-FW-Static
X-Trace-Id
X-FW-Server
X-FW-Serve
X-Akamai-Request-ID2
X-FW-Type
Front
X-FW-Version
X-Is-Bot
X-Rendered-As
Section-Io-Cache
X-Cache-Expired-At
X-Page-View
X-NYM-Debug-Backend
X-Cache-Status-Check
NGB
X-Adobe-Loc
X-Adobe-Content
X-Instance
X-RateLimit-Limit
X-Drupal-Cache-Tags
X-Nginx-Cache
X-Unique-Id
X-Drupal-Cache-Contexts
X-XRDS-LOCATION
Url
CDN-RequestId
Pinterest-Version
Pinterest-Generated-By
X-Servername
X-Pinterest-Rid
Liferay-Portal
X-Content-Options
Accept-Language
X-Time
X-CDN-Forward
X-Template
SRV
Fastly-SWR
X-Zen-Fury
Fastly-SIE
X-Air-Trace-Id
X-Air-Source
X-Air-Hostname
X-Newrelic-App-Data
X-Debug-IsConnected
X-Debug-IsPreview
Backend
X-Cache-Hit
X-DynaTrace-JS-Agent
X-Mode
X-Yottaa-Metrics
X-Yottaa-Optimizations
Country
X-Uri
X-Rocket-Nginx-Serving-Static
X-COUNTRY
X-Varnish-Ttl
X-App-Version
X-ARC
X-Tec-Api-Version
X-Fastly-Request-Id
X-Tec-Api-Origin
X-Tec-Api-Root
X-Edge-Location
X-Cache-Operation
Node
X-Extlb
Meta-Geo
X-Tumblr-Pixel-2
X-Generation-Time
X-Tumblr-Pixel-3
Onion-Location
X-Zipkin-Id
S-Rt
X-Proxied
Filters
X-Cache-Server
X-UPSTREAM-Address
X-Amzn-Remapped-Content-Length
X-RN-RSRV
X-Rewrite-Enabled
Content-Secure-Policy
X-Routing-Service
Selected-Fe
X-Proxy-Build
Uber-Trace-Id
X-PHP-Backend
X-Proxy-Cache-Info
Countrycode
Webserver
CF-IPCountry
X-Locale
X-Content-Age
X-Timing-Wait
X-Server-W
Cache-Hits
TWC-GeoIP-Country
Azure-InstanceId
TWC-GeoIP-LatLong
Azure-SiteName
Cache-Name
TWC-Device-Class
Azure-Version
Property-Id
Azure-RegionName
Azure-SlotName
Mn-Server-Ip
TWC-Connection-Speed
X-Ms-Request-Id
X-Skip-Cache
X-LJ-Flow-ID
X-Soup
Webcakes-Region
X-Reqid
X-Access
X-Site-Version
X-BYPASS-REASON
X-Cache-Action
X-Cms-Context
X-Format
X-Section
X-UA-Device-Type
X-ProxyCache-Status
Webcakes-App-Name
WP-Super-Cache
X-Origin-Hint
X-Proxy-Cache-Status
TWC-Privacy
X-Web-Node
X-VWS-Id
X-ProxyCache-Key
X-AWS-Id
X-Via-Fastly
X-Cluster-Node
X-Ms-Version
TWC-Locale-Group
Webcakes-App-Version
X-IPS-LoggedIn
Cache-Tv-Group
X-Sucuri-ID
X-Tb
X-Sucuri-Cache
X-Say-TTL
X-Origin-Date
X-Say-Cacheable
X-Proto
X-SayCDN-TTL
X-Ua
X-Forwarded-Host
X-Cluster
X-Debug
X-IPLB-Instance
X-IPLB-Request-ID
X-Optimistic-Header
X-Cache-Host
X-Cache-TTL-Remaining
X-PHP-Host
X-No-Session
X-Detected-As
X-Labrador-Cache-Channel
X-JoinUs
X-SaId
Apigw-Requestid
X-Xfnlog-Site
Locale
X-Urbn-Context-Path
X-Urbn-Site-Id
X-R9-Blue-Green-Version
X-Ruxit-Js-Agent
Web-Mar-Node
Cross-Origin-Window-Policy
DB-Nickname
X-Sql-Duration-Ms
X-Sql-Count
X-Varnish-Beresp-Grace
X-Adobe-Source
X-Handled-By
X-LSADC-Cache
X-FB-TRIP-ID
X-VC-Cache
X-Real-IP
ServedBy
ServerID
X-Director
X-LAGOON
Fastcgi-Useragent
X-WP-CF-Super-Cache
Frame-Options
X-Node-Name
X-WP-CF-Super-Cache-Cache-Control
X-Oneagent-Js-Injection
X-GeoCountry
X-GeoCode
Upgrade-Insecure-Requests
X-Tt-Logid
X-Varnish-Hits
Fastly-Drupal-HTML
Source
Mime-Version
Load-Balancing
X-Api-Version
X-Aspnetmvc-Version
X-Varnish-Cache-Hits
X-Hl-Ver
X-Generated-By
X-GEO
X-Buckets
CDN-PullZone
CDN-Uid
CDN-RequestCountryCode
X-Varnish-Hostname
CDN-CachedAt
X-FireWall-Port
X-Request-Time
X-ServerID
CDN-Cache
CDN-EdgeStorageId
Xet-Cookie
X-Webkit-CSP-Report-Only
X-Datadog-Parent-Id
X-Datadog-Sampling-Priority
X-Datadog-Sampled
X-Datadog-Trace-Id
X-Origin-TTL
X-RM-Cache-TTL
X-URL
X-Origin-CC
X-Redis-Cache
X-Mg-Request-UUID
X-Cache-Debug
X-TIME
X-Akamai-Transformed
X-TA-CDN-Provider
X-SRV
CF-Cached-On
X-Loop
X-Served-From
Xserver
X-Sorting-Hat-ShopId
X-Storefront-Renderer-Rendered
X-Sorting-Hat-PodId
X-ShardId
X-Tx-Id
X-Alternate-Cache-Key
X-ShopId
X-Shopify-Stage
X-Pubstack
X-Storage
X-Endurance-Cache-Level
X-Restarts
X-Provided-By
X-Pass-Why
X-Newrelic-Synthetics
X-Request-Host
X-CSRF-Token
X-Location
Meta-Geo-Continent
Ngx.Var.Host
X-ScT
Memcached
Lang
MD5-Digest
NM-Fastcgi-Cache
Rendered-Blocks
Odigeo-Trace-Id
X-Scale
Redirect-Candidate
Release
X-S-Maxage
X-INCAP-ABP
X-Men
Host-ID
X-Level-Front-Cache
Origin
Gannett-Cam-Experience-Id
BehaviorPad-Version
X-Origin
C-Via
Cache-Host
A
X-Fetched-On
X-Processor
X-Origin-Time
X-Rocket-Build-Number
X-Rojux
X-Nyt-Route
DCR-Processing-Time-Ms
DSUID
Server-Host
DCR-Decision-By
Candidate-Md5Url
X-S
X-Mobile-URL
X-Mid
X-S-Cookie
Sslversion
X-A-Dam
X-A-Dcw
X-A-Dgt
X-CUA
X-D
X-A-Ccd
X-Test
X-Developer
X-Destination
X-SVT-ORM-VERSION
X-Aed
X-SVT-ORM-RULES
X-B-Cookie
X-Bc-Bl
X-BCube-Filmed-By
X-Bip
X-Auto-Login
X-Application
X-Core-Mission
X-Conf
X-CMSURLCustom
X-Cache-NE
X-A
X-Ec-Fail
T-Server
X-Generated-On
X-Gdpr
X-External-Request-Id
X-TIM-N
Surrogated-Key
Xc-Version
X-Vdms-Version
X-Hash
X-Vdms-Path
TDXMobile
Thinkindot-CacheControl
X-Sigma
X-Thanos
X-Sigma-Backend
WWW-Authenticate
Thinkindot-Control
X-Ec-GeoHdr
Thinkindot-CacheControl-Type
X-Thinkindot-L3
X-Epic-Correlation-Id
X-SRCache-Key
X-A-Wwc
X-Varnish-Beresp-Ttl
X-Via-CDN
Server-Info
X-Service
HostName
X-Httpd
X-FL-EDGE
X-Cdn-Origin
X-CacheTTL
X-Cache-Info
X-Cdn-Srv
X-Developers
X-Dispatcher-Number
X-Cache-Date
X-Fastly-Backend
X-Ec-Custom-Error
X-Dispatcher-Server
Tube-Got-Results
Origin-EX
Req-Svc-Chain
Origin-CC
Locid
Gh-Request-Id
Srvid
Tube-Get-Contents
X-Akamai-Device-Characteristics
Tube-Return
X-FL-QIT-DEBUG
Tube-Got-Eval
X-BBC-Edge-Cache-Status
X-Geo-Header
X-SD-PageType
X-Server-IP
X-Response-By
X-Req
X-Region-Sid
X-Slack-Backend
X-Slack-Shared-Secret-Outcome
Magicmarker
X-We-Are-Hiring
X-Varnishpool
X-Sn-Servicetimems
X-Pool
X-Platform-Router
X-Nginx-Cache-Key
X-Instance-Name
X-Human
Edge-Cache
X-Node-Id
X-Org
X-Platform-Processor
X-Platform-Cluster
X-Platform
X-Origin-Response-Time
X-Gamma-Serve
X-Loc
CacheControlHeader
Click-Count-Action-Start
CloudFront-Viewer-Country
Cmsid
AKAMAI
Click-Count-Error
Cmstype
Country-Code
Edge-Copy-Time
X-Via-Edge
X-Via-SSL
X-WP-CF-Super-Cache-Active
Environment
Apple-News-Services-Parsed-Url
Apple-News-Services-Handled
X-Esi-Check
Apple-News-Services-Host
X-Vcl-Version
X-Forwarded-Site
X-FC-Vary-Parameters
X-Frame-Option
X-Fastly-Cache
Adler-Geo
X-Date
X-Cache-Bucket
Canary
X-Cache-FS-Status
X-Block-Status
X-Azure-Ref-OriginShield
X-Accel-Expires-Debug
X-Ad-Defer-Variation
X-Cache-Id
Cache-Key
X-DefHash
X-Device-Os
X-DefElseHash
X-Gen-Mode
X-Ckpd-Fst-Backend
X-Core-Value
Apple-News-Services-Request-Url
X-Has-Esi
X-Variation
X-Varnish-CookieHashed-On
X-Varnish-CookieINHashed-On
X-Var-Ttl
X-V-Cache
X-Planisys-CDN-TTL
X-SB
X-Varnish-Remaining-TTL
X-Vmg-Version
PFcat
X-HN
X-VarnishDD-TTL
L
X-Worker
X-VServer
X-WA-Info
X-Planisys-CDN-Rules
X-Planisys-CDN-Cache
X-HS-Content-Campaign-Id
X-Irp-Debug
X-Is-Gdpr
X-Hnp-Log
Wxu-Next-Region
X-GeoIP-City
X-Gzip
X-JWT-State
X-Minions-Version
X-Origin-Expires
X-Owner
X-NodeID
X-NCache
X-Mly-Id
X-Mvc-Supplant-Cachable
X-GeoIP
X-Op-Id-All
On-Server
State
X-VC
Section-Io-Origin-Status
Section-Io-Id
Platform
We-Hiring
Expect-Staple
Section-Io-Origin-Time-Seconds
Fastly-Backend-Name
User-Cache-Control
Vix-Hermes-Req-Id
Fastly-GeoIP-CountryCode
Mail-Subject
Wxu-Next-Commit
Server-Ext
Wxu-Next-Hostname
X-Zone
Ssr
Is-Eu
Kp-EeAlive
Section-Origin-Responded
Server-Hostname
Sever-Int
X-TNCMS
X-Wix-Viewer-Type
X-Ua-Device
Cache-Provider
HA-Ipaddr
Ha-Gx-Prefs
CDCHOST
X-WADP-Cache
X-GeoIP-Region-Code
X-Fmm-Version
X-Clara-WADP
X-RCS-CacheZone
X-DPWN-IS-SECURE
X-VG-TLSProxy
X-GeoIP-Country-Code
Producers
X-From
Datacenter
X-Release
X-Csrf-Jwt
Web-Mar-Region
Machine
X-App
X-Old-Content-Length
X-Microcachable
X-Accel-Buffering
NGX
X-Aicache-OS
X-CGP
X-Eu-Site
X-Qloud-Router
X-Cache-Tags
X-Cache-Remote
L5d-Success-Class
X-Air-Pt
X-CACHE-AGE
X-VCT
X-Varnish-Beresp-Status
X-Cache-Enabled
X-LB-NoCache
X-Platform-Server
Fastly-SSL
X-Lambda-Id
X-Request-Start
X-Parent-Response-Time
X-Correlation-ID
X-Nananana
X-Mvc-Supplant-OutputCached
X-Up
Pics-Label
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-Dc
X-B3-SpanId
X-Via-Popn
X-Refresh
X-Vtex-Remote-Cache
X-Upstream-Ht
X-Upstream-Ct
X-Generated-In
X-Render-Time
X-Via-Poph
X-Via-Popv
X-AIR-PT
X-Cs
X-B3-Spanid
X-Trace-ID
X-DC
CPC-Cache
VNS-Cache
X-Cache-Backend
GeoIP-Latitude
VNS-Age
CPC-Age
X-Cached-By
X-Tb-Optimization-Total-Bytes-Saved
AMP-Access-Control-Allow-Source-Origin
X-HA-Backend
X-Cache-Type
SID
X-CCDN-CacheTTL
Decoy-Debug-Status
Env
X-ND-Cache
Sid
Decoy-Debug-Key
X-TH-Server
Decoy-Debug-TTL
Memory
X-Hcs-Proxy-Type
Time
Cluster
X-CCDN-Origin-Time
Cache
NtCoent-Length
X-Webkit-CSP
X-LB-ID
X-Servedbyhost
X-Nf-Request-Id
X-Tid
X-ATG-Version
X-Edge-Pop
X-Esi
X-HS-Status
X-Nc
X-Srv
X-Wa
X-Presslabs-Stats
Server-ID
Cdn
Srv
X-NWS-UUID-VERIFY
X-Contensis-Viewer-Groups
X-Client-Ip
X-Varnish-Authentication
X-Cache-ASPX
X-DataCenter
X-Via-JSL
X-NewRelic-App-Data
X-MP-GENERATED-AT
X-Vgn-Hpd-Cached
Svr
X-Vgn-Hpd-Ssi
X-Vgn-Hpd-Variations-Key
Esi-Enabled
X-CF-Lambda-Fn
Fastly-Drupal-Html
X-PAYTM-SRV-ID
X-CF-Lambda-Version
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
Uri
X-Fpc
X-Amz-Meta-Cb-Modifiedtime
GeoIp-Country-Code
X-ZONE
X-Check-Cacheable
X-Proxy-CacheRZ
X-Datadome
XkeyRZ
YJS-ID
N-Cache
Lb
X-Vc
X-Udemy-Cache-App-Namespace
X-Shop-Environment
X-Wikidot-Static-Cache
RNT-Time
X-Forwarded-Path
M-TraceId
True-Client-IP
X-CACHE-KEY
Resin-Trace
X-Tenant
True-Client-Ip
X-Wikidot-Backend
X-CDN-Cache-Status
X-Bl-Debug
RNT-Machine
X-Orig-Expires
Hostname
X-CS
X-NGINX-Cache
X-EC-Lua
X-CSRF-TOKEN
X-MSEdge-Flight
X-MSEdge-Features
X-AK-Request-ID
XServer
X-Fastly-Country-Code
Cdncip
Cdnsip
X-App-Name
X-Varnish-Beresp-TTL
X-Gateway-Skip-Cache
X-Gateway-Cache-Key
X-Via-NSCOPI
X-Gateway-Cache-Status
X-Gateway-Request-Id
X-TX-ID
OT-Force-Account-Verify
X-B3-Trace-ID
X-Policy
X-API-Version
X-FPC
Sm-Log-Id
GeoIP-Country-Code
X-Service-Response-Time
X-Logging-Id
X-Container-Uri
X-Datacenter
Eomportal-Instance
X-Git-Commit
X-Cache-Ttl
Path
CDN
X-Vcache
Server-Id
Hit
X-Accel-Version
X-CLOUD-TRACE-CONTEXT
X-SIPLIST1
X-Cdn-Diag
X-VCL-Version
Ngx-Var-Key
X-WA
X-Lb-Id
X-MCACHE
IsBot
HIT
X-Micro-Cache
X-APP-VERSION
X-NC
X-Cache-NGX
X-Geo
X-RateLimit-Reset
X-Edge-POP
LB
X-Request-URI
X-Ha-Backend
X-Cdn-Cache-Status
X-Tncms
Pramga
X-Acquia-Purge-Cdn-Unconfigured
XM
X-ServedByHost
RATING
X-Info
X-SERVER-NAME
X-Akamai-Pragma-Client-IP
X-Clientip
Geoip-Latitude
X-Snapshot-Date
X-Rebelmouse-Cache-Control
X-Rebelmouse-Surrogate-Control
X-Srcache-Store-Status
X-Srcache-Fetch-Status
FSS-Cache
X-Xrds-Location
V-Age
ENV
Timeexpire
X-Cdn-Forward
X-VG-WebCache
Tcn
X-TT-LOGID
CDN-RequestPullCode
CDN-RequestPullSuccess
Epwk-X-Cache
True-Client-Country-4JS
Req-ID
X-Via-PopV
X-Via-PopN
X-Via-PopH
X-Ctl-Mach
Yjs-Id
Cross-Origin-Opener-Policy-Report-Only
Location
Cdn-Requestid
X-HostName
X-Iauth-Set-Uid
X-Wp-Cf-Super-Cache
X-Wp-Cf-Super-Cache-Cache-Control
X-TimeS
X-Hyper-Cache
W
Ohc-File-Size
X-Amz-Meta-Opti
X-Dw-Trace-Id
X-Pod-Name
Proxy-Connection
X-Serial
X-Lb-Nocache
Warning
X-LiteSpeed-Tag
X-M-Reqid
X-LiteSpeed-Cache-Control
X-M-Log
X-Viewer-Country
X-RAMCache
Cneonction
X-Litespeed-Cache-Control
X-Cdn-Request-ID
X-UP
WZWS-RAY
X-Qnm-Cache
X-Fastly-Backend-Reqs
X-ApacheServer
Content-Style-Type
Content-Script-Type
X-PERF
X-Acquia-Site
X-Vgn-Hpd-Reason
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-Acquia-Application-Trace
X-User
Servername
X-MiniProfiler-Ids
X-Lsadc-Cache
CountryCode
X-Akamai-ERRuleID
X-WP-CF-Super-Cache-Cookies-Bypass
PICS-Label
Ohc-Cache-HIT
X-Moov-Xdn-Version
X-Akamai-ERPolicy
X-Moov-T
X-Oss-Server-Time
X-Oss-Hash-Crc64ecma
X-Oss-Object-Type
X-Oss-Request-Id
X-IPS-Cached-Response
X-Cache-Expires
Ec-Rule-Version
X-B3-ParentSpanId
X-Oss-Storage-Class
MIME-Version
X-Fastly-Cache-Hits
X-Webstats-RespID
X-Th-Server
Ngx
My-App
X-B3-Parentspanid
X-Mg-Cache