Threat Level: green Handler on Duty: Richard Porter

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
X-XSS-Protection
Accept-Ranges
Expect-CT
CF-RAY
Pragma
X-Powered-By
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Alt-Svc
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-UA-Compatible
X-Served-By
P3P
X-Xss-Protection
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
X-FRAME-OPTIONS
X-Permitted-Cross-Domain-Policies
Access-Control-Allow-Credentials
Content-Security-Policy-Report-Only
P3p
X-AspNet-Version
X-Runtime
X-DNS-Prefetch-Control
Accept-CH
X-Cache-Status
X-Drupal-Cache
Accept-CH-Lifetime
CF-Ray
X-Ua-Compatible
X-Check
X-Generator
X-Cacheable
Server-Timing
X-Envoy-Upstream-Service-Time
X-Request-ID
Timing-Allow-Origin
X-Iinfo
X-Drupal-Dynamic-Cache
Access-Control-Expose-Headers
Feature-Policy
X-Content-Security-Policy
Content-Encoding
X-CDN
Status
Upgrade
X-AspNetMvc-Version
Access-Control-Max-Age
X-Via
X-Amz-Request-Id
X-Amz-Id-2
Host-Header
Allow
X-Backend
Cf-Edge-Cache
X-Cache-Group
Request-Context
X-Robots-Tag
Keep-Alive
X-Server
X-Hacker
X-UA-Device
X-AH-Environment
X-Turbo-Charged-By
X-Ws-Request-Id
X-Proxy-Cache
Xkey
X-Age
X-Rq
X-Vhost
EagleId
X-Dispatcher
X-Server-Powered-By
X-Amz-Version-Id
X-Varnish-Cache
Grace
X-Dns-Prefetch-Control
Cf-Apo-Via
X-LiteSpeed-Cache
X-Page-Speed
X-Pingback
Cf-Railgun
X-Swift-CacheTime
X-Swift-SaveTime
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
EagleEye-TraceId
Ali-Swift-Global-Savetime
X-Aws-Lambda-Call-Status
X-CST
X-WebKit-CSP
X-OneAgent-JS-Injection
X-Backend-Server
Permissions-Policy
X-Readtime
X-Server-Id
X-Response-Time
X-Host
X-Akam-SW-Version
Request-Id
Surrogate-Control
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Nginx-Upstream-Cache-Status
X-HW
Accept-Ch-Lifetime
X-Cloud-Trace-Context
X-Nginx-Cache-Status
X-Node
X-Application-Context
X-Country-Code
X-Cache-Lookup
X-Ruxit-JS-Agent
X-Litespeed-Cache
X-Trace
Content-Location
Service-Worker-Allowed
X-Url
X-Content-Type
X-Country
X-Clacks-Overhead
X-Oneagent-Js-Injection
X-ECACHE
X-Edge
X-Origin-Cache-Key
X-Mcache
Accept-Ch
X-Mod-Pagespeed
X-Amz-Server-Side-Encryption
X-Midtier
Cross-Origin-Opener-Policy
X-Rack-Cache
X-FTR-Request-ID
Cache-Tag
X-MS-InvokeApp
Nginx-Cache
X-Upstream
X-TtlSet
X-Vname
X-PC
X-ESI
X-Powered-By-Plesk
Rating
Edge-Control
X-Browser-Type
X-D2id
X-Server-Name
X-Element-Page-Cache
Verso
X-Kinja
X-Kinja-Build
X-GoogleNews-Bot
X-Exp-Variant
X-Cdn-Fetch
X-Exp-Id
X-Kinja-Server
X-Kinja-Revision
X-Times
X-Cnection
X-Ac
SPRequestDuration
SPIisLatency
AR-ATIME
AR-SID
AR-PoweredBy
X-B3-TraceId
AR-Request-ID
X-Vcap-Request-Id
X-Abt-Application-Version
X-SharePointHealthScore
X-Navigation-Version
SPRequestGuid
X-Dw-Request-Base-Id
X-Ruxit-Js-Agent
X-GitHub-Request-Id
X-Ser
X-NF-Request-ID
X-RateLimit-Remaining
X-VARITI-CCR
AR-CACHE
Pinterest-Version
X-Server-ID
X-Pinterest-Rid
Pinterest-Generated-By
X-Mg-S
X-Cache-Key
S
X-Sol
Pagespeed
Display
X-Middleton-Display
RTSS
X-Client-IP
X-NWS-LOG-UUID
Edge-Cache-Tag
X-Cache-TTL
Fastly-Restarts
X-Amz-Rid
X-Amzn-Trace-Id
Origin-Trial
X-Powered-CMS
X-Goog-Hash
X-Ttl
X-Kraken-Loop-Name
X-Erf-Bev-Bev-Is-Generated
X-Erf-Bev-Bev
X-Server-Lifecycle-Phase
X-Instrumentation
X-Edge-Location-Klb
Cache-Status
X-Kinsta-Cache
X-Version
Access-Control-Request-Method
X-Content-Security-Policy-Report-Only
X-Varnish-TTL
X-Recruiting
X-ARC
X-TraceId
X-Content-Digest
Arr-Disable-Session-Affinity
X-Erf-Stays-Pdp-Viaduct-Migration-Web-V2
X-T
X-SRCache-Fetch-Status
X-SRCache-Store-Status
X-MSEdge-Ref
X-Forwarded-For
X-Middleton-Response
Response
X-Ua-Device
Content-MD5
X-Accel-Expires
MicrosoftSharePointTeamServices
TP-Cache
X-Shield-Request-Id
X-Hits
X-Cached
X-Id
X-FTR-Backend-Server
X-FTR-Backend
X-FTR-Balancer
X-FTR-Cache-Status
X-Country-Code-Real
X-FTR-Expires
Public-Key-Pins
X-Request-Received
MS-Author-Via
Server-Node
X-Request-Processing-Time
X-Ua-Browser
X-HS-Cache-Config
Front-End-Https
X-HS-Combine-CSS
X-HS-Content-Id
X-HS-Hub-Id
Payment
Cross-Origin-Resource-Policy
X-Webkit-Csp
X-Frontend
X-DIS-Request-ID
X-RateLimit-Limit
X-Forwarded-Proto
X-LLID
X-Daa-Tunnel
X-HP-Webp
X-GUploader-UploadID
X-Jurisdiction
X-HP-Trace-Id
X-FastCGI-Cache
X-Fastcgi-Cache
TP-L2-Cache
X-LB-Cache
Realpath
X-Protected-By
Cache-Tags
X-Amz-Apigw-Id
X-Amzn-RequestId
X-Origin-Server
X-Distributor
X-WebKit-CSP-Report-Only
X-TTL
X-Request-Handler-Origin-Region
X-Microsite
Count-Hit
X-Page-Id
X-B3-TraceId-Primal
X-F-Cache
MRF-Tech
Mrf-Cache-Status
X-Kinja-CCPA
X-AppVersion
X-Www-Served-By
X-NGENIX-Cache
X-Activity-Id
X-Az
X-Cluster-Name
X-Varnish-Backend
X-Hostname
Accept-Charset
Referer-Policy
X-Debug-Info
X-Geo-Country
X-Envoy-Decorator-Operation
X-App-Server
X-Correlation-Id
Fastcgi-Cache
X-Varnish-Server
X-PressLabs-Stats
Host
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Oracle-Dms-Ecid
X-ORACLE-DMS-RID
X-Goog-Metageneration
X-FB-Debug
Access-Control-Allow-Method
X-Rid
X-Git-Hash
X-Oracle-Dms-Rid
Retry-After
X-Ratelimit-Limit
Server-Name
X-Content-Options
X-Load-Cache
X-CSRF-Token
X-Webkit-CSP
X-RateLimit-Reset
X-Tt-Trace-Tag
X-Px
X-Upgrade-Enabled
X-Tt-Trace-Host
X-Aspnet-Duration-Ms
X-Route-Name
X-Request-Guid
X-Providence-Cookie
X-Contextid
X-Is-Crawler
X-Flags
DC
X-Revision
X-Origin-Cache
X-B-Cache
TCN
X-Cache-Control
X-App-Environment
X-Grace
X-ORACLE-DMS-ECID
X-Signature
X-Trace-Id
Charset
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-B
Paypal-Debug-Id
X-Datadog-Parent-Id
X-Type
Section-Io-Cache
X-B3-Sampled
X-Ezoic-Cdn
Cleartype
X-ASPNET-VERSION
X-Seen-By
X-TT
X-Mobile
X-Amz-Meta-S3cmd-Attrs
X-XRDS-LOCATION
X-Fastly-Request-ID
X-Fb-Rlafr
Healthy
X-Amz-Replication-Status
Frame-Options
X-Wix-Request-Id
X-Whom
X-Magnolia-Registration
X-Varnish-Ttl
X-Language
X-Logged-In
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Fastly-Request-Id
X-Node-Name
X-Goog-Storage-Class
Filterid
X-TEC-API-ORIGIN
X-EdgeConnect-Cache-Status
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Ratelimit-Remaining
X-Azure-Ref
X-App-Version
X-Proxy
X-Newrelic-App-Data
X-N
Content-Disposition
Backend
Akamai-GRN
X-Template
Upgrade-Insecure-Requests
X-Air-Pt
Refresh
NGB
X-Proxy-Cache-Info
X-Response-Served-From
X-Original-Request-Id
X-Is-Bot
X-Rendered-As
X-Yottaa-Metrics
X-Yottaa-Optimizations
SD-X-WS
VIX-Pulpo-Upstream-Status
VIX-Pulpo-Node
X-Page-View
X-Tumblr-User
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-RemovedCookies
X-Unique-Id
X-ProcessESI
Liferay-Portal
X-WP-CF-Super-Cache-Cache-Control
Viewport
X-Debug-IsPreview
X-Servername
X-UUID
X-Instance
X-Debug-IsConnected
X-Amzn-Remapped-Content-Length
MS-CV
Ms-Operation-Id
X-Datadog-Sampled
X-Varnish-Grace
X-WP-CF-Super-Cache
X-Adobe-Content
X-RTag
X-Adobe-Loc
X-FW-Version
X-G
X-IPS-LoggedIn
Fastly-SIE
X-Debug
X-FW-Server
X-FW-Dynamic
X-FW-Hash
X-FW-Serve
X-FW-Static
X-FW-Type
Fastly-SWR
Url
X-Device-Type
X-Cacheable-TTL
X-NYM-Debug-Backend
X-User-Agent
X-Region
X-Cache-Grace
From-Origin
X-Tec-Api-Origin
X-Rule
X-Tec-Api-Version
X-Tec-Api-Root
X-Environment-Context
X-L-Path
Country
X-Cache-Hit
X-Jobs
X-Hl-Ver
X-Status
X-Backend-Name
X-B3-SpanId
Amp-Access-Control-Allow-Source-Origin
ServerID
Surrogate-Key
Countrycode
X-Hosted-By
X-Air-Trace-Id
X-Air-Hostname
X-Air-Source
X-Cache-Age
X-Time
Alternate-Protocol
X-VC-Cache
X-Http-Reason
X-Content-Powered-By
X-Origin-TTL
X-CCDN-CacheTTL
X-Origin-CC
X-Hcs-Proxy-Type
X-CCDN-Origin-Time
X-Akamai-Request-ID2
X-Cache-Status-Check
X-NODE
X-HTML-Minification-Powered-By
X-Via-JSL
Protected
X-INCAP-ABP
WPO-Cache-Message
WPO-Cache-Status
X-B3-Traceid
Version
SRV
X-Rocket-Nginx-Serving-Static
X-Akamai-Edgescape
GEO-INFO
X-Nginx-Cache
X-CDN-Forward
CDN-RequestId
CF-IPCountry
X-Framework
X-Storage
X-WP-CF-Super-Cache-Active
X-Source
X-Accel-Version
X-Edge-Location
X-Cache-Rule
Access-Control-Request-Headers
X-XRDS-Location
Front
X-Httpd
X-Use-Magma
X-Mode
OT-Force-Account-Verify
X-Real-IP
X-Use-Mantle
X-Rn-Rsrv
X-Upstream-Ht
Accept-Language
X-Upstream-Ct
X-UPSTREAM-Address
X-Xfnlog-Site
X-VC
Webserver
X-Endurance-Cache-Level
X-Rewrite-Enabled
X-Cache-Operation
Meta-Geo
Filters
X-Director
X-Timing-Wait
X-Detected-As
X-Tumblr-Pixel-2
X-Cache-Debug
Selected-Fe
X-JoinUs
X-Soup
X-Proxy-Build
X-Served-From
X-SaId
X-Tumblr-Pixel-3
X-Varnish-Cache-Hits
ServedBy
X-Adobe-Source
X-BYPASS-REASON
X-Cms-Context
X-Handled-By
X-Say-Cacheable
X-SayCDN-TTL
X-Sql-Count
X-Sql-Duration-Ms
X-Redis-Cache
X-ProxyCache-Status
X-Logging-Id
X-Origin
X-ProxyCache-Key
X-Worker
X-Say-TTL
X-Origin-Hint
X-GeoCountry
X-No-Session
X-PHP-Host
X-GeoCode
X-Cache-Time
Webcakes-App-Version
Azure-Version
X-Loop
Webcakes-Region
Azure-RegionName
Azure-SiteName
Azure-SlotName
Azure-InstanceId
X-Labrador-Cache-Channel
TWC-Locale-Group
X-Lambda-Id
TWC-Connection-Speed
TWC-GeoIP-LatLong
Xserver
TWC-Privacy
TWC-Device-Class
X-Varnish-Age
TWC-GeoIP-Country
Xet-Cookie
Web-Mar-Node
Property-Id
X-Server-W
X-S
X-RM-Cache-TTL
X-Restarts
X-Tncms
X-VCT
X-Format
Webcakes-App-Name
DB-Nickname
X-Generation-Time
X-Tb
X-VWS-Id
X-Vercel-Id
X-IPLB-Request-ID
X-Skip-Cache
X-LJ-Flow-ID
X-RCS-CacheZone
X-IPLB-Instance
X-Git-Commit
X-Container-Uri
X-Cache-Server
X-DynaTrace
X-Fetched-On
X-Vercel-Cache
X-Varnish-Beresp-Grace
X-AWS-Id
Mn-Server-Ip
Apigw-Requestid
X-Xrds-Location
X-Ms-Request-Id
X-Cache-Host
X-Ms-Version
X-Frame-Option
X-Is-Tablet
X-Is-Supported-Browser
X-Is-Desktop
X-Is-Mobile
X-Cluster
X-Provided-By
X-Geo-Region
X-Browser-Name
Node
X-Tcp-Rtt
X-Web-Node
X-Vcache
X-AB
Section-Io-Id
X-Reqid
X-Forwarded-Host
X-Site-Version
X-Locale
X-ServerID
X-R9-Blue-Green-Version
X-Proxied
X-Routing-Service
X-Extlb
X-Zipkin-Id
Cross-Origin-Embedder-Policy
X-Platform-Cluster
X-Platform-Processor
X-Platform-Router
Cache-Tv-Group
X-Uri
X-COUNTRY
X-Webstats-RespID
AMP-Access-Control-Allow-Source-Origin
Source
X-Drupal-Cache-Tags
Priority
X-FB-TRIP-ID
X-Drupal-Cache-Contexts
Content-Secure-Policy
Fastcgi-Useragent
X-MP-GENERATED-AT
CDN-RequestPullCode
CDN-Uid
CDN-RequestPullSuccess
CDN-PullZone
CDN-Cache
WP-Super-Cache
X-Origin-Date
CDN-CachedAt
CDN-EdgeStorageId
CDN-RequestCountryCode
X-Alternate-Cache-Key
Onion-Location
X-Shopify-Stage
X-Storefront-Renderer-Rendered
X-Vcl-Version
X-Generated-By
X-Urbn-Context-Path
WZWS-RAY
X-Content-Age
X-Urbn-Site-Id
Locale
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-ShopId
X-ShardId
S-Rt
X-Sucuri-Cache
X-Pass-Why
X-TT-LOGID
X-Cdn-Origin
X-Newrelic-Synthetics
X-Sucuri-ID
Sid
X-SRV
X-Ua
X-Varnish-Beresp-Ttl
X-Cluster-Node
X-Buckets
X-Proxy-Cache-Status
Cross-Origin-Embedder-Policy-Report-Only
X-Cache-Action
X-Cache-Expired-At
X-Shield-Cache-Expires
Fastly-Drupal-HTML
X-Thinkindot-L3
Thinkindot-Control
TDXMobile
Thinkindot-CacheControl
Thinkindot-CacheControl-Type
X-Scope-Id
Cross-Origin-Window-Policy
X-CMSURLCustom
Cache
X-DataDome
X-LSADC-Cache
Atl-Traceid
HostName
X-GEO
X-Mg-Request-UUID
X-Aspnetmvc-Version
X-Via-Edge
X-Via-CDN
Edge-Copy-Time
X-Request-URI
X-Via-SSL
X-Application
X-Vdms-Path
X-B-Cookie
Sslversion
Surrogated-Key
X-PAYTM-SRV-ID
X-ScT
X-Bl-Debug
X-BCube-Filmed-By
X-SRCache-Key
X-Aed
X-Conf
T-Server
Type
X-VCache
X-A-Ccd
X-Vtex-Remote-Cache
X-A
X-Rojux
X-Cache-NE
X-Bc-Bl
X-Cache-Bucket
X-Scheme
X-Optimistic-Header
X-Viewer-Country
X-S-Cookie
X-TIM-N
MD5-Digest
X-Epic-Correlation-Id
X-External-Request-Id
X-Ec-GeoHdr
Meta-Geo-Continent
X-Ec-Fail
X-D
Lang
X-A-Dgt
Gannett-Cam-Experience-Id
X-A-Dam
Environment
X-A-Dcw
DCR-Decision-By
DCR-Processing-Time-Ms
X-Ec-Custom-Error
Ngx-Var-Key
Candidate-Md5Url
Ngx.Var.Host
X-A-Wwc
Redirect-Candidate
X-Vdms-Version
X-Destination
Origin-Agent-Cluster
Origin
X-Developer
Rendered-Blocks
CDCHOST
X-Correlation-ID
X-TimeS
X-DC
X-Datadome
X-WP-CF-Super-Cache-Cookies-Bypass
X-VServer
X-TH-Server
X-Sigma
X-Sigma-Backend
Server-Host
Pramga
Release
Req-ID
Magicmarker
L
Fastly-SSL
Host-ID
Req-Svc-Chain
Server-Ext
V-Age
Vix-Hermes-Req-Id
Ssr
Sever-Int
X-Section
Server-Hostname
X-Thanos
X-Cache-Info
X-Mly-Id
X-Dispatcher-Server
X-Loc
X-We-Are-Hiring
X-Node-Id
X-Debug-Cache-Store
X-VG-WebCache
X-Op-Id-All
X-Nyt-Route
X-Debug-Cache-Fetch
X-Varnishpool
Fastly-GeoIP-CountryCode
X-Generated-On
X-Instance-Name
X-GeoIP-Country-Code
X-Human
X-Level-Front-Cache
X-Gdpr
X-Fastly-Cache
X-Varnish-Director
X-Forwarded-Site
X-Core-Value
X-Origin-Time
X-GeoIP-Region-Code
X-SB
X-Rocket-Build-Number
X-Request-Time
X-Bip
X-BBC-Edge-Cache-Status
X-Access
X-Acquia-Purge-Cdn-Unconfigured
X-B3-Trace-ID
X-Request-Start
X-WA-Info
X-Platform
X-VG-TLSProxy
X-Varnish-Hostname
X-Clientip
X-Pool
X-Varnish-Beresp-Status
X-Req
X-Pubstack
X-Proxied-Request
X-SD-PageType
X-Aicache-OS
DSUID
Apple-News-Services-Handled
Apple-News-Services-Host
Apple-News-Services-Request-Url
X-Origin-Response-Time
Apple-News-Services-Parsed-Url
User-Cache-Control
X-DPWN-IS-SECURE
X-Device-Os
X-Cache-TTL-Remaining
X-Esi-Check
X-Zen-Fury
X-FC-Vary-Parameters
X-From
X-Var-Ttl
X-Fmm-Version
X-Cache-Id
X-Cache-Date
Web-Mar-Region
X-Ad-Load-Variation
Wxu-Next-Region
Wxu-Next-Commit
We-Hiring
X-ApacheServer
X-Block-Status
Uber-Trace-Id
X-V-Cache
X-Auto-Login
Wxu-Next-Hostname
X-Up
X-Old-Content-Length
X-Server-IP
X-NMSegId
X-Nginx-Cache-Key
X-NCache
X-Org
X-TA-CDN-Provider
X-RateLimit-Limit-Second
X-RateLimit-Remaining-Second
X-Policy
X-Request-Host
X-PERF
X-Mvc-Supplant-OutputCached
X-Mvc-Supplant-Cachable
X-UA-Device-Type
X-Gzip
X-GeoIP-City
X-GeoIP
X-Geo-Header
X-Hnp-Log
X-HS-Content-Campaign-Id
X-Men
X-Micro-Cache
X-SVT-ORM-RULES
X-Irp-Debug
X-SVT-ORM-VERSION
X-Gen-Mode
Cluster
Tube-Return
Cache-Provider
Click-Count-Error
Mail-Subject
Click-Count-Action-Start
NM-Fastcgi-Cache
Producers
Platform
Canary
On-Server
Machine
C-Via
Tube-Get-Contents
Tube-Got-Eval
Gh-Request-Id
Esi-Enabled
True-Client-Country-4JS
Country-Code
Is-Eu
Adler-Geo
Tube-Got-Results
X-Connection-Hash
X-Service
Expiry
Cdn-Host
X-Fastly-Backend
X-Core-Mission
X-Edge-Server
X-Hash
X-Ratelimit-Reset
IsBot
X-Proto
X-SIPLIST1
X-Test
Pics-Label
Cf-Device-Type
X-Cdn-Srv
Cdn-Request-Time
X-ZONE
X-Branch-Name
X-Moov-T
X-GoCache-CacheStatus
X-Contensis-Viewer-Groups
X-Cache-Aspx
X-Moov-Xdn-Version
X-Varnish-Authentication
Content-Style-Type
AKAMAI
X-App-Name
A
Content-Script-Type
W
X-Parent-Response-Time
Cache-Key
X-HA-Backend
X-CGP
X-Via-Poph
X-Sn-Servicetimems
X-Ah-Environment
X-Wikidot-Backend
NGX
Proxy-Firewall
Fastly-Backend-Name
X-Wikidot-Static-Cache
X-Eu-Site
X-Via-Popn
X-Via-Popv
RNT-Time
HA-Ipaddr
X-Csrf-Jwt
L5d-Success-Class
X-Slack-Backend
X-Amz-Meta-Cb-Modifiedtime
RNT-Machine
Ha-Gx-Prefs
X-CacheTTL
X-Slack-Shared-Secret-Outcome
Datacenter
Expect-Staple
Cdnsip
N-Cache
X-Qloud-Router
X-LB-NoCache
LB
X-AK-Request-ID
X-Owner
X-Region-Sid
X-Accel-Expires-Debug
Locid
Cdncip
Yak-Timeinfo
X-ND-Cache
X-Date
X-CF-Lambda-Version
X-CF-Lambda-Fn
Cdn
X-Dc
X-Tx-Id
X-VarnishDD-TTL
X-Shop-Environment
Xc-Version
X-LB-ID
X-Orig-Expires
PFcat
X-Tt-Logid
X-HN
X-Forwarded-Path
X-Cache-Type
X-Amz-Storage-Class
X-Tenant
X-Backend-Instance
X-Azure-Ref-OriginShield
X-Refresh
X-NGINX-Cache
X-Wa
X-Servedbyhost
X-Nc
X-Gamma-Serve
X-Varnish-Hits
X-Nf-Request-Id
X-Tb-Optimization-Total-Bytes-Saved
X-VHOST
Server-ID
X-DynaTrace-JS-Agent
RATING
Cmstype
XM
Cmsid
NtCoent-Length
SID
Cdn-Requestid
X-Srv
GeoIp-Country-Code
X-Origin-Expires
CPC-Age
X-API-Version
X-Vmg-Version
X-CDN-Cache-Status
X-Cache-Backend
X-Cdn-Diag
CPC-Cache
X-LAGOON
X-Nananana
CloudFront-Viewer-Country
X-Fpc
X-TIME
X-Akamai-Transformed
X-Via-Fastly
X-TX-ID
X-Api-Version
X-B3-Parentspanid
X-Lagoon
XkeyRZ
X-Proxy-CacheRZ
X-Hit
CacheControlHeader
X-NewRelic-App-Data
X-Zone
X-Variation
Resin-Trace
User-Agent
Cross-Origin-Opener-Policy-Report-Only
Uri
X-UA
X-Client-Ip
MIME-Version
X-URL
X-Presslabs-Stats
X-CACHE-AGE
X-Amz-Meta-Opti
True-Client-Ip
GeoIP-Latitude
X-Fastly-Country-Code
X-Info
X-Datacenter
X-LiteSpeed-Tag
Tcn
Lb
X-Ig-Origin-Region
VNS-Cache
VNS-Age
X-Location
Cache-Hits
X-B3-Spanid
X-LiteSpeed-Cache-Control
X-Dynatrace-Js-Agent
X-HostName
DataCenter
X-NWS-UUID-VERIFY
Fusion-Template-Id
Cache-Name
X-DataCenter
X-Vc
Fusion-Deployment-Id
Fusion-Content-Id
True-Client-IP
Fusion-Content-Source
Fusion-Source
X-Geo
Fusion-Component-Id
X-AIR-PT
Hostname
Mime-Version
Powered-By
X-Cloudmap
Origin-EX
X-CUA
Origin-CC
X-Jungle-Id
X-Cached-By
X-HOST
X-Dispatcher-Number
X-CSRF-TOKEN
Fastly-Drupal-Html
X-CS
X-IAuth-Set-Uid
Cf-Ipcountry
X-User
X-Segment-20210421
X-Webkit-Csp-Report-Only
X-RID
X-Cdn-Forward
Debug
X-Mid
Srv
X-Render-Time
X-MCACHE
GeoIP-Country-Code
Cl-Cache
X-Wormhole-Sdk
X-Varnish-Beresp-TTL
X-Litespeed-Tag
Load-Balancing
X-ECache
X-Cdn-Cache-Status
Ohc-File-Size
X-Powered-By-VTEX-Cache
X-VTEX-Cache-Server
X-VTEX-Cache-Time
BehaviorPad-Version
X-Esi
X-Dispatch
Edge-Cache
X-Auth-Group-Type
X-Cs
X-FPC
X-Oracle-DMS-ECID
Ohc-Cache-HIT
CDN
X-Lb-Id
X-Cache-Enabled
Server-Id
X-VCL-Version
X-WA
YJS-ID
X-ServedByHost
X-NC
My-App
Location
X-NodeID
X-Wp-Cf-Super-Cache-Cache-Control
X-Fastly-Backend-Reqs
CountryCode
X-Wp-Cf-Super-Cache
X-Lb-Nocache
X-Ig-Push-State
Server-Info
X-Litespeed-Cache-Control
Ms-Author-Via
Wpo-Cache-Message
Wpo-Cache-Status
X-Internal-Host
CF-Ctrl
Xkey-La3
Xkeylog
Odigeo-Trace-Id
X-MiniProfiler-Ids
X-Snapshot-Date
CF-Cached-On
X-MSEdge-Features
X-MSEdge-Flight
X-Proxy-Cache-La3
X-Akamai-Pragma-Client-IP
X-Cdn-Request-ID
X-Custom-Header
X-Vgn-Hpd-Reason
X-IN-APIGATEWAY
Time
Memory
Memcached
X-Acquia-Application-Trace
X-Acquia-Application-UUID
OriginIP
X-IN-APIGATEWAYSSL
X-Acquia-Purge-Tags
X-Acquia-Site
X-FL-QIT-DEBUG
FSS-Cache
Section-Origin-Responded
X-FL-EDGE
Srvid
X-App
X-APP-VERSION
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Ngx
X-Nitro-Cache
X-Nitro-Cache-From
X-Nitro-Rev
X-Cache-Version
X-Shardid
X-Sorting-Hat-Shopid
X-Sorting-Hat-Podid
X-Shopid
X-Cache-FS-Status
X-PHP-Backend
X-Pad
X-Http-Duration-Ms
X-Te-Duration-Ms
Akamai-Cache-Status
X-Http-Count
X-Te-Count
X-Ha-Backend
X-Depends
X-Dw-Trace-Id
X-Sucuri-Id
Sm-Log-Id
X-Check-Cacheable
X-Th-Server
X-Wp-Cf-Super-Cache-Cookies-Bypass
X-RequestId
Geoip-Latitude
X-Serial
X-Service-Response-Time
X-Via-PopV
X-Via-PopN
X-Via-PopH
X-Udemy-Cache-App-Namespace
X-Fastly-Cache-Hits
X-Web-Server
X-Lsadc-Cache
X-Mg-Cache