Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Last-Modified
Cf-Request-Id
CF-Cache-Status
Link
Accept-Ranges
CF-RAY
X-XSS-Protection
ETag
Expect-CT
Pragma
X-Powered-By
Via
X-Cache
Age
Content-Security-Policy
Access-Control-Allow-Origin
Content-Language
Referrer-Policy
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
Alt-Svc
X-UA-Compatible
X-Served-By
X-Download-Options
X-Timer
X-Request-Id
Access-Control-Allow-Headers
X-Varnish
X-Xss-Protection
Access-Control-Allow-Methods
Access-Control-Allow-Credentials
X-AspNet-Version
X-Runtime
X-Adblock-Key
X-Permitted-Cross-Domain-Policies
X-DNS-Prefetch-Control
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-Cache-Status
X-Check
X-Generator
X-Cacheable
Timing-Allow-Origin
X-Content-Security-Policy
X-Iinfo
Feature-Policy
Status
X-Envoy-Upstream-Service-Time
Content-Encoding
Access-Control-Expose-Headers
P3p
X-Drupal-Dynamic-Cache
X-AspNetMvc-Version
X-CDN
X-Request-ID
Upgrade
X-Via
CF-Ray
Report-To
X-Ws-Request-Id
Access-Control-Max-Age
Server-Timing
EagleId
X-Cache-Group
X-Turbo-Charged-By
Keep-Alive
X-UA-Device
Request-Context
X-Age
X-Backend
X-Proxy-Cache
X-Server-Powered-By
X-AH-Environment
X-Robots-Tag
X-Hacker
X-Server
X-Amz-Request-Id
Host-Header
NEL
X-Amz-Id-2
Grace
X-Rq
X-Swift-SaveTime
X-Swift-CacheTime
X-Nginx-Cache-Status
X-Varnish-Cache
X-LiteSpeed-Cache
Ali-Swift-Global-Savetime
X-WebKit-CSP
X-Page-Speed
X-Vhost
EagleEye-TraceId
X-Ua-Compatible
X-Amz-Version-Id
X-OneAgent-JS-Injection
X-Pingback
X-Dispatcher
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
X-Device
X-Cache-Spec
Accept-CH
X-Host
X-Server-Id
Cf-Railgun
X-Node
X-Backend-Server
X-Readtime
Surrogate-Control
X-Akam-SW-Version
X-Dns-Prefetch-Control
Request-Id
X-Response-Time
X-HW
X-Application-Context
Xkey
Content-Location
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
Rating
X-Ruxit-JS-Agent
X-Country
X-B3-TraceId
X-Cloud-Trace-Context
Accept-CH-Lifetime
Accept-Ch-Lifetime
X-Cache-Lookup
X-Trace
X-Url
Allow
X-Ac
X-Content-Type
X-Vname
X-TtlSet
X-PC
X-Aws-Lambda-Call-Status
X-Varnish-TTL
Edge-Control
X-Clacks-Overhead
X-Server-Name
Fastly-Restarts
X-ESI
X-Mod-Pagespeed
Cache-Tag
X-Rack-Cache
X-VARITI-CCR
Service-Worker-Allowed
X-FastCGI-Cache
Verso
X-Element-Page-Cache
X-Vcap-Request-Id
X-Upstream
X-Amz-Rid
X-MS-InvokeApp
MS-Author-Via
X-GitHub-Request-Id
Public-Key-Pins
X-Dw-Request-Base-Id
X-Cached
X-Client-IP
X-Abt-Application-Version
RTSS
X-D2id
X-Cnection
X-Px
X-Cache-TTL
X-Kinja-Build
X-GoogleNews-Bot
X-Kinja
X-Cdn-Fetch
X-Exp-Id
X-Kinja-Revision
X-Exp-Variant
X-Kinja-Server
X-Use-Magma
Access-Control-Request-Method
Arr-Disable-Session-Affinity
X-Country-Code
X-Navigation-Version
X-Powered-By-Plesk
X-Goog-Hash
X-NF-Request-ID
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-TTL
AR-CACHE
AR-SID
AR-PoweredBy
AR-Request-ID
AR-ATIME
X-Sol
X-Powered-CMS
X-Middleton-Display
Pagespeed
Display
X-Version
X-Origin-Cache
Response
X-Middleton-Response
X-LLID
X-CST
X-MSEdge-Ref
TCN
X-Edge-Location-Klb
X-RateLimit-Remaining
Nginx-Cache
X-Kinsta-Cache
X-Amz-Server-Side-Encryption
X-B3-TraceId-Primal
Mrf-Cache-Status
MRF-Tech
X-Edge
X-Protected-By
X-T
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
X-Forwarded-For
X-Content-Security-Policy-Report-Only
X-Shield-Request-Id
X-Mg-S
X-Aspnetmvc-Version
X-Id
X-Language
S
Edge-Cache-Tag
Content-MD5
SPIisLatency
SPRequestDuration
Front-End-Https
Fastcgi-Cache
X-Mid
Realpath
Server-Node
X-Request-Processing-Time
X-Request-Received
X-Frontend
X-Pinterest-Rid
Pinterest-Version
Pinterest-Generated-By
X-Recruiting
Filters
Server-Name
X-Content
X-Ab
X-Ser
X-Cache-Key
X-Ua-Browser
X-NWS-LOG-UUID
X-MCACHE
X-Correlation-Id
X-Template
X-Yandex-Sdch-Disable
X-HS-Hub-Id
X-HS-Content-Id
X-Ruxit-Js-Agent
X-HS-Cache-Config
X-DynaTrace
X-HS-Combine-CSS
X-Ezoic-Cdn
X-SharePointHealthScore
SPRequestGuid
X-Hits
X-ECACHE
X-Parallel-Accel
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
MicrosoftSharePointTeamServices
X-Ttl
X-Tt-Trace-Tag
X-Tt-Trace-Host
Cache-Tags
X-Page-Id
Cleartype
X-B3-Sampled
Charset
Host
X-Webkit-Csp
X-Git-Hash
X-Litespeed-Cache
X-Daa-Tunnel
X-Www-Served-By
X-Debug-Info
X-Geo-Country
Alternate-Protocol
X-Content-Options
Accept-Ch
X-DIS-Request-ID
Fusion-Component-Id
Fusion-Content-Source
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Content-Id
Fusion-Source
X-Content-Digest
X-Hostname
X-Amzn-Trace-Id
Cross-Origin-Opener-Policy
X-Amz-Replication-Status
Filterid
X-Ratelimit-Limit
X-Varnish-Age
X-Grace
X-F-Cache
X-FB-Debug
ServerID
X-VCache
X-DataDome
X-N
X-Accel-Expires
X-Upgrade-Enabled
X-AppVersion
X-Activity-Id
X-Nginx-Upstream-Cache-Status
X-Az
X-Rid
X-Forwarded-Proto
X-Mobile-URL
X-Fastly-Request-ID
X-Providence-Cookie
X-Flags
X-Aspnet-Duration-Ms
Access-Control-Allow-Method
X-Is-Crawler
X-Request-Guid
X-Route-Name
X-Origin-Server
X-LB-Cache
X-Type
X-Server-ID
X-Seen-By
X-TT
X-Whom
X-Goog-Stored-Content-Length
X-Varnish-Grace
X-App-Environment
X-Tb
Payment
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
Viewport
X-Goog-Metageneration
X-Goog-Generation
X-GUploader-UploadID
X-FW-Type
X-FW-Static
X-FW-Hash
X-WebKit-CSP-Report-Only
X-FW-Server
X-FW-Serve
X-FW-Dynamic
X-User-Agent
Node
Fastcgi-Useragent
X-Distributor
DC
Paypal-Debug-Id
X-Wix-Request-Id
Accept-Charset
Country
TP-L2-Cache
TP-Cache
X-XRDS-LOCATION
X-Fastly-Request-Id
X-App-Server
X-Cache-Rule
X-Ratelimit-Reset
X-Tec-Api-Version
X-Tec-Api-Origin
X-Tec-Api-Root
X-Cache-Control
X-Via-JSL
X-NGENIX-Cache
X-Fastcgi-Cache
X-Cluster-Name
Version
X-Drupal-Cache-Tags
X-Cache-Age
X-Signature
X-B-Cache
X-Contextid
X-Buckets
X-Request-Handler-Origin-Region
X-Microsite
Referer-Policy
X-Oracle-Dms-Ecid
X-Origin-Upstream-Status
Amp-Access-Control-Allow-Source-Origin
X-Node-Name
Cache-Status
X-Oracle-Dms-Rid
Refresh
X-Logged-In
X-Response-Served-From
SD-X-WS
X-Original-Request-Id
VIX-Pulpo-Node
VIX-Pulpo-Upstream-Status
X-Page-View
X-Is-Bot
X-Jobs
X-Mobile
X-Cache-Expired-At
X-Rendered-As
X-Vgn-Hpd-Reason
X-Real-IP
X-IPLB-Instance
X-Load-Cache
X-B
X-Erf-Bev-Bev-Is-Generated
X-Proxy-Cache-Status
X-Revision
X-Erf-Bev-Bev
X-Debug
NGB
X-Browser-Type
Access-Control-Request-Headers
X-Cacheable-TTL
X-Yottaa-Metrics
X-Proxy
X-ProcessESI
X-Instance
X-RemovedCookies
X-Varnish-Backend
X-Cache-Action
X-Device-Type
X-Yottaa-Optimizations
X-G
X-Framework
X-Drupal-Cache-Contexts
X-UUID
Surrogate-Key
Akamai-GRN
X-Cache-Time
X-Debug-IsPreview
X-Rule
X-Debug-IsConnected
X-FW-Version
CF-IPCountry
X-Accel-Buffering
SID
X-Presslabs-Stats
GEO-INFO
X-Air-Source
X-Air-Trace-Id
X-Air-Hostname
X-Oneagent-Js-Injection
X-Cache-NGX
Count-Hit
Uber-Trace-Id
X-Nginx-Cache
X-RateLimit-Limit
X-Azure-Ref
X-Cache-Operation
X-Source
X-Ms-Version
X-Ms-Request-Id
X-Zen-Fury
X-XRDS-Location
DynaTrace
X-EdgeConnect-Cache-Status
Protected
X-TEC-API-ORIGIN
X-APP-VERSION
X-TEC-API-VERSION
X-TEC-API-ROOT
Liferay-Portal
X-PressLabs-Stats
Frame-Options
WPO-Cache-Message
WPO-Cache-Status
X-CDN-Forward
X-RTag
X-Servername
X-Cache-Hit
Ms-Operation-Id
MS-CV
Healthy
X-Backend-Name
X-Hyper-Cache
Ec-Rule-Version
X-IPS-LoggedIn
X-Cache-TTL-Remaining
Countrycode
Cross-Origin-Window-Policy
X-Tumblr-Pixel-1
X-L-Path
X-Mode
Xserver
X-Tumblr-Pixel-0
X-Tumblr-User
X-Tumblr-Pixel
X-Environment-Context
Content-Disposition
X-Adobe-Content
X-Adobe-Loc
X-Ratelimit-Remaining
Backend
X-Trace-Id
X-Varnish-Server
LB
X-UPSTREAM-Address
X-Tid
X-Content-Age
Meta-Geo
X-SaId
X-JoinUs
X-Rewrite-Enabled
X-Detected-As
X-RN-RSRV
X-Extlb
Country-Code
X-Format
X-Hosted-By
X-Cache-Grace
Apigw-Requestid
Url
X-Alternate-Cache-Key
X-Debug-Cache
X-Cache-Server
X-ShardId
X-Sql-Duration-Ms
X-Sql-Count
X-Sorting-Hat-ShopId
X-Proxied
X-Redis-Cache
X-Zipkin-Id
X-Uri
X-Sorting-Hat-PodId
X-Routing-Service
X-Region
X-ShopId
X-Shopify-Stage
X-FB-TRIP-ID
Mn-Server-Ip
X-Access
X-ApacheServer
X-UA-Device-Type
X-Origin-Date
X-Section
CDN-Cache
X-Via-Fastly
CDN-EdgeStorageId
Cache-Name
Eomportal-Instance
Decoy-Debug-Key
Decoy-Debug-Status
CDN-Uid
CDN-RequestId
X-ServerID
CDN-PullZone
CDN-RequestCountryCode
CDN-CachedAt
X-Varnish-Beresp-Grace
X-Human
X-PERF
X-Forwarded-Host
X-Generation-Time
Decoy-Debug-TTL
X-PHP-Backend
X-Microcachable
X-Status
X-NCache
X-No-Session
X-Site-Version
X-Generated-By
TWC-Connection-Speed
TWC-Device-Class
Property-Id
TWC-GeoIP-Country
X-Akamai-Edgescape
Fastly-SSL
X-OCL
X-Storage
X-PCL
X-Server-W
TWC-Locale-Group
X-Web-Node
X-Cache-Host
X-BYPASS-REASON
X-ProxyCache-Key
X-ProxyCache-Status
X-Cache-Type
X-Content-Powered-By
X-Cluster-Node
X-Origin-Hint
X-Proxy-Build
X-Timing-Wait
Webcakes-App-Version
Webcakes-App-Name
TWC-Privacy
X-Pubstack
X-NYM-Debug-Backend
X-Say-Cacheable
Webcakes-Region
X-SayCDN-TTL
X-Say-TTL
TWC-GeoIP-LatLong
Selected-Fe
X-Soup
Section-Io-Cache
Cache-Tv-Group
X-Varnishpool
X-Be
X-Hl-Ver
X-LSADC-Cache
Azure-SiteName
Azure-RegionName
Azure-SlotName
Azure-InstanceId
Retry-After
X-Nginx-Cache-Key
Azure-Version
X-R9-Blue-Green-Version
Content-Secure-Policy
X-Webkit-CSP
X-NewRelic-App-Data
X-TIME
X-Unique-Id
DB-Nickname
X-Cache-Remote
X-Ua
X-Cached-By
X-Azure-Ref-OriginShield
X-TT-LOGID
X-Bc-Bl
X-Platform-Server
OT-Force-Account-Verify
X-Auto-Login
X-Akamai-Transformed
Source
X-Dc
Cache
X-Xfnlog-Site
X-GEO
X-Cache-Tags
ServedBy
Upgrade-Insecure-Requests
X-Cdn
X-LAGOON
SRV
From-Origin
Xet-Cookie
X-Varnish-Cache-Hits
X-Origin-TTL
X-Origin-CC
HostName
X-AOL-HN
X-Request-Time
Mime-Version
X-Varnish-Hits
X-CSRF-Token
Cache-Hits
X-Loop
X-TNCMS
X-App-Version
X-HTML-Minification-Powered-By
X-Varnish-Hostname
X-Request-Host
X-Time
X-EC-Lua
WP-Super-Cache
X-S-Maxage
X-SRV
X-NWS-UUID-VERIFY
Webserver
X-Xrds-Location
X-ECache
Onion-Location
X-FireWall-Port
X-Cache-Enabled
Web-Mar-Node
X-Handled-By
X-Tumblr-Pixel-2
X-Tumblr-Pixel-3
X-B3-SpanId
N-Cache
X-Proto
X-Correlation-ID
X-Http-Reason
X-Akamai-Request-ID2
Nel
Ms-Author-Via
X-Adobe-Source
S-Rt
X-Tenant
X-Endurance-Cache-Level
X-Origin-Response-Time
X-RCS-CacheZone
Mobile-Detection-Method
X-Forwarded-Path
X-A-Wwc
X-External-Request-Id
X-Cache-NE
X-A-Dgt
Fastcgi-X-Cache-Version
X-Gen-Mode
X-SRCache-Key
X-Reqid
X-A-Dam
X-Ftr-Request-Id
X-Vtex-Processado-Em
X-A-Dcw
X-B-Cookie
Rendered-Blocks
X-Epic-Correlation-Id
X-Developer
X-Conf
X-Vdms-Path
X-Connection-Hash
X-Cluster
X-Ckpd-Fst-Backend
X-Vdms-Version
X-CF-Lambda-Fn
X-CF-Lambda-Version
X-V-Cache
X-AWS-Id
Pramga
Redirect-Candidate
X-Aed
X-Destination
X-A-Ccd
X-D
X-TIM-N
A
X-VG-WebCache
X-GG-Cache-Date
User-Cache-Control
X-Rojux
X-Orig-Expires
X-ARC
X-ND-Cache
X-NAPM-TraceId
X-Slack-Backend
Vix-Hermes-Req-Id
V-Age
DCR-Decision-By
X-PAYTM-SRV-ID
X-Amz-Meta-S3cmd-Attrs
X-Processor
X-Planisys-CDN-TTL
DCR-Processing-Time-Ms
X-Planisys-CDN-Rules
Surrogated-Key
X-Backend-TTL
X-PBS-Appsvrname
X-Planisys-CDN-Cache
X-S-Cookie
X-S
X-Ig-Push-State
X-VWS-Id
X-A
Expiry
X-Session-Fingerprint
X-Hnp-Log
X-Shop-Environment
Odigeo-Trace-Id
Xc-Version
BehaviorPad-Version
X-Block-Status
X-Vtex-Remote-Cache
Meta-Geo-Continent
X-LJ-Flow-ID
Sslversion
X-SD-PageType
X-Application
X-ScT
X-Time-Microsecs
X-Edge-Location
Server-Info
X-Magnolia-Registration
X-MP-GENERATED-AT
X-Aicache-OS
Traceparent
State
Origin-EX
Origin-CC
Origin
Svr
True-Client-Country-4JS
Wxu-Next-Region
Wxu-Next-Hostname
Wxu-Next-Commit
X-Accel-Expires-Debug
X-LI-UUID
X-Rocket-Nginx-Serving-Static
X-Scheme
X-Server-IP
X-Request-URI
X-Proxy-Upstream
X-Origin
X-Origin-Expires
X-Policy
X-Sucuri-Cache
X-Sucuri-ID
X-VServer
X-Webstats-RespID
X-Fastly-Backend
X-Viewer-Country
X-VG-TLSProxy
X-SVT-ORM-RULES
X-SVT-ORM-VERSION
X-Old-Content-Length
X-NodeID
X-Fastly-Cache
X-Fetched-On
X-Forwarded-Site
X-Device-Os
X-Date
X-Cache-Date
X-Cache-Info
X-Cdn-Srv
X-GeoIP-Country-Code
X-GeoIP-Region-Code
X-Men
X-Mg-Request-UUID
X-Mvc-Supplant-Cachable
X-Location
X-Li-Pop
X-Hash
X-Li-Fabric
X-Cache-Bucket
X-Core-Mission
CDCHOST
CacheControlHeader
Cmsid
Cmstype
Fastcgi-Cache-TTL
Arc-Country
Apple-News-Services-Request-Url
AKAMAI
X-Locale
Apple-News-Services-Handled
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
Gh-Request-Id
DSUID
Host-ID
CloudFront-Viewer-Country
X-Via-NSCOPI
Environment
Fastly-Drupal-Html
X-Developers
X-Envoy-Decorator-Operation
X-Datadog-Trace-Id
X-Eu-Site
X-Gdpr
X-VarnishDD-TTL
X-Gamma-Serve
X-Cdn-Origin
X-Esi-Check
X-Has-Esi
X-CGP
X-Csrf-Jwt
X-Cache-Id
X-Cache-Debug
X-Branch-Name
X-Datadog-Parent-Id
X-Sn-Servicetimems
X-Is-Gdpr
X-Geo-Header
X-JWT-State
X-Restarts
X-Datadog-Sampling-Priority
X-FC-Vary-Parameters
X-GeoIP
X-UnsetCookies
X-Req
X-Region-Sid
X-RateLimit-Remaining-Second
X-RateLimit-Limit-Second
X-Rocket-Build-Number
X-Served-From
L
X-TrackingId
X-Skip-Cache
X-Sigma-Backend
X-Sigma
X-Platform
X-PHP-Host
X-HN
X-Irp-Debug
X-Gzip
X-GeoIP-City
X-TH-Server
X-Labrador-Cache-Channel
X-BBC-Edge-Cache-Status
X-Origin-Time
X-Owner
X-Nyt-Route
X-Node-Id
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Status
X-Storefront-Renderer-Rendered
Fastly-GeoIP-CountryCode
L5d-Success-Class
Release
Req-Svc-Chain
PFcat
Ha-Gx-Prefs
Ssr
HA-Ipaddr
Web-Mar-Region
We-Hiring
X-ATG-Version
Locid
Mail-Subject
Machine
X-Backend-State
X-Thinkindot-L3
X-Cache-Var
Server-Host
TDXMobile
X-Amzn-RequestId
X-Qloud-Router
X-Tx-Id
X-Level-Front-Cache
X-Cache-Var-Map
X-Amz-Apigw-Id
X-Pod-Name
Thinkindot-CacheControl-Type
Thinkindot-Control
Thinkindot-CacheControl
X-HS-Content-Campaign-Id
X-Generated-On
X-Zone
NM-Fastcgi-Cache
X-DefElseHash
X-DefHash
X-Response-By
X-Variation
Is-Eu
X-Varnish-CookieHashed-On
X-DPWN-IS-SECURE
Memcached
X-NU-AKA-ACS-Version
X-Rebelmouse-Cache-Control
X-Rebelmouse-Surrogate-Control
X-Loc
Magicmarker
Fastly-SWR
Platform
Cf-Device-Type
Fastly-SIE
Adler-Geo
X-Varnish-Remaining-TTL
X-Varnish-CookieINHashed-On
X-Core-Value
X-Trace-ID
Accept-Language
X-Ua-Device
X-NC
X-RPM
X-DI
X-Worker
NGX
X-Wix-Viewer-Type
X-Action
X-DSS
X-VC-Cache
X-RPS
Kp-EeAlive
Edge-Cache
X-Cache-Backend
X-DW
X-CS
X-DB
X-RSL
AMP-Access-Control-Allow-Source-Origin
X-Amzn-Remapped-Content-Length
X-LB-ID
X-Up
CDN
X-TraceId
X-Mvc-Supplant-OutputCached
X-Request-Start
X-Srv
X-Thanos
Pics-Label
X-LB-NoCache
X-Optimistic-Header
X-Generated-In
X-Minions-Version
X-CacheTTL
X-Bip
X-Qnm-Cache
X-M-Log
X-M-Reqid
X-Tb-Optimization-Total-Bytes-Saved
X-Urbn-Context-Path
Locale
Memory
Time
X-API-Version
X-Urbn-Site-Id
Env
X-Via-Popv
WebServer
X-Cache-Config
X-Refresh
X-Varnish-Ttl
X-DC
X-Via-Poph
X-Via-Popn
X-Tt-Logid
X-Edge-Pop
X-HA-Backend
Datacenter
X-Cache-Ttl
GeoIp-Country-Code
X-CACHE-KEY
X-Ec-Fail
X-Ec-GeoHdr
X-User
X-Parent-Response-Time
X-DynaTrace-JS-Agent
X-TA-CDN-Provider
Server-ID
X-Esi
X-Servedbyhost
Candidate-Md5Url
NtCoent-Length
X-Dynatrace
X-MSEdge-Features
X-ZONE
X-MSEdge-Flight
X-CLOUD-TRACE-CONTEXT
X-Cs
Cdncip
X-Vc
X-AK-Request-ID
On-Server
Cdnsip
WWW-Authenticate
X-Datadome
X-TX-ID
X-WADP-Cache
X-Fmm-Version
Esi-Enabled
X-VCL-Version
X-Clara-WADP
Cluster
X-Varnish-Beresp-TTL
My-App
X-Webkit-CSP-Report-Only
X-Var-Ttl
Tracecode
X-App
Geoip-Latitude
X-CUA
X-LI-Proto
X-Traceid
X-Fpc
X-Pass-Why
X-URL
X-Cache-PHP
T-Server
X-Webkit-Csp-Report-Only
X-Li-Proto
C-Via
X-Unique-ID
X-Service
X-From
Lfy
X-VC
DataCenter
X-Fragments
X-Newrelic-Synthetics
X-FPC
X-B3-Spanid
Lang
Cf-Int-Pingora-Origin-Digest
X-NODE
Fastly-Drupal-HTML
Target-Params
Geo-Info
Test
X-Vcl-Version
Proxy-Connection
X-Mcache
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
Resin-Trace
M-TraceId
X-Render-Time
X-Cache-Status-Check
X-Provided-By
X-LiteSpeed-Cache-Control
Server-Id
X-RAMCache
X-CSRF-TOKEN
Permissions-Policy
X-Ha-Backend
GeoIP-Country-Code
MIME-Version
X-ID
Hostname
X-Edge-POP
Hit
X-Httpd
X-ServedByHost
WZWS-RAY
X-Api-Version
Servername
X-Proxy-Cache-Info
X-Clientip
X-Geo
X-Dynatrace-Js-Agent
X-Via-PopN
X-Via-PopH
FSS-Cache
X-SB
X-Cdn-Forward
X-Via-PopV
Producers
X-RateLimit-Reset
X-Pad
X-Edge-Cache
X-Oss-Storage-Class
X-Oss-Request-Id
X-Oss-Server-Time
X-Udemy-Cache-App-Namespace
X-Pool
X-Fastly-Backend-Reqs
X-Platform-Processor
X-LiteSpeed-Tag
ENV
UCS
Cache-Host
X-NGINX-Cache
HIT
X-Oss-Object-Type
X-Oss-Hash-Crc64ecma
X-Platform-Router
X-Platform-Cluster
X-Ucs
X-ElasticPress-Query
X-Scale
X-Info
Section-Origin-Responded
Section-Io-Origin-Time-Seconds
Section-Io-Id
Section-Io-Origin-Status
X-Ec-Custom-Error
X-AIR-PT
S-Cnection
X-Acquia-Application-Trace
X-Acquia-Application-UUID
Server-Ext
X-UP
MD5-Digest
URI
Server-Hostname
X-Cache-Expires
X-Dispatcher-Number
PICS-Label
X-BBC-Origin-Response-Status
X-Check-Cacheable
X-GoCache-CacheStatus
Cneonction
X-Cache-CFC
Uri
Sever-Int
X-Acquia-Purge-Tags
X-Lb-Nocache
ServerName
X-Acquia-Site
X-HS-Status
X-Srcache-Store-Status
X-Srcache-Fetch-Status
Ohc-File-Size
X-Via-Ucdn
IsBot
Server-Ttl
X-SIPLIST1
X-Swift-Error
Fastly-Backend-Name
X-Fastly-Cache-Hits
Cteonnt-Length
X-Lb-Id
X-Micro-Cache
X-Nc
Tcn
X-Cdn-Request-ID
X-Release
User-Agent
X-Dw-Trace-Id
X-B3-ParentSpanId
Vha6-Origin
CF-Cached-On
X-Akamai-ERRuleID
X-Akamai-ERPolicy
X-Backend-Host
Cf-Ipcountry
X-Yottaa-OS
Wpo-Cache-Message
X-Vcache
Ngx
X-Snapshot-Date
X-Newrelic-App-Data
X-UA
Wpo-Cache-Status
X-Cms-Context
X-ServerName
X-Air-Pt
X-HostName
Load-Balancing
Sid
X-Cache-Ngx
X-Apw-Access-Token
Inserted-Into-Cache-At
X-Litespeed-Cache-Control
X-Fetch-By
GeoIP-Latitude
X-Via-CDN
X-Apw-Hits
X-IN-APIGATEWAYSSL
X-B3-Parentspanid
X-Apw-Access-Object
X-Shopify-Generated-Cart-Token
X-IN-APIGATEWAY
X-Apw-Access-Action
Shield-Pop
Req-ID
X-Http-Count
X-Http-Duration-Ms
CountryCode
EpKe-Alive
X-Sentry-ID
X-APP
X-Contensis-Viewer-Groups
X-Te-Count
X-Te-Duration-Ms
X-CacheKey
X-Akamai-Request-ID
X-Logging-Id
X-BCube-Filmed-By
X-Akamai-Pragma-Client-IP
X-Cache-ASPX
X-Last-Modified
X-Varnish-Authentication