Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Content-Length
Strict-Transport-Security
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Accept-Ranges
Expect-CT
X-XSS-Protection
Pragma
X-Powered-By
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Access-Control-Allow-Origin
Referrer-Policy
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
X-Cache-Hits
P3P
X-UA-Compatible
X-Xss-Protection
X-Served-By
X-Download-Options
CF-Ray
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-FRAME-OPTIONS
X-Request-Id
X-Request-ID
X-Permitted-Cross-Domain-Policies
X-AspNet-Version
Alt-Svc
X-Runtime
Content-Security-Policy-Report-Only
X-Drupal-Cache
X-DNS-Prefetch-Control
X-Check
X-Generator
X-Cache-Status
X-Cacheable
Timing-Allow-Origin
X-Iinfo
X-Envoy-Upstream-Service-Time
X-Content-Security-Policy
X-Drupal-Dynamic-Cache
Feature-Policy
Content-Encoding
Access-Control-Expose-Headers
Upgrade
Status
X-CDN
X-AspNetMvc-Version
P3p
Access-Control-Max-Age
X-Via
Server-Timing
X-UA-Device
Request-Context
X-Robots-Tag
X-Turbo-Charged-By
X-Cache-Group
X-Amz-Request-Id
EagleId
X-Amz-Id-2
X-Backend
X-AH-Environment
X-Proxy-Cache
Keep-Alive
X-Ua-Compatible
X-Server
X-Ws-Request-Id
X-Age
Host-Header
Cf-Edge-Cache
X-Hacker
X-Vhost
X-Server-Powered-By
X-Rq
X-Dns-Prefetch-Control
X-Varnish-Cache
X-Dispatcher
X-Amz-Version-Id
Grace
Allow
X-Swift-CacheTime
X-Swift-SaveTime
Ali-Swift-Global-Savetime
X-OneAgent-JS-Injection
X-LiteSpeed-Cache
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
X-WebKit-CSP
X-Page-Speed
Cf-Apo-Via
X-Device
Cf-Railgun
Accept-CH
X-Aws-Lambda-Call-Status
X-Node
X-Pingback
X-Host
X-Ruxit-JS-Agent
X-Server-Id
EagleEye-TraceId
X-Nginx-Cache-Status
Surrogate-Control
X-Akam-SW-Version
X-Cache-Spec
X-Backend-Server
Request-Id
X-Readtime
X-Cache-Lookup
X-HW
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Trace
Accept-Ch-Lifetime
X-Application-Context
X-Response-Time
Fastly-Restarts
Permissions-Policy
X-Nginx-Upstream-Cache-Status
X-Mod-Pagespeed
X-Edge
X-WebKit-CSP-Report-Only
Accept-CH-Lifetime
X-Litespeed-Cache
X-Mcache
Content-Location
X-Content-Type
X-MS-InvokeApp
X-Url
X-CST
X-Country
X-Clacks-Overhead
Rating
X-PC
X-Amz-Server-Side-Encryption
X-Vname
X-TtlSet
X-Midtier
RTSS
Cache-Tag
X-ESI
X-Vcap-Request-Id
X-D2id
X-VARITI-CCR
Origin-Trial
X-Element-Page-Cache
Verso
X-Cdn-Fetch
X-Server-Name
X-Exp-Id
X-Kinja-Build
X-Kinja-Revision
X-Use-Magma
X-Kinja
X-Kinja-Server
X-GoogleNews-Bot
X-Exp-Variant
X-Rack-Cache
X-Ac
X-Ttl
X-GitHub-Request-Id
X-Powered-By-Plesk
X-Cnection
X-ECACHE
Service-Worker-Allowed
X-SharePointHealthScore
SPRequestGuid
X-Amz-Rid
Xkey
X-Navigation-Version
X-Client-IP
X-B3-TraceId
X-Abt-Application-Version
Edge-Control
X-Cache-TTL
SPIisLatency
SPRequestDuration
X-NWS-LOG-UUID
X-Upstream
Arr-Disable-Session-Affinity
X-Instrumentation
X-Erf-Bev-Bev
X-Server-Lifecycle-Phase
X-Kraken-Loop-Name
X-Erf-Bev-Bev-Is-Generated
X-Browser-Type
X-Mg-S
X-Cached
X-Dw-Request-Base-Id
X-Px
X-Varnish-TTL
X-Correlation-Id
Pagespeed
Display
X-Middleton-Display
X-Sol
X-Cache-Key
X-FastCGI-Cache
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-NF-Request-ID
Access-Control-Request-Method
Edge-Cache-Tag
X-Forwarded-For
Content-MD5
X-Goog-Hash
X-Country-Code
X-Webkit-Csp
Front-End-Https
X-Powered-CMS
TCN
X-Id
X-Version
AR-PoweredBy
AR-SID
AR-Request-ID
AR-CACHE
AR-ATIME
Public-Key-Pins
X-RateLimit-Remaining
Accept-Ch
X-HP-Webp
X-Jurisdiction
X-HP-Trace-Id
X-MSEdge-Ref
X-T
X-Recruiting
X-Content-Digest
X-Ratelimit-Limit
X-Ser
X-XRDS-Location
X-Daa-Tunnel
X-Amzn-Trace-Id
X-Middleton-Response
Response
X-Accel-Expires
TP-L2-Cache
TP-Cache
X-Shield-Request-Id
S
MicrosoftSharePointTeamServices
Nginx-Cache
Cache-Status
MRF-Tech
Mrf-Cache-Status
X-B3-TraceId-Primal
X-Request-Received
X-Request-Processing-Time
X-HS-Hub-Id
X-HS-Combine-CSS
X-HS-Cache-Config
X-HS-Content-Id
Server-Node
Cache-Tags
X-Distributor
X-Hits
X-Fastcgi-Cache
X-Edge-Location-Klb
X-Kinsta-Cache
X-LB-Cache
X-Ratelimit-Remaining
Cross-Origin-Opener-Policy
Fastcgi-Cache
X-Ratelimit-Reset
X-Origin-Server
X-PressLabs-Stats
X-Ezoic-Cdn
Alternate-Protocol
X-Grace
X-Ua-Browser
X-TEC-API-ORIGIN
X-TEC-API-ROOT
Server-Name
X-TEC-API-VERSION
X-DIS-Request-ID
Filterid
X-Geo-Country
X-Request-Handler-Origin-Region
X-Microsite
X-Rid
X-Protected-By
Healthy
X-LLID
X-Frontend
X-Hostname
X-ORACLE-DMS-RID
X-Git-Hash
Payment
X-Varnish-Backend
X-DataDome
X-ORACLE-DMS-ECID
X-Logged-In
X-Debug-Info
X-Fastly-Request-ID
X-FB-Debug
X-Page-Id
Cleartype
X-Www-Served-By
X-Forwarded-Proto
X-Load-Cache
X-NGENIX-Cache
X-Cluster-Name
X-ASPNET-VERSION
X-Origin-Cache
DC
MS-Author-Via
X-ECache
Charset
Content-Disposition
Realpath
X-B3-Sampled
Access-Control-Allow-Method
X-Goog-Metageneration
X-GUploader-UploadID
X-Upgrade-Enabled
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
X-Proxy
X-F-Cache
X-Activity-Id
X-AppVersion
X-Az
X-Seen-By
X-Amz-Replication-Status
Retry-After
X-Server-ID
Paypal-Debug-Id
Cross-Origin-Resource-Policy
X-TTL
X-Contextid
X-Amz-Meta-S3cmd-Attrs
X-Flags
X-Aspnet-Duration-Ms
X-Request-Guid
X-Fb-Rlafr
X-Whom
X-Azure-Ref
X-Type
X-Revision
X-Route-Name
X-Providence-Cookie
X-Is-Crawler
Count-Hit
X-Aspnetmvc-Version
X-App-Environment
Accept-Charset
Surrogate-Key
Viewport
X-B-Cache
X-Signature
X-Hosted-By
X-B
X-VCache
X-Wix-Request-Id
X-TT
X-Varnish-Server
X-Akamai-Edgescape
X-Cache-Age
X-DynaTrace
X-B3-Traceid
Amp-Access-Control-Allow-Source-Origin
X-Language
X-Source
X-App-Server
X-Fastly-Request-Id
X-Cache-Control
X-Mobile
X-Oracle-Dms-Ecid
X-Oracle-Dms-Rid
Referer-Policy
X-Goog-Generation
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Storage-Class
X-Magnolia-Registration
X-Times
X-Varnish-Grace
Host
Version
X-Envoy-Decorator-Operation
X-HTML-Minification-Powered-By
X-N
X-Cache-Rule
X-Tt-Trace-Tag
X-Varnish-Ttl
X-Tt-Trace-Host
X-Original-Request-Id
X-Tumblr-Pixel-1
X-Tumblr-Pixel-0
X-Tumblr-Pixel
X-Tumblr-User
X-Response-Served-From
X-Rule
X-RTag
WPO-Cache-Status
Access-Control-Request-Headers
MS-CV
Ms-Operation-Id
X-Varnish-Age
X-UUID
X-Cache-Time
WPO-Cache-Message
X-Cache-Status-Check
X-EdgeConnect-Cache-Status
Refresh
X-Framework
Section-Io-Cache
SD-X-WS
X-Backend-Name
X-FW-Hash
X-User-Agent
X-Cacheable-TTL
X-FW-Dynamic
X-Cache-Grace
X-Content-Powered-By
X-FW-Version
X-FW-Server
X-ProcessESI
X-FW-Type
GEO-INFO
X-Page-View
X-RemovedCookies
X-FW-Static
X-FW-Serve
X-Drupal-Cache-Tags
X-Is-Bot
VIX-Pulpo-Upstream-Status
X-Rendered-As
VIX-Pulpo-Node
Protected
X-Instance
X-Cache-Expired-At
X-G
X-Jobs
Akamai-GRN
X-Device-Type
X-Drupal-Cache-Contexts
X-Adobe-Content
X-Adobe-Loc
X-L-Path
CDN-RequestId
X-Environment-Context
X-Status
From-Origin
X-Akamai-Request-ID2
NGB
Url
X-Servername
X-Template
X-Http-Reason
SRV
X-NYM-Debug-Backend
X-Trace-Id
X-Amz-Apigw-Id
X-RateLimit-Limit
X-Amzn-RequestId
X-Region
X-COUNTRY
Front
X-Nginx-Cache
X-CDN-Forward
X-Debug-IsPreview
X-Debug-IsConnected
X-XRDS-LOCATION
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Unique-Id
Accept-Language
X-Cache-Hit
Backend
X-Content-Options
Fastly-SWR
Fastly-SIE
Country
X-Zen-Fury
X-Air-Trace-Id
X-Air-Hostname
X-Air-Source
Liferay-Portal
X-Tb
X-DynaTrace-JS-Agent
Pinterest-Generated-By
X-Mode
X-Pinterest-Rid
Pinterest-Version
Content-Secure-Policy
X-Cache-Operation
X-Newrelic-App-Data
X-Real-IP
X-Node-Name
Meta-Geo
Webserver
Filters
X-Cache-Server
Uber-Trace-Id
X-RN-RSRV
X-Tumblr-Pixel-2
X-UPSTREAM-Address
X-Proxy-Cache-Info
X-Generation-Time
X-Rewrite-Enabled
X-Amzn-Remapped-Content-Length
X-Tt-Logid
X-IPS-LoggedIn
Cache-Hits
X-Timing-Wait
CF-IPCountry
Azure-Version
X-PHP-Backend
X-Web-Node
Azure-InstanceId
X-Content-Age
Azure-RegionName
Azure-SiteName
Onion-Location
Azure-SlotName
X-Proxy-Build
Selected-Fe
X-Ms-Version
X-Ms-Request-Id
X-Rocket-Nginx-Serving-Static
X-Time
X-R9-Blue-Green-Version
X-Format
X-Reqid
X-Locale
X-Proto
X-Section
X-Access
X-Server-W
X-Sql-Count
X-SayCDN-TTL
X-Debug
X-Say-Cacheable
X-UA-Device-Type
Cache-Name
X-Sql-Duration-Ms
X-VC-Cache
X-Sucuri-Cache
X-Sucuri-ID
X-Say-TTL
X-Soup
X-Cluster-Node
Node
X-TIME
X-Adobe-Source
Webcakes-Region
X-AWS-Id
X-BYPASS-REASON
X-Cache-Host
X-Cache-Action
Webcakes-App-Version
Webcakes-App-Name
TWC-Connection-Speed
ServerID
ServedBy
TWC-Device-Class
TWC-GeoIP-Country
TWC-Privacy
TWC-Locale-Group
TWC-GeoIP-LatLong
X-Cms-Context
X-IPLB-Instance
X-VWS-Id
X-Via-Fastly
X-Ua
S-Rt
X-Site-Version
X-Varnish-Beresp-Grace
X-Skip-Cache
X-ProxyCache-Status
X-ProxyCache-Key
X-IPLB-Request-ID
Property-Id
X-Labrador-Cache-Channel
X-Origin-Hint
X-Proxy-Cache-Status
X-PHP-Host
X-Handled-By
X-LJ-Flow-ID
DB-Nickname
X-LAGOON
X-Cache-TTL-Remaining
X-Cluster
Web-Mar-Node
X-Zipkin-Id
X-Routing-Service
Apigw-Requestid
X-Forwarded-Host
X-JoinUs
X-Proxied
X-Extlb
X-Origin-Date
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-Tumblr-Pixel-3
X-Ruxit-Js-Agent
X-FB-TRIP-ID
X-No-Session
X-Detected-As
X-SaId
X-Uri
Cross-Origin-Window-Policy
Mn-Server-Ip
X-Edge-Location
X-Buckets
X-Optimistic-Header
Locale
Mime-Version
X-Urbn-Site-Id
X-GeoCode
Fastcgi-Useragent
X-Urbn-Context-Path
X-GeoCountry
WP-Super-Cache
Countrycode
X-Tec-Api-Origin
X-Tec-Api-Version
X-Tec-Api-Root
X-LSADC-Cache
X-ARC
X-Xfnlog-Site
Source
CDN-RequestCountryCode
CDN-Uid
CDN-EdgeStorageId
CDN-PullZone
CDN-CachedAt
X-App-Version
X-Oneagent-Js-Injection
CDN-Cache
Cache-Tv-Group
X-Hl-Ver
X-Director
Upgrade-Insecure-Requests
X-Varnish-Hits
X-Request-Time
X-Generated-By
X-Mg-Request-UUID
X-GEO
Fastly-Drupal-HTML
X-Cache-Debug
CF-Cached-On
X-Redis-Cache
X-SRV
Xet-Cookie
X-Loop
X-Tx-Id
Frame-Options
X-URL
X-Origin-TTL
X-FireWall-Port
X-Origin-CC
X-Varnish-Cache-Hits
X-Pass-Why
X-TNCMS
X-Varnish-Hostname
X-RM-Cache-TTL
X-TA-CDN-Provider
X-ShardId
X-Storefront-Renderer-Rendered
X-Shopify-Stage
X-Sorting-Hat-PodId
X-Akamai-Transformed
X-ServerID
X-Sorting-Hat-ShopId
X-ShopId
X-Alternate-Cache-Key
X-Datadog-Parent-Id
X-Datadog-Trace-Id
X-Datadog-Sampling-Priority
X-Datadog-Sampled
X-Api-Version
X-Newrelic-Synthetics
X-Service
Load-Balancing
X-Served-From
X-Endurance-Cache-Level
X-Pubstack
X-Request-Host
X-B3-Spanid
X-NWS-UUID-VERIFY
X-Location
T-Server
TDXMobile
Memcached
DCR-Decision-By
A
Meta-Geo-Continent
Redirect-Candidate
Thinkindot-Control
WWW-Authenticate
Thinkindot-CacheControl-Type
Thinkindot-CacheControl
Origin
Host-ID
Gannett-Cam-Experience-Id
BehaviorPad-Version
Sslversion
Cache-Host
Lang
Candidate-Md5Url
Rendered-Blocks
Req-Svc-Chain
MD5-Digest
DCR-Processing-Time-Ms
Odigeo-Trace-Id
Edge-Cache
X-A
Surrogated-Key
Server-Info
Ngx.Var.Host
Release
DSUID
X-Mid
X-Processor
X-Platform-Router
X-Rocket-Build-Number
X-Rojux
X-S
X-Platform-Processor
X-Platform-Cluster
X-Loc
X-Level-Front-Cache
X-Mobile-URL
X-Nyt-Route
X-Origin-Time
X-S-Cookie
X-S-Maxage
X-Vdms-Path
X-TIM-N
X-Vdms-Version
X-We-Are-Hiring
Xc-Version
X-Thinkindot-L3
X-Thanos
X-Sigma
X-ScT
X-Sigma-Backend
X-SRCache-Key
X-Test
X-INCAP-ABP
X-Httpd
X-BCube-Filmed-By
X-Bc-Bl
X-Bip
X-Cache-Date
X-Cache-Info
X-BBC-Edge-Cache-Status
X-B-Cookie
X-A-Dgt
X-A-Dcw
X-A-Wwc
X-Aed
X-Application
X-Cache-NE
X-CMSURLCustom
X-Epic-Correlation-Id
X-Ec-GeoHdr
X-External-Request-Id
X-Gdpr
X-Generated-On
X-Ec-Fail
X-Developer
X-Conf
X-CUA
X-D
X-Destination
X-A-Dam
X-A-Ccd
Xserver
X-Storage
X-Restarts
X-Frame-Option
X-Fetched-On
X-Ec-Custom-Error
X-Geo-Header
X-GeoIP
X-Human
X-Is-Gdpr
X-HS-Content-Campaign-Id
X-Has-Esi
X-GeoIP-City
X-Core-Value
X-Cache-Bucket
NM-Fastcgi-Cache
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
Mail-Subject
Magicmarker
Section-Io-Origin-Status
Section-Io-Id
X-Auto-Login
X-JWT-State
X-Akamai-Device-Characteristics
We-Hiring
Server-Host
X-Clara-WADP
X-Mvc-Supplant-Cachable
X-WP-CF-Super-Cache-Active
Country-Code
X-Worker
X-WADP-Cache
X-WA-Info
X-Cdn-Origin
X-Core-Mission
X-SVT-ORM-VERSION
X-SVT-ORM-RULES
X-Sn-Servicetimems
X-Hash
X-VServer
X-Vmg-Version
X-Origin
X-Origin-Response-Time
X-Org
X-Node-Id
Gh-Request-Id
X-Pool
X-SD-PageType
X-VG-TLSProxy
X-Varnishpool
X-Varnish-Beresp-Status
X-Var-Ttl
X-Mly-Id
X-Fmm-Version
Cache-Key
Fastly-Backend-Name
Fastly-GeoIP-CountryCode
CacheControlHeader
CloudFront-Viewer-Country
C-Via
AKAMAI
X-Parent-Response-Time
X-CACHE-AGE
X-Varnish-Beresp-Ttl
X-Nginx-Cache-Key
X-Men
X-Azure-Ref-OriginShield
X-Server-IP
X-Region-Sid
X-App
X-Accel-Buffering
Tube-Return
User-Cache-Control
Tube-Got-Results
Tube-Got-Eval
Tube-Get-Contents
Vix-Hermes-Req-Id
Apple-News-Services-Parsed-Url
X-CSRF-Token
X-NodeID
X-Old-Content-Length
Apple-News-Services-Request-Url
X-Ad-Defer-Variation
X-Cache-Id
Click-Count-Action-Start
X-Developers
X-DefHash
X-DefElseHash
X-Gen-Mode
X-Device-Os
X-Dispatcher-Server
X-Esi-Check
X-FC-Vary-Parameters
Click-Count-Error
X-Forwarded-Site
X-GeoIP-Country-Code
X-GeoIP-Region-Code
X-Irp-Debug
Apple-News-Services-Host
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Cache-Tags
Canary
X-Gzip
Datacenter
X-Hnp-Log
X-Cdn-Srv
X-Block-Status
Web-Mar-Region
X-Varnish-CookieINHashed-On
X-Scale
Platform
X-Varnish-CookieHashed-On
X-SB
X-Gamma-Serve
Server-Ext
X-Varnish-Remaining-TTL
Machine
X-Fastly-Cache
X-Dispatcher-Number
On-Server
NGX
Environment
Adler-Geo
X-Fastly-Backend
X-Variation
Origin-EX
Origin-CC
X-Req
X-Request-Start
X-Accel-Expires-Debug
Is-Eu
Ssr
Server-Hostname
Apple-News-Services-Handled
X-Platform-Server
X-Wix-Viewer-Type
State
X-Platform
Kp-EeAlive
X-CacheTTL
Sever-Int
X-Date
X-Qloud-Router
Fastly-SSL
X-VarnishDD-TTL
X-V-Cache
Cmsid
X-Tid
X-HN
L
X-Ckpd-Fst-Backend
Cluster
CDCHOST
X-DPWN-IS-SECURE
X-Cache-Backend
Wxu-Next-Region
Wxu-Next-Hostname
Decoy-Debug-Status
X-Op-Id-All
X-Origin-Expires
Wxu-Next-Commit
Cmstype
X-Planisys-CDN-Cache
X-Planisys-CDN-Rules
X-Planisys-CDN-TTL
Decoy-Debug-TTL
X-Cache-Remote
Decoy-Debug-Key
X-Minions-Version
PFcat
X-Owner
X-LB-NoCache
Producers
X-Nananana
Cache-Provider
X-NCache
X-Webkit-CSP-Report-Only
X-Microcachable
X-Mvc-Supplant-OutputCached
X-Refresh
X-Tb-Optimization-Total-Bytes-Saved
X-Eu-Site
X-Response-By
HA-Ipaddr
X-Release
X-Csrf-Jwt
L5d-Success-Class
X-CGP
Ha-Gx-Prefs
Pics-Label
X-Instance-Name
X-Cache-FS-Status
X-Provided-By
X-Air-Pt
X-Zone
X-Aicache-OS
Expect-Staple
HostName
Env
X-DC
X-Via-CDN
X-ND-Cache
X-FL-EDGE
Srvid
GeoIP-Latitude
X-FL-QIT-DEBUG
Memory
Locid
X-Up
Time
X-Dc
X-From
Edge-Copy-Time
X-Presslabs-Stats
X-VC
X-Trace-ID
X-Via-SSL
X-Via-Edge
X-NewRelic-App-Data
X-Servedbyhost
Svr
X-RCS-CacheZone
X-Generated-In
X-Vcl-Version
X-Cache-Enabled
NtCoent-Length
X-Cached-By
SID
X-Edge-Pop
Sid
Cache
X-Webkit-CSP
X-HS-Status
X-Lambda-Id
X-Nc
X-Via-Popv
X-Via-Popn
X-DataCenter
X-Debug-Cache-Store
X-Debug-Cache-Fetch
X-Via-Poph
X-AIR-PT
X-Vgn-Hpd-Ssi
X-Vgn-Hpd-Cached
X-Esi
X-Vgn-Hpd-Variations-Key
X-Cs
X-Vc
X-Wa
Fastly-Drupal-Html
X-Srv
X-HA-Backend
X-Correlation-ID
X-ZONE
AMP-Access-Control-Allow-Source-Origin
Cdn
X-CCDN-Origin-Time
GeoIp-Country-Code
X-Hcs-Proxy-Type
X-Render-Time
X-CCDN-CacheTTL
VNS-Age
X-Vtex-Remote-Cache
VNS-Cache
X-Client-Ip
CPC-Cache
CPC-Age
X-Check-Cacheable
X-NGINX-Cache
X-VCT
X-LB-ID
X-AK-Request-ID
Hostname
Cdnsip
Cdncip
Server-ID
X-Gateway-Cache-Status
X-Via-NSCOPI
True-Client-IP
X-Gateway-Cache-Key
X-TH-Server
X-Amz-Meta-Cb-Modifiedtime
X-Gateway-Skip-Cache
X-Gateway-Request-Id
X-Upstream-Ht
X-Proxy-CacheRZ
X-Via-JSL
X-Upstream-Ct
XkeyRZ
X-API-Version
X-ATG-Version
X-Fpc
X-B3-SpanId
X-Cache-Type
X-CSRF-TOKEN
X-Contensis-Viewer-Groups
X-Varnish-Authentication
X-Cache-ASPX
Srv
Uri
X-Nf-Request-Id
X-Varnish-Beresp-TTL
X-EC-Lua
XServer
X-CS
Esi-Enabled
M-TraceId
Eomportal-Instance
True-Client-Ip
X-FPC
X-Micro-Cache
X-CF-Lambda-Version
X-CF-Lambda-Fn
X-MSEdge-Flight
X-MSEdge-Features
X-RateLimit-Limit-Second
X-PAYTM-SRV-ID
OT-Force-Account-Verify
X-RateLimit-Remaining-Second
Resin-Trace
Ngx-Var-Key
X-Udemy-Cache-App-Namespace
X-Datadome
X-APP-VERSION
Path
CDN
Request-ID
X-MP-GENERATED-AT
YJS-ID
X-Request-URI
X-Wikidot-Static-Cache
X-Cache-NGX
X-CDN-Cache-Status
X-Fastly-Country-Code
X-SIPLIST1
IsBot
N-Cache
X-Wikidot-Backend
X-CACHE-KEY
X-TX-ID
X-VCL-Version
X-Orig-Expires
X-Shop-Environment
X-Tenant
RNT-Time
Server-Id
RNT-Machine
X-Forwarded-Path
X-Bl-Debug
X-Info
X-CLOUD-TRACE-CONTEXT
GeoIP-Country-Code
X-Lb-Id
X-Accel-Version
X-Service-Response-Time
Sm-Log-Id
Lb
X-App-Name
X-Ha-Backend
X-B3-Trace-ID
X-WA
X-Policy
X-MCACHE
Location
X-Pod-Name
X-Edge-POP
Cross-Origin-Opener-Policy-Report-Only
X-Datacenter
X-RateLimit-Reset
LB
X-Akamai-Pragma-Client-IP
Hit
X-Cdn-Cache-Status
HIT
X-Oss-Hash-Crc64ecma
X-Oss-Object-Type
X-Via-PopV
X-Oss-Request-Id
X-Oss-Server-Time
X-Via-PopH
X-Oss-Storage-Class
X-NC
Ohc-File-Size
Servername
X-Via-PopN
X-Cache-Expires
X-SERVER-NAME
X-Cdn-Request-ID
X-Geo
X-Cdn-Forward
X-Srcache-Store-Status
X-Snapshot-Date
X-ServedByHost
X-Cache-Ttl
X-Srcache-Fetch-Status
Timeexpire
FSS-Cache
ENV
Pramga
X-Logging-Id
Geoip-Latitude
Yjs-Id
Proxy-Connection
Epwk-X-Cache
X-LiteSpeed-Cache-Control
Req-ID
X-Cdn-Diag
X-Ctl-Mach
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
Traceparent
X-Scheme
X-Moov-T
X-Hyper-Cache
WZWS-RAY
X-Container-Uri
X-Git-Commit
X-Lb-Nocache
X-Moov-Xdn-Version
X-Amz-Meta-Opti
X-Serial
X-Dw-Trace-Id
X-UP
X-Vcache
X-TraceId
X-Fastly-Backend-Reqs
Warning
X-MiniProfiler-Ids
X-M-Reqid
X-M-Log
Ec-Rule-Version
X-PERF
X-B3-Parentspanid
Cneonction
X-Viewer-Country
Content-Style-Type
X-Swift-Error
X-Acquia-Site
X-Acquia-Application-UUID
X-Acquia-Purge-Tags
X-VG-WebCache
X-Acquia-Application-Trace
Content-Script-Type
X-RAMCache
X-Qnm-Cache
X-ApacheServer
X-Tncms
X-TT-LOGID
X-Wp-Cf-Super-Cache-Cache-Control
X-F-Status
X-Lsadc-Cache
CountryCode
X-Wp-Cf-Super-Cache
X-Mid-Debug-Cache-Key
X-Request-URL
X-Mg-Cache
XM
X-Litespeed-Cache-Control
V-Age
X-Iauth-Set-Uid
X-Acquia-Purge-Cdn-Unconfigured
MIME-Version
True-Client-Country-4JS
Ohc-Cache-HIT
X-LiteSpeed-Tag
Ngx
X-Th-Server
X-B3-ParentSpanId
Inserted-Into-Cache-At
X-Fastly-Cache-Hits
X-Cache-Ngx
X-Mid-Debug-Cache-Disk
X-Webstats-RespID
X-IPS-Cached-Response
My-App