Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Accept-Ranges
Expect-CT
Pragma
X-Powered-By
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
X-Xss-Protection
P3P
X-UA-Compatible
X-Served-By
X-Download-Options
CF-Ray
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
X-Request-ID
Access-Control-Allow-Credentials
X-FRAME-OPTIONS
X-Permitted-Cross-Domain-Policies
X-Request-Id
X-AspNet-Version
Alt-Svc
X-Runtime
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-DNS-Prefetch-Control
X-Check
X-Generator
X-Cache-Status
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Envoy-Upstream-Service-Time
X-Content-Security-Policy
X-Drupal-Dynamic-Cache
Feature-Policy
Content-Encoding
Access-Control-Expose-Headers
Upgrade
Status
X-CDN
X-AspNetMvc-Version
P3p
Access-Control-Max-Age
X-Via
Server-Timing
X-UA-Device
Request-Context
X-Robots-Tag
X-Turbo-Charged-By
X-Cache-Group
X-Amz-Request-Id
EagleId
X-Amz-Id-2
X-Backend
X-AH-Environment
X-Proxy-Cache
Keep-Alive
X-Ua-Compatible
X-Server
X-Ws-Request-Id
X-Age
Host-Header
Cf-Edge-Cache
X-Hacker
X-Vhost
X-Server-Powered-By
X-Rq
X-Dns-Prefetch-Control
X-Varnish-Cache
X-Dispatcher
X-Amz-Version-Id
Grace
Allow
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-OneAgent-JS-Injection
X-LiteSpeed-Cache
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-WebKit-CSP
X-Page-Speed
Cf-Apo-Via
X-Device
Cf-Railgun
Accept-CH
X-Aws-Lambda-Call-Status
X-Node
X-Pingback
X-Host
X-Ruxit-JS-Agent
X-Server-Id
EagleEye-TraceId
X-Nginx-Cache-Status
Surrogate-Control
X-Akam-SW-Version
X-Cache-Spec
X-Backend-Server
Request-Id
X-Readtime
X-Cache-Lookup
X-HW
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Trace
Accept-Ch-Lifetime
X-Application-Context
X-Response-Time
Fastly-Restarts
Permissions-Policy
X-Nginx-Upstream-Cache-Status
X-Mod-Pagespeed
X-Edge
X-WebKit-CSP-Report-Only
Accept-CH-Lifetime
X-Litespeed-Cache
X-Mcache
Content-Location
X-Content-Type
X-MS-InvokeApp
X-CST
X-Url
X-Country
X-Clacks-Overhead
Rating
X-PC
X-Amz-Server-Side-Encryption
X-TtlSet
X-Vname
X-Midtier
RTSS
Cache-Tag
X-ESI
X-Vcap-Request-Id
X-D2id
X-VARITI-CCR
Origin-Trial
X-Element-Page-Cache
Verso
X-Cdn-Fetch
X-Exp-Id
X-Use-Magma
X-Kinja
X-Kinja-Build
X-Kinja-Server
X-GoogleNews-Bot
X-Kinja-Revision
X-Exp-Variant
X-Server-Name
X-Rack-Cache
X-Ac
X-GitHub-Request-Id
X-Ttl
X-Powered-By-Plesk
X-Cnection
X-ECACHE
Service-Worker-Allowed
X-SharePointHealthScore
SPRequestGuid
X-Amz-Rid
X-Navigation-Version
Xkey
X-Client-IP
X-B3-TraceId
X-Abt-Application-Version
Edge-Control
X-Cache-TTL
X-NWS-LOG-UUID
SPIisLatency
SPRequestDuration
X-Upstream
Arr-Disable-Session-Affinity
X-Erf-Bev-Bev
X-Instrumentation
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Mg-S
X-Cached
X-Dw-Request-Base-Id
X-Px
X-Varnish-TTL
X-Correlation-Id
Pagespeed
Display
X-Middleton-Display
X-Sol
X-Cache-Key
X-FastCGI-Cache
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-NF-Request-ID
Access-Control-Request-Method
Edge-Cache-Tag
X-Forwarded-For
Content-MD5
X-Goog-Hash
X-Country-Code
X-Webkit-Csp
Front-End-Https
X-Powered-CMS
TCN
X-Id
X-Version
AR-PoweredBy
AR-SID
AR-Request-ID
AR-CACHE
AR-ATIME
Public-Key-Pins
X-RateLimit-Remaining
Accept-Ch
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
X-MSEdge-Ref
X-T
X-Recruiting
X-Content-Digest
X-Ratelimit-Limit
X-Ser
X-Daa-Tunnel
X-XRDS-Location
X-Amzn-Trace-Id
X-Middleton-Response
X-Accel-Expires
Response
TP-Cache
TP-L2-Cache
X-Shield-Request-Id
S
Nginx-Cache
MicrosoftSharePointTeamServices
MRF-Tech
Cache-Status
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Request-Received
X-Request-Processing-Time
X-HS-Content-Id
X-HS-Hub-Id
X-HS-Combine-CSS
X-HS-Cache-Config
Server-Node
Cache-Tags
X-Distributor
X-Hits
X-Fastcgi-Cache
X-Edge-Location-Klb
X-Kinsta-Cache
X-LB-Cache
Fastcgi-Cache
Cross-Origin-Opener-Policy
X-Ratelimit-Remaining
X-Ratelimit-Reset
Alternate-Protocol
X-PressLabs-Stats
X-Ezoic-Cdn
X-Origin-Server
X-Ua-Browser
X-Grace
X-TEC-API-ROOT
X-TEC-API-VERSION
Server-Name
X-TEC-API-ORIGIN
X-DIS-Request-ID
Filterid
X-Geo-Country
X-Microsite
X-Request-Handler-Origin-Region
X-Rid
X-Protected-By
X-Frontend
Healthy
X-LLID
X-Hostname
X-ORACLE-DMS-RID
X-Git-Hash
Payment
X-DataDome
X-Varnish-Backend
X-Logged-In
X-ORACLE-DMS-ECID
X-Debug-Info
X-FB-Debug
X-Fastly-Request-ID
X-Www-Served-By
X-Page-Id
Cleartype
X-Forwarded-Proto
X-Load-Cache
X-NGENIX-Cache
X-Origin-Cache
X-ASPNET-VERSION
X-Cluster-Name
DC
MS-Author-Via
X-ECache
Charset
Content-Disposition
Realpath
Access-Control-Allow-Method
X-B3-Sampled
X-Goog-Metageneration
X-GUploader-UploadID
X-Upgrade-Enabled
X-Kong-Proxy-Latency
X-Kong-Upstream-Latency
X-Proxy
X-F-Cache
X-Activity-Id
X-Az
X-AppVersion
X-Seen-By
Retry-After
X-Amz-Replication-Status
X-Server-ID
X-TTL
Cross-Origin-Resource-Policy
Paypal-Debug-Id
X-Amz-Meta-S3cmd-Attrs
X-Contextid
X-Revision
X-Aspnet-Duration-Ms
X-Request-Guid
X-Route-Name
X-Is-Crawler
X-Providence-Cookie
X-Flags
X-Type
X-Whom
Count-Hit
X-Azure-Ref
X-Fb-Rlafr
X-Signature
Viewport
Accept-Charset
X-Hosted-By
X-App-Environment
X-Aspnetmvc-Version
X-B-Cache
X-Wix-Request-Id
X-B
X-VCache
Surrogate-Key
X-TT
X-Varnish-Server
X-Akamai-Edgescape
X-Cache-Age
X-DynaTrace
X-B3-Traceid
Amp-Access-Control-Allow-Source-Origin
X-Language
X-Source
X-App-Server
X-Fastly-Request-Id
X-Cache-Control
X-Oracle-Dms-Ecid
X-Mobile
X-Oracle-Dms-Rid
Referer-Policy
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Goog-Generation
X-Magnolia-Registration
X-Times
X-Varnish-Grace
Host
X-Envoy-Decorator-Operation
Version
X-HTML-Minification-Powered-By
X-N
X-Tt-Trace-Host
X-Varnish-Ttl
X-Cache-Rule
X-Tt-Trace-Tag
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Original-Request-Id
X-Tumblr-User
X-Response-Served-From
X-Tumblr-Pixel
X-Rule
X-RTag
X-Cache-Time
WPO-Cache-Status
Access-Control-Request-Headers
WPO-Cache-Message
MS-CV
Ms-Operation-Id
X-UUID
X-Varnish-Age
X-Framework
Refresh
X-EdgeConnect-Cache-Status
Section-Io-Cache
X-Cache-Status-Check
SD-X-WS
GEO-INFO
X-FW-Serve
X-FW-Server
X-FW-Hash
X-FW-Dynamic
X-Backend-Name
X-Content-Powered-By
X-Cacheable-TTL
X-FW-Type
X-Page-View
X-ProcessESI
X-RemovedCookies
X-FW-Static
X-User-Agent
X-Cache-Grace
X-FW-Version
Protected
VIX-Pulpo-Node
X-Jobs
X-Rendered-As
Akamai-GRN
VIX-Pulpo-Upstream-Status
X-Cache-Expired-At
X-Drupal-Cache-Contexts
X-Drupal-Cache-Tags
X-G
X-Device-Type
X-Is-Bot
X-Instance
X-L-Path
X-Environment-Context
X-Adobe-Content
X-Status
From-Origin
X-Adobe-Loc
CDN-RequestId
SRV
X-Akamai-Request-ID2
NGB
X-Servername
X-Http-Reason
X-Trace-Id
Url
X-Template
X-NYM-Debug-Backend
X-Amz-Apigw-Id
X-Amzn-RequestId
X-RateLimit-Limit
X-Region
Front
X-COUNTRY
X-Nginx-Cache
X-Debug-IsConnected
X-Debug-IsPreview
X-CDN-Forward
X-XRDS-LOCATION
X-Unique-Id
X-Yottaa-Optimizations
X-Yottaa-Metrics
Accept-Language
X-Cache-Hit
X-Content-Options
Fastly-SWR
Backend
Fastly-SIE
Country
X-Zen-Fury
Liferay-Portal
X-Air-Trace-Id
X-Air-Hostname
X-Air-Source
X-Tb
X-DynaTrace-JS-Agent
Pinterest-Version
Pinterest-Generated-By
X-Pinterest-Rid
X-Newrelic-App-Data
X-Cache-Operation
Content-Secure-Policy
X-Real-IP
X-Node-Name
X-Rewrite-Enabled
Meta-Geo
X-Tumblr-Pixel-2
Webserver
X-Mode
Filters
X-Generation-Time
X-Amzn-Remapped-Content-Length
X-RN-RSRV
X-UPSTREAM-Address
X-Tt-Logid
Uber-Trace-Id
X-Proxy-Cache-Info
X-Cache-Server
X-Timing-Wait
CF-IPCountry
X-IPS-LoggedIn
Azure-SiteName
X-Proxy-Build
Selected-Fe
Azure-InstanceId
X-Content-Age
X-Rocket-Nginx-Serving-Static
X-Ms-Request-Id
X-Time
Azure-RegionName
Azure-SlotName
Azure-Version
X-Web-Node
Onion-Location
X-PHP-Backend
Cache-Hits
X-Ms-Version
X-SayCDN-TTL
X-Format
X-R9-Blue-Green-Version
X-Say-TTL
X-Say-Cacheable
X-Section
X-Sql-Duration-Ms
X-Access
X-Proto
X-Debug
X-Locale
X-Reqid
X-Sql-Count
X-Soup
X-Sucuri-ID
X-Sucuri-Cache
X-VC-Cache
X-UA-Device-Type
Cache-Name
X-Cluster-Node
Node
X-TIME
Webcakes-App-Version
Webcakes-Region
X-Adobe-Source
X-Cache-Host
X-Cache-Action
X-BYPASS-REASON
Webcakes-App-Name
TWC-Locale-Group
TWC-Connection-Speed
ServerID
ServedBy
TWC-Device-Class
TWC-GeoIP-Country
X-Cms-Context
TWC-GeoIP-LatLong
TWC-Privacy
X-IPLB-Instance
X-Via-Fastly
X-Ua
S-Rt
X-Site-Version
X-Varnish-Beresp-Grace
X-Skip-Cache
X-ProxyCache-Status
X-ProxyCache-Key
X-IPLB-Request-ID
Property-Id
X-Labrador-Cache-Channel
X-Origin-Hint
X-Proxy-Cache-Status
X-PHP-Host
X-Handled-By
X-Server-W
DB-Nickname
X-JoinUs
X-LAGOON
X-LJ-Flow-ID
Apigw-Requestid
X-FB-TRIP-ID
X-Cache-TTL-Remaining
X-Cluster
X-Detected-As
X-No-Session
X-SaId
X-Forwarded-Host
X-Origin-Date
X-Tumblr-Pixel-3
Cross-Origin-Window-Policy
X-WP-CF-Super-Cache-Cache-Control
X-AWS-Id
X-Ruxit-Js-Agent
X-WP-CF-Super-Cache
X-Uri
X-VWS-Id
Web-Mar-Node
X-Optimistic-Header
X-Buckets
X-Edge-Location
X-Urbn-Site-Id
X-GeoCode
X-Urbn-Context-Path
Countrycode
X-GeoCountry
Fastcgi-Useragent
Locale
WP-Super-Cache
Mime-Version
X-Tec-Api-Version
X-LSADC-Cache
X-Tec-Api-Root
X-Tec-Api-Origin
X-Proxied
X-Routing-Service
X-Extlb
X-Zipkin-Id
Mn-Server-Ip
X-ARC
Source
X-Xfnlog-Site
CDN-CachedAt
CDN-Cache
X-Oneagent-Js-Injection
CDN-Uid
CDN-RequestCountryCode
CDN-PullZone
X-App-Version
CDN-EdgeStorageId
X-Hl-Ver
X-Director
Cache-Tv-Group
Upgrade-Insecure-Requests
X-Varnish-Hits
X-Request-Time
X-Generated-By
X-Mg-Request-UUID
X-GEO
Fastly-Drupal-HTML
X-Cache-Debug
CF-Cached-On
X-Redis-Cache
X-SRV
Xet-Cookie
X-Loop
X-Tx-Id
Frame-Options
X-URL
X-Origin-TTL
X-FireWall-Port
X-Origin-CC
X-Varnish-Cache-Hits
X-TNCMS
X-Pass-Why
X-Varnish-Hostname
X-TA-CDN-Provider
X-RM-Cache-TTL
X-Akamai-Transformed
X-Alternate-Cache-Key
X-Storefront-Renderer-Rendered
X-ShardId
X-ServerID
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-ShopId
X-Shopify-Stage
X-Datadog-Trace-Id
X-Datadog-Sampled
X-Datadog-Sampling-Priority
X-Datadog-Parent-Id
X-Api-Version
X-Service
X-Newrelic-Synthetics
Load-Balancing
X-Served-From
X-Request-Host
X-Pubstack
X-Endurance-Cache-Level
X-Location
X-B3-Spanid
X-NWS-UUID-VERIFY
WWW-Authenticate
Thinkindot-CacheControl-Type
T-Server
Thinkindot-CacheControl
TDXMobile
Surrogated-Key
Thinkindot-Control
Memcached
DCR-Processing-Time-Ms
DSUID
Edge-Cache
Gannett-Cam-Experience-Id
DCR-Decision-By
Candidate-Md5Url
Server-Info
A
BehaviorPad-Version
Cache-Host
Host-ID
Lang
Redirect-Candidate
Release
Rendered-Blocks
Req-Svc-Chain
Origin
Odigeo-Trace-Id
MD5-Digest
X-A
Meta-Geo-Continent
Ngx.Var.Host
Sslversion
X-Conf
X-Loc
X-Level-Front-Cache
X-Mid
X-Mobile-URL
X-Nyt-Route
X-INCAP-ABP
X-Httpd
X-External-Request-Id
X-Epic-Correlation-Id
X-Test
X-Gdpr
X-Generated-On
X-ScT
X-S
X-Rojux
X-Sigma
X-TIM-N
X-Thinkindot-L3
X-Thanos
X-Rocket-Build-Number
X-Vdms-Path
X-Platform-Cluster
X-Origin-Time
X-Platform-Processor
X-Platform-Router
X-Processor
X-S-Cookie
X-Ec-GeoHdr
X-BCube-Filmed-By
X-Bc-Bl
X-Bip
X-Cache-Date
X-Cache-Info
X-BBC-Edge-Cache-Status
X-B-Cookie
X-A-Dgt
X-A-Dcw
X-A-Wwc
X-Aed
X-Application
X-Cache-NE
X-CMSURLCustom
X-Sigma-Backend
X-Developer
X-S-Maxage
X-Vdms-Version
X-Ec-Fail
X-SRCache-Key
X-Destination
Xc-Version
X-We-Are-Hiring
X-CUA
X-D
X-A-Dam
X-A-Ccd
Xserver
X-Restarts
X-Storage
X-Frame-Option
X-Fetched-On
X-Ec-Custom-Error
X-Geo-Header
X-GeoIP
X-Human
X-Is-Gdpr
X-HS-Content-Campaign-Id
X-Has-Esi
X-GeoIP-City
X-Core-Value
X-Clara-WADP
NM-Fastcgi-Cache
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
Mail-Subject
Magicmarker
Section-Io-Origin-Status
Section-Io-Id
X-Cache-Bucket
X-Akamai-Device-Characteristics
We-Hiring
Server-Host
X-JWT-State
X-Mvc-Supplant-Cachable
X-WP-CF-Super-Cache-Active
Country-Code
X-Worker
X-WADP-Cache
X-WA-Info
X-Cdn-Origin
X-Core-Mission
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Sn-Servicetimems
X-Hash
X-VServer
X-Vmg-Version
X-Origin
X-Origin-Response-Time
X-Org
X-Node-Id
Gh-Request-Id
X-Pool
X-SD-PageType
X-VG-TLSProxy
X-Varnishpool
X-Varnish-Beresp-Status
X-Var-Ttl
X-Mly-Id
X-Fmm-Version
Fastly-GeoIP-CountryCode
CacheControlHeader
Fastly-Backend-Name
AKAMAI
CloudFront-Viewer-Country
Cache-Key
X-Varnish-Beresp-Ttl
X-CACHE-AGE
X-Parent-Response-Time
X-CacheTTL
X-CSRF-Token
X-Block-Status
State
X-Cache-Tags
Apple-News-Services-Parsed-Url
Apple-News-Services-Handled
X-Cache-Id
X-Date
Apple-News-Services-Host
X-Accel-Expires-Debug
X-SB
X-Region-Sid
X-Accel-Buffering
X-Server-IP
X-Slack-Backend
X-Slack-Shared-Secret-Outcome
X-Ad-Defer-Variation
X-Gamma-Serve
X-Wix-Viewer-Type
X-Auto-Login
X-App
X-Dispatcher-Number
X-Fastly-Cache
X-Azure-Ref-OriginShield
X-Old-Content-Length
X-GeoIP-Region-Code
X-Gzip
X-GeoIP-Country-Code
X-Varnish-Remaining-TTL
Click-Count-Action-Start
X-Gen-Mode
X-Varnish-CookieINHashed-On
X-Hnp-Log
X-Irp-Debug
Adler-Geo
X-Variation
X-Varnish-CookieHashed-On
Canary
X-Forwarded-Site
C-Via
X-NodeID
X-DefElseHash
Web-Mar-Region
Apple-News-Services-Request-Url
Datacenter
X-DefHash
X-Developers
X-FC-Vary-Parameters
Click-Count-Error
X-Esi-Check
X-Dispatcher-Server
X-Device-Os
X-Cdn-Srv
X-Fastly-Backend
Sever-Int
X-Req
Server-Ext
Kp-EeAlive
X-Platform
X-Platform-Server
NGX
X-Men
Ssr
Platform
Machine
X-Request-Start
Tube-Get-Contents
Environment
Server-Hostname
Vix-Hermes-Req-Id
X-Qloud-Router
Is-Eu
Tube-Got-Eval
Tube-Got-Results
Tube-Return
User-Cache-Control
X-Nginx-Cache-Key
X-DPWN-IS-SECURE
Origin-EX
Cluster
X-Op-Id-All
Decoy-Debug-Status
X-Scale
Origin-CC
On-Server
X-VarnishDD-TTL
X-Minions-Version
Cache-Provider
X-LB-NoCache
X-V-Cache
X-HN
L
X-Nananana
X-Tid
Fastly-SSL
CDCHOST
X-NCache
PFcat
Cmstype
Cmsid
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
Wxu-Next-Region
Decoy-Debug-TTL
Wxu-Next-Hostname
Wxu-Next-Commit
X-Cache-Backend
X-Planisys-CDN-Cache
X-Cache-Remote
X-Origin-Expires
Decoy-Debug-Key
X-Ckpd-Fst-Backend
X-Owner
Producers
X-Webkit-CSP-Report-Only
X-Response-By
Pics-Label
X-Cache-FS-Status
L5d-Success-Class
X-Microcachable
HA-Ipaddr
X-Tb-Optimization-Total-Bytes-Saved
Ha-Gx-Prefs
X-Eu-Site
X-Instance-Name
X-Refresh
X-Release
X-Mvc-Supplant-OutputCached
X-CGP
X-Csrf-Jwt
X-Provided-By
X-Zone
X-Air-Pt
Expect-Staple
X-Aicache-OS
HostName
Env
X-DC
X-Via-CDN
X-Up
GeoIP-Latitude
Srvid
X-ND-Cache
X-FL-EDGE
X-FL-QIT-DEBUG
Memory
Locid
X-From
Time
X-Dc
X-Presslabs-Stats
X-Trace-ID
X-Via-SSL
Edge-Copy-Time
X-VC
X-Via-Edge
X-NewRelic-App-Data
X-Cache-Enabled
Svr
X-Generated-In
X-RCS-CacheZone
X-Vcl-Version
X-Servedbyhost
NtCoent-Length
SID
Sid
X-Cached-By
X-Edge-Pop
Cache
X-Webkit-CSP
X-Debug-Cache-Fetch
X-Via-Poph
X-HS-Status
X-Via-Popn
X-Via-Popv
X-DataCenter
X-Debug-Cache-Store
X-Nc
X-AIR-PT
Fastly-Drupal-Html
X-Esi
X-Wa
X-Cs
X-Srv
X-Vgn-Hpd-Variations-Key
X-Vc
X-Lambda-Id
X-Vgn-Hpd-Ssi
X-Vgn-Hpd-Cached
AMP-Access-Control-Allow-Source-Origin
X-Correlation-ID
X-ZONE
Cdn
GeoIp-Country-Code
VNS-Cache
X-Client-Ip
X-CCDN-CacheTTL
X-CCDN-Origin-Time
X-HA-Backend
X-Hcs-Proxy-Type
CPC-Age
X-Render-Time
CPC-Cache
VNS-Age
X-Vtex-Remote-Cache
X-Check-Cacheable
X-NGINX-Cache
X-VCT
Server-ID
Hostname
X-LB-ID
Cdnsip
Cdncip
X-AK-Request-ID
X-Gateway-Cache-Key
True-Client-IP
X-TH-Server
X-Gateway-Skip-Cache
X-Gateway-Request-Id
X-Gateway-Cache-Status
X-Via-NSCOPI
X-Amz-Meta-Cb-Modifiedtime
X-Proxy-CacheRZ
X-Via-JSL
XkeyRZ
X-Upstream-Ct
X-Upstream-Ht
X-ATG-Version
X-Fpc
X-API-Version
X-CSRF-TOKEN
X-B3-SpanId
X-Cache-Type
X-Varnish-Beresp-TTL
X-Cache-ASPX
X-Varnish-Authentication
Srv
Uri
X-Nf-Request-Id
X-Contensis-Viewer-Groups
XServer
X-EC-Lua
X-CS
Eomportal-Instance
M-TraceId
Esi-Enabled
True-Client-Ip
X-MSEdge-Features
X-PAYTM-SRV-ID
X-FPC
Resin-Trace
X-RateLimit-Remaining-Second
Ngx-Var-Key
OT-Force-Account-Verify
X-RateLimit-Limit-Second
X-CF-Lambda-Fn
X-Micro-Cache
X-CF-Lambda-Version
X-MSEdge-Flight
X-Datadome
X-Udemy-Cache-App-Namespace
X-APP-VERSION
CDN
Path
Request-ID
X-MP-GENERATED-AT
YJS-ID
X-CDN-Cache-Status
X-Cache-NGX
X-SIPLIST1
X-Wikidot-Backend
X-Request-URI
X-Wikidot-Static-Cache
X-Fastly-Country-Code
N-Cache
IsBot
X-CACHE-KEY
RNT-Machine
X-Orig-Expires
X-Forwarded-Path
X-Lb-Id
X-Info
RNT-Time
X-VCL-Version
X-TX-ID
X-CLOUD-TRACE-CONTEXT
X-Tenant
Server-Id
X-Shop-Environment
X-Bl-Debug
GeoIP-Country-Code
X-Accel-Version
Lb
Sm-Log-Id
X-Service-Response-Time
X-B3-Trace-ID
X-App-Name
X-Policy
X-Ha-Backend
Location
X-WA
X-Pod-Name
X-MCACHE
X-RateLimit-Reset
X-Edge-POP
Cross-Origin-Opener-Policy-Report-Only
LB
X-Datacenter
X-Akamai-Pragma-Client-IP
Hit
HIT
X-Cdn-Cache-Status
X-Oss-Hash-Crc64ecma
X-Oss-Object-Type
X-Via-PopV
X-Oss-Request-Id
X-Oss-Server-Time
X-Via-PopH
X-Oss-Storage-Class
X-NC
Ohc-File-Size
Servername
X-Via-PopN
X-Cache-Expires
X-SERVER-NAME
X-Cdn-Request-ID
X-Geo
X-Cdn-Forward
X-Srcache-Store-Status
X-Snapshot-Date
X-ServedByHost
X-Cache-Ttl
X-Srcache-Fetch-Status
Timeexpire
FSS-Cache
Req-ID
Proxy-Connection
Yjs-Id
X-Cdn-Diag
Pramga
X-Ctl-Mach
Epwk-X-Cache
X-Logging-Id
ENV
X-Rebelmouse-Cache-Control
X-Rebelmouse-Surrogate-Control
X-Moov-Xdn-Version
X-Serial
X-Moov-T
X-Lb-Nocache
X-Git-Commit
X-Hyper-Cache
X-Amz-Meta-Opti
X-Container-Uri
Traceparent
Geoip-Latitude
X-LiteSpeed-Cache-Control
X-Vcache
X-UP
X-Fastly-Backend-Reqs
X-TraceId
X-Scheme
WZWS-RAY
X-Dw-Trace-Id
Warning
X-M-Reqid
X-MiniProfiler-Ids
X-M-Log
Ec-Rule-Version
X-VG-WebCache
Cneonction
X-Tncms
X-Viewer-Country
Content-Script-Type
X-B3-Parentspanid
X-Acquia-Purge-Tags
X-RAMCache
X-Acquia-Site
X-Acquia-Application-UUID
X-PERF
X-Qnm-Cache
X-ApacheServer
X-Acquia-Application-Trace
X-Swift-Error
Content-Style-Type
X-TT-LOGID
X-Wp-Cf-Super-Cache-Cache-Control
X-F-Status
X-Lsadc-Cache
CountryCode
X-Wp-Cf-Super-Cache
X-Mid-Debug-Cache-Key
X-Request-URL
X-Mg-Cache
XM
X-Litespeed-Cache-Control
V-Age
X-Iauth-Set-Uid
X-Acquia-Purge-Cdn-Unconfigured
MIME-Version
True-Client-Country-4JS
Ohc-Cache-HIT
X-LiteSpeed-Tag
Ngx
X-Th-Server
X-B3-ParentSpanId
Inserted-Into-Cache-At
X-Fastly-Cache-Hits
X-Cache-Ngx
X-Mid-Debug-Cache-Disk
X-Webstats-RespID
X-IPS-Cached-Response
My-App