Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-UA-Compatible
X-Xss-Protection
X-Served-By
CF-Ray
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-FRAME-OPTIONS
X-Envoy-Upstream-Service-Time
Timing-Allow-Origin
X-Iinfo
X-DNS-Prefetch-Control
X-Dns-Prefetch-Control
X-Drupal-Dynamic-Cache
Server-Timing
Feature-Policy
X-Content-Security-Policy
Access-Control-Expose-Headers
X-XSS-PROTECTION
Content-Encoding
X-CDN
Status
X-Request-ID
Upgrade
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Via
X-Amz-Id-2
Request-Context
X-Backend
X-Turbo-Charged-By
X-Cache-Group
X-Robots-Tag
X-AH-Environment
Cf-Edge-Cache
Keep-Alive
Host-Header
X-Hacker
X-Vhost
X-UA-Device
X-Proxy-Cache
X-Server
X-Rq
Allow
X-Server-Powered-By
X-Ws-Request-Id
X-Dispatcher
X-Age
EagleId
X-Varnish-Cache
X-Amz-Version-Id
P3p
Nel
X-LiteSpeed-Cache
X-Ua-Compatible
Grace
Cf-Apo-Via
Cf-Railgun
X-Page-Speed
X-Pantheon-Styx-Hostname
X-Styx-Req-Id
EagleEye-TraceId
X-Device
X-Swift-CacheTime
X-Swift-SaveTime
X-OneAgent-JS-Injection
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-Pingback
X-Host
X-Node
X-Cache-Lookup
X-CST
Accept-CH
X-Backend-Server
X-WebKit-CSP
Surrogate-Control
X-Server-Id
Accept-CH-Lifetime
Permissions-Policy
X-Readtime
X-Nginx-Upstream-Cache-Status
X-Nginx-Cache-Status
X-Akam-SW-Version
X-EdgeConnect-MidMile-RTT
X-EdgeConnect-Origin-MEX-Latency
X-Application-Context
Request-Id
X-Content-Security-Policy-Report-Only
X-Cloud-Trace-Context
Xkey
X-Response-Time
X-HW
X-Ruxit-JS-Agent
X-Trace
X-Edge
Content-Location
X-Clacks-Overhead
X-Mod-Pagespeed
Rating
X-Url
X-ESI
X-Midtier
X-Amz-Server-Side-Encryption
X-ECACHE
Cache-Tag
X-Oneagent-Js-Injection
Accept-Ch
X-MS-InvokeApp
X-Powered-By-Plesk
X-Rack-Cache
X-D2id
X-Kinja-Build
X-Use-Magma
X-Kinja-Server
X-Kinja-Revision
X-Kinja
X-Exp-Id
X-Cdn-Fetch
X-Exp-Variant
X-GoogleNews-Bot
X-Element-Page-Cache
Service-Worker-Allowed
X-Vcap-Request-Id
X-Mcache
Verso
X-Upstream
Edge-Control
X-Country
X-Country-Code
RTSS
X-Ac
X-Vname
X-TtlSet
X-PC
Origin-Trial
X-Goog-Hash
X-VARITI-CCR
X-Navigation-Version
X-Kinja-CCPA
X-Abt-Application-Version
X-Cache-TTL
Fastly-Restarts
X-Browser-Type
Accept-Ch-Lifetime
X-Litespeed-Cache
X-Amz-Rid
X-Aspnetmvc-Version
X-Varnish-TTL
X-Ruxit-Js-Agent
X-GitHub-Request-Id
X-NWS-LOG-UUID
X-WebKit-CSP-Report-Only
X-Webkit-CSP
X-Cached
Cross-Origin-Opener-Policy
X-Server-Name
X-Middleton-Display
Pagespeed
Display
X-Sol
X-Amzn-Trace-Id
X-Dw-Request-Base-Id
SPRequestGuid
X-SharePointHealthScore
X-Times
X-Ttl
Pinterest-Generated-By
X-Pinterest-Rid
Pinterest-Version
SPRequestDuration
X-ORACLE-DMS-ECID
X-ORACLE-DMS-RID
SPIisLatency
X-Server-Lifecycle-Phase
X-Instrumentation
X-Erf-Bev-Bev-Is-Generated
X-Kraken-Loop-Name
X-Erf-Bev-Bev
X-B3-Traceid
X-Content-Type
X-Cache-Key
AR-PoweredBy
AR-SID
AR-ATIME
AR-Request-ID
X-FastCGI-Cache
X-Powered-CMS
X-Client-IP
Arr-Disable-Session-Affinity
X-Mg-S
Response
X-Middleton-Response
X-Version
X-Ser
X-Cnection
X-Server-ID
X-Jurisdiction
X-HP-Trace-Id
X-HP-Webp
Nginx-Cache
X-Accel-Expires
Cache-Tags
X-T
AR-CACHE
X-SRCache-Store-Status
X-SRCache-Fetch-Status
X-Fastly-Request-ID
X-RateLimit-Remaining
Cache-Status
Edge-Cache-Tag
X-NF-Request-ID
X-Hits
X-MSEdge-Ref
Front-End-Https
X-Px
Public-Key-Pins
X-Recruiting
X-B3-TraceId
X-RateLimit-Limit
S
Payment
X-Shield-Request-Id
X-Daa-Tunnel
X-Frontend
X-LLID
Server-Node
X-Ua-Browser
X-Request-Processing-Time
X-Request-Received
X-B3-TraceId-Primal
MRF-Tech
Mrf-Cache-Status
Content-MD5
X-GUploader-UploadID
X-Goog-Metageneration
MicrosoftSharePointTeamServices
X-DIS-Request-ID
X-Amzn-RequestId
X-Content-Digest
X-Amz-Apigw-Id
Access-Control-Request-Method
X-Webkit-CSP-Report-Only
X-TTL
TP-Cache
X-Forwarded-For
X-Protected-By
Realpath
X-Microsite
X-Request-Handler-Origin-Region
X-Distributor
X-FB-Debug
X-PressLabs-Stats
X-Webkit-Csp
X-HS-Cache-Config
X-HS-Content-Id
X-HS-Combine-CSS
Access-Control-Allow-Method
X-HS-Hub-Id
Fastcgi-Cache
X-Rid
X-Page-Id
X-Cluster-Name
Accept-Charset
X-LB-Cache
X-Aspnet-Version
Count-Hit
X-Ua-Device
X-Goog-Generation
X-Goog-Stored-Content-Length
X-Goog-Stored-Content-Encoding
X-Goog-Storage-Class
X-Hostname
X-B3-Sampled
X-Geo-Country
X-Id
X-Edge-Location-Klb
TP-L2-Cache
X-Kinsta-Cache
X-Ratelimit-Remaining
Cross-Origin-Resource-Policy
X-Xrds-Location
X-Seen-By
X-Correlation-Id
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Ezoic-Cdn
X-App-Server
Cleartype
TCN
X-Logged-In
X-Varnish-Backend
X-Fastcgi-Cache
X-Content-Options
X-Hosted-By
Referer-Policy
X-TEC-API-ORIGIN
X-Git-Hash
X-TEC-API-VERSION
X-TEC-API-ROOT
X-Mobile
DC
X-COUNTRY
X-Contextid
Retry-After
X-Origin-Cache
X-Fb-Rlafr
X-Providence-Cookie
X-Is-Crawler
X-Request-Guid
X-Aspnet-Duration-Ms
X-Flags
X-Route-Name
X-Amz-Replication-Status
Surrogate-Key
X-Grace
X-Revision
X-App-Environment
X-TT
X-Ratelimit-Limit
X-Debug-Info
X-F-Cache
X-Forwarded-Proto
Frame-Options
X-IPS-LoggedIn
X-Varnish-Grace
X-Amz-Meta-S3cmd-Attrs
X-Newrelic-App-Data
X-RateLimit-Reset
X-Envoy-Decorator-Operation
X-Azure-Ref
Section-Io-Cache
MS-Author-Via
X-Magnolia-Registration
X-Wix-Request-Id
X-Proxy-Cache-Info
X-Whom
X-Www-Served-By
X-App-Version
Healthy
Charset
Viewport
X-Akamai-Edgescape
X-Language
Alternate-Protocol
X-Activity-Id
X-Trace-Id
WPO-Cache-Status
X-Backend-Name
X-AppVersion
Filterid
X-Az
WPO-Cache-Message
X-Origin-Server
Amp-Access-Control-Allow-Source-Origin
Server-Name
X-Varnish-Server
X-Kong-Upstream-Latency
X-Datadog-Sampling-Priority
X-Datadog-Parent-Id
Paypal-Debug-Id
X-Kong-Proxy-Latency
X-Datadog-Trace-Id
X-B
X-EdgeConnect-Cache-Status
Host
SD-X-WS
X-Http-Reason
VIX-Pulpo-Upstream-Status
SRV
X-Cache-Rule
VIX-Pulpo-Node
X-Response-Served-From
X-Original-Request-Id
X-UUID
X-Akamai-Request-ID2
X-Edge-Location
X-ProcessESI
X-Rule
X-User-Agent
X-Nf-Request-Id
X-Cache-Grace
X-DataDome
X-Instance
X-RemovedCookies
Front
X-Tumblr-Pixel
X-Rocket-Nginx-Serving-Static
X-Vcache
Protected
X-Region
X-ARC
X-L-Path
X-Environment-Context
Country
X-Tumblr-Pixel-1
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Cacheable-TTL
X-Page-View
X-Unique-Id
From-Origin
X-Tumblr-Pixel-0
X-N
X-Jobs
X-Tumblr-User
X-Varnish-Age
X-Adobe-Loc
Fastly-SWR
Fastly-SIE
X-Adobe-Content
X-FW-Static
X-Rendered-As
X-FW-Version
X-Status
Akamai-GRN
X-Framework
X-FW-Type
X-Is-Bot
X-FW-Dynamic
X-FW-Serve
X-FW-Hash
X-Load-Cache
X-FW-Server
X-Type
X-Mg-Request-UUID
X-Datadog-Sampled
X-Signature
X-G
X-Proxy
X-Cache-Time
X-B-Cache
Content-Disposition
X-Debug-IsPreview
X-Debug-IsConnected
X-Amzn-Remapped-Content-Length
ServerID
Access-Control-Request-Headers
X-Time
X-ECache
X-CDN-Forward
X-Client-Ip
X-Tec-Api-Origin
X-Tec-Api-Root
X-Tec-Api-Version
Backend
X-WP-CF-Super-Cache
X-WP-CF-Super-Cache-Cache-Control
Refresh
X-Cache-Control
X-Erf-Web-Scheduler
X-MCACHE
X-DynaTrace
Xet-Cookie
X-Servername
X-Httpd
Accept-Language
Url
X-Drupal-Cache-Tags
X-Tt-Trace-Tag
X-Tt-Trace-Host
X-Template
CF-IPCountry
X-Cache-Age
Countrycode
X-DynaTrace-JS-Agent
X-Generated-By
X-Mode
X-Device-Type
X-Nginx-Cache
Webserver
X-HTML-Minification-Powered-By
X-Content-Powered-By
X-NYM-Debug-Backend
Xserver
X-Source
X-Storage
X-XRDS-Location
GEO-INFO
X-Hcs-Proxy-Type
X-CCDN-Origin-Time
X-CCDN-CacheTTL
X-Cache-Hit
X-Loop
X-Content-Age
Locale
Load-Balancing
Filters
X-GeoCountry
S-Rt
X-LAGOON
X-XRDS-LOCATION
X-Urbn-Site-Id
Meta-Geo
X-Cache-Action
X-SayCDN-TTL
X-UPSTREAM-Address
X-Urbn-Context-Path
X-Rewrite-Enabled
X-GeoCode
X-Tncms
X-JoinUs
X-Say-TTL
OT-Force-Account-Verify
X-ServerID
X-Director
Version
X-Say-Cacheable
X-SaId
X-Cache-Operation
X-URL
X-Rn-Rsrv
X-Container-Uri
Cross-Origin-Window-Policy
X-Cluster-Node
X-Forwarded-Host
X-Git-Commit
Onion-Location
X-Tumblr-Pixel-3
X-Soup
X-Tumblr-Pixel-2
X-Varnish-Cache-Hits
X-Varnish-Hostname
X-Tt-Logid
X-Cache-Server
Azure-InstanceId
X-Tb
X-Skip-Cache
X-Detected-As
X-Sql-Count
X-Sql-Duration-Ms
Azure-RegionName
Azure-SiteName
X-Ms-Request-Id
X-VC-Cache
X-Lambda-Id
X-Labrador-Cache-Channel
X-Ms-Version
Azure-Version
Azure-SlotName
X-RM-Cache-TTL
X-Adobe-Source
X-PHP-Host
X-Served-From
Web-Mar-Node
X-FB-TRIP-ID
X-Extlb
Node
Mn-Server-Ip
X-Proxied
X-Routing-Service
X-Redis-Cache
X-R9-Blue-Green-Version
X-Zipkin-Id
X-VCT
DB-Nickname
X-RCS-CacheZone
Webcakes-App-Version
Selected-Fe
Property-Id
X-Uri
Webcakes-Region
Webcakes-App-Name
TWC-Connection-Speed
TWC-Locale-Group
TWC-GeoIP-LatLong
TWC-GeoIP-Country
TWC-Device-Class
X-Proxy-Build
X-Timing-Wait
X-Proto
X-Format
X-Fetched-On
X-Debug
Fastcgi-Useragent
TWC-Privacy
X-Logging-Id
X-Generation-Time
X-Origin-Hint
X-FTR-Request-ID
X-B3-SpanId
X-NGENIX-Cache
X-Endurance-Cache-Level
Uber-Trace-Id
Source
X-Zen-Fury
X-LSADC-Cache
CDN-RequestId
X-Sucuri-Cache
X-Sucuri-ID
X-Ua
X-S
Section-Io-Origin-Time-Seconds
Section-Io-Origin-Status
Section-Origin-Responded
Section-Io-Id
X-Oracle-Dms-Rid
X-Oracle-Dms-Ecid
X-TimeS
X-CACHE-AGE
X-Origin-CC
X-Origin-TTL
NGB
X-Drupal-Cache-Contexts
X-MP-GENERATED-AT
X-Akamai-Transformed
X-Origin-Date
X-Pass-Why
Upgrade-Insecure-Requests
X-Varnish-Hits
X-Srv
X-Real-IP
X-Cache-Expired-At
Fastly-Drupal-HTML
X-Ratelimit-Reset
X-Newrelic-Synthetics
X-Handled-By
Liferay-Portal
Apigw-Requestid
X-Xfnlog-Site
X-Cms-Context
X-Optimistic-Header
X-Reqid
X-No-Session
X-GEO
X-Upgrade-Enabled
ServedBy
X-TIME
X-Restarts
MS-CV
X-Cache-Host
X-Varnish-Ttl
X-ProxyCache-Status
Ms-Operation-Id
X-RTag
X-BYPASS-REASON
X-Hl-Ver
X-ProxyCache-Key
X-Tx-Id
WP-Super-Cache
CDN-Uid
X-Cache-TTL-Remaining
CDN-RequestPullSuccess
X-UA-Device-Type
X-Cache-Type
X-AB
CDN-Cache
CDN-RequestPullCode
X-Node-Name
CDN-RequestCountryCode
CDN-CachedAt
CDN-PullZone
CDN-EdgeStorageId
X-Fastly-Request-Id
X-Cluster
X-Parent-Response-Time
X-AWS-Id
X-IPLB-Request-ID
X-VWS-Id
X-IPLB-Instance
X-LJ-Flow-ID
X-Pubstack
X-TraceId
X-Via-JSL
X-S-Cookie
X-Rojux
Cache-Provider
X-Request-Host
X-Destination
X-Bl-Debug
X-SD-PageType
X-ScT
X-Proxy-Cache-Status
L
Sslversion
X-CGP
X-CF-Lambda-Version
Surrogated-Key
T-Server
Server-Host
Rendered-Blocks
X-Application
X-App
Origin-Agent-Cluster
Redirect-Candidate
X-CF-Lambda-Fn
True-Client-Country-4JS
X-A-Dam
X-A-Ccd
X-A-Dcw
X-A-Dgt
X-A-Wwc
X-A
Web-Mar-Region
X-Cache-NE
Vix-Hermes-Req-Id
W
X-Aed
Odigeo-Trace-Id
Ngx.Var.Host
X-D
DCR-Processing-Time-Ms
X-Csrf-Jwt
Fastly-SSL
Gannett-Cam-Experience-Id
DCR-Decision-By
Candidate-Md5Url
X-Debug-Cache-Store
X-BCube-Filmed-By
X-Debug-Cache-Fetch
Canary
Ha-Gx-Prefs
HA-Ipaddr
MD5-Digest
Magicmarker
X-Conf
Meta-Geo-Continent
N-Cache
X-PAYTM-SRV-ID
Lang
Host-ID
X-CacheTTL
L5d-Success-Class
X-B-Cookie
BehaviorPad-Version
X-Developer
X-SRCache-Key
X-Eu-Site
X-External-Request-Id
X-Geo-Region
X-Epic-Correlation-Id
X-Ec-Fail
X-Ec-GeoHdr
X-Fastly-Backend
X-FC-Vary-Parameters
X-Worker
Xc-Version
X-We-Are-Hiring
X-Vtex-Remote-Cache
X-Vdms-Version
X-Viewer-Country
X-Ec-Custom-Error
X-Vdms-Path
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Micro-Cache
X-Dispatcher-Number
X-CSRF-Token
Cache-Name
X-Cache-Status-Check
X-Server-W
Release
Req-Svc-Chain
Thinkindot-Control
Producers
Platform
Thinkindot-CacheControl-Type
X-Orig-Expires
X-Org
X-Wikidot-Backend
X-AIR-PT
X-Origin-Time
Thinkindot-CacheControl
TDXMobile
X-GeoIP-Region-Code
X-VG-TLSProxy
X-VG-WebCache
X-Core-Mission
X-Cache-Debug
X-Nananana
X-Shopify-Stage
Mail-Subject
X-DPWN-IS-SECURE
X-Wikidot-Static-Cache
X-Forwarded-Path
Origin
X-VServer
X-Vmg-Version
X-CMSURLCustom
X-Core-Value
VNS-Age
X-Node-Id
X-Thanos
X-Alternate-Cache-Key
X-NodeID
X-Qloud-Router
X-Nyt-Route
X-Pool
X-Cache-Info
X-ApacheServer
X-BBC-Edge-Cache-Status
X-Bc-Bl
X-Human
X-Nitro-Cache
X-App-Name
X-Geo-Header
X-Owner
X-Accel-Expires-Debug
We-Hiring
X-Cache-Bucket
X-Shop-Environment
VNS-Cache
X-Old-Content-Length
Is-Eu
X-Cdn-Origin
X-Cdn-Diag
X-Level-Front-Cache
X-Accel-Buffering
X-Irp-Debug
X-Generated-On
X-Gdpr
X-Bip
X-Wix-Viewer-Type
X-ShopId
Adler-Geo
AKAMAI
X-Up
X-RateLimit-Remaining-Second
X-DefElseHash
X-DefHash
X-Refresh
X-Var-Ttl
X-RateLimit-Limit-Second
X-Mvc-Supplant-Cachable
CloudFront-Viewer-Country
X-Varnish-CookieHashed-On
X-Variation
X-Correlation-ID
X-Date
X-Mly-Id
X-Thinkindot-L3
X-Server-IP
X-Storefront-Renderer-Rendered
X-Sorting-Hat-ShopId
X-Sorting-Hat-PodId
X-Dispatcher-Server
X-Sn-Servicetimems
X-SVT-ORM-RULES
X-GeoIP-Country-Code
X-Tenant
X-Request-Time
X-S-Maxage
X-Hash
X-SVT-ORM-VERSION
X-ShardId
Cmsid
X-Policy
Environment
Expect-Staple
X-Varnishpool
X-Varnish-CookieINHashed-On
Datacenter
Fastly-Backend-Name
Fastly-GeoIP-CountryCode
X-PERF
Gh-Request-Id
X-Platform
X-Loc
X-Mid
CPC-Cache
X-Varnish-Remaining-TTL
Cmstype
CPC-Age
User-Cache-Control
X-Origin
Cf-Device-Type
X-Esi-Check
X-Gen-Mode
X-Via-Fastly
X-Instance-Name
CDCHOST
X-Mvc-Supplant-OutputCached
Server-Ext
Sever-Int
X-Datadome
X-GeoIP
X-INCAP-ABP
X-Block-Status
X-Clara-WADP
X-NCache
X-Nginx-Cache-Key
X-WADP-Cache
X-Cache-Id
X-Auto-Login
Esi-Enabled
Apple-News-Services-Handled
X-From
X-Origin-Response-Time
Apple-News-Services-Host
Apple-News-Services-Parsed-Url
X-Hnp-Log
X-Device-Os
Apple-News-Services-Request-Url
X-Vgn-Hpd-Reason
Country-Code
X-Fmm-Version
X-Test
X-Clientip
NM-Fastcgi-Cache
X-Forwarded-Site
X-Gzip
Machine
Server-Hostname
X-Op-Id-All
X-Accel-Version
X-B3-Spanid
X-LB-NoCache
X-Cache-Enabled
X-Cdn-Srv
X-Section
Ssr
DSUID
Server-Info
Pics-Label
C-Via
NGX
Wxu-Next-Commit
X-WA-Info
X-Akamai-Device-Characteristics
Wxu-Next-Hostname
Content-Secure-Policy
Wxu-Next-Region
X-Access
X-Buckets
X-Is-Tablet
X-Browser-Name
X-Is-Desktop
X-Vcl-Version
AMP-Access-Control-Allow-Source-Origin
X-Tcp-Rtt
X-Is-Mobile
X-Is-Supported-Browser
Server-ID
X-Amz-Meta-Cb-Modifiedtime
X-Presslabs-Stats
X-CACHE-GROUP
X-Dc
X-API-Version
X-Varnish-Beresp-Ttl
X-Varnish-Beresp-Grace
X-HA-Backend
IsBot
X-SIPLIST1
Hostname
X-ID
X-B3-Parentspanid
Memcached
X-JWT-State
X-Is-Gdpr
X-Zone
X-Has-Esi
X-Cached-By
CF-Ctrl
X-Wp-Cf-Super-Cache-Active
YJS-ID
Time
Cdn-Requestid
X-Platform-Processor
X-Platform-Router
Memory
X-Platform-Cluster
X-Origin-Cache-Key
Sid
X-TA-CDN-Provider
X-Scale
Origin-EX
X-Tb-Optimization-Total-Bytes-Saved
Cache-Hits
Location
Origin-CC
X-WP-CF-Super-Cache-Active
X-Frame-Option
X-TIM-N
X-Hyper-Cache
X-Internal-Host
X-Air-Hostname
X-Air-Trace-Id
X-Air-Source
X-Fpc
X-Backend-Instance
X-NewRelic-App-Data
X-ZONE
X-PHP-Backend
X-Cs
X-NGINX-Cache
X-DC
Resin-Trace
X-Country-Code-Real
X-Webstats-RespID
X-Service
X-FTR-Backend
X-FTR-Balancer
X-FTR-Backend-Server
X-FTR-Cache-Status
X-FTR-Expires
X-VC
X-DataCenter
Epwk-X-Cache
X-Azure-Ref-OriginShield
X-SRV
GeoIP-Latitude
X-LiteSpeed-Cache-Control
LB
X-Site-Version
GeoIp-Country-Code
Uri
X-Microcachable
X-CSRF-TOKEN
Cache-Host
True-Client-Ip
X-Nitro-Rev
X-Nitro-Cache-From
X-Origin-Expires
X-Locale
X-VCache
X-Cache-Ttl
X-NMSegId
Req-ID
X-Edge-Server
XM
X-Info
NtCoent-Length
Cdn-Host
Cdn-Request-Time
WZWS-RAY
XServer
True-Client-IP
GeoIP-Country-Code
Cdn
X-Datacenter
PFcat
M-TraceId
X-VarnishDD-TTL
X-Pad
X-Pod-Name
X-HN
X-Ad-Load-Variation
X-Geo
X-Web-Node
SID
WebServer
X-M-Reqid
X-Ad-Defer-Variation
X-Vercel-Id
X-M-Log
User-Agent
X-Github-Request-Id
X-Request-Start
X-Scope-Id
Pramga
X-Request-URI
Cluster
X-Vercel-Cache
X-Via-CDN
Content-Script-Type
Content-Style-Type
X-CS
Locid
CountryCode
Edge-Copy-Time
X-FPC
X-FL-EDGE
X-Via-SSL
X-FL-QIT-DEBUG
X-Via-Edge
X-Varnish-Beresp-Status
X-MSEdge-Features
Fastly-Drupal-Html
X-MSEdge-Flight
A
X-Shield-Cache-Expires
X-Qnm-Cache
Srvid
X-HostName
Tcn
X-Cache-Date
Cache-Tv-Group
Edge-Cache
X-WP-CF-Super-Cache-Cookies-Bypass
X-APP-VERSION
X-Api-Version
HostName
Cf-Ipcountry
X-Cdn-Request-ID
X-TH-Server
X-Cache-ASPX
X-Contensis-Viewer-Groups
X-AK-Request-ID
Path
Cdnsip
Cdncip
X-ATG-Version
X-Amz-Meta-Opti
X-NWS-UUID-VERIFY
X-Moov-Xdn-Version
X-Varnish-Authentication
X-Esi
X-Moov-T
X-FireWall-Port
X-LiteSpeed-Tag
Click-Count-Error
X-Via-Popv
Tube-Return
X-Nc
Tube-Got-Results
X-Aicache-OS
X-B3-Trace-ID
X-Req
X-Cache-FS-Status
Tube-Get-Contents
Tube-Got-Eval
X-Branch-Name
X-Acquia-Purge-Cdn-Unconfigured
X-Wa
X-Via-Poph
X-Via-Popn
X-V-Cache
Click-Count-Action-Start
X-Servedbyhost
X-SB
Cache-Key
X-VCL-Version
X-Wp-Cf-Super-Cache-Cookies-Bypass
MIME-Version
XkeyRZ
X-Vary
X-Proxy-CacheRZ
X-Men
On-Server
V-Age
Yak-Timeinfo
X-TRACE-ID
X-LB-ID
X-UA
CDN
X-CACHE-KEY
X-Tim-N
Wpo-Cache-Status
Srv
X-Render-Time
Proxy-Connection
X-Wp-Cf-Super-Cache-Cache-Control
X-Wp-Cf-Super-Cache
X-Cdn-Forward
Geoip-Latitude
Wpo-Cache-Message
Ngx-Var-Key
X-Akamai-Pragma-Client-IP
X-Rebelmouse-Cache-Control
X-Rebelmouse-Surrogate-Control
X-Lb-Cache
X-Air-Pt
X-Acquia-Purge-Tags
X-Platform-Server
X-Acquia-Application-UUID
Priority
X-Fastly-Backend-Reqs
Lb
X-Acquia-Application-Trace
X-HS-Content-Campaign-Id
X-Acquia-Site
My-App
Server-Id
X-Ha-Backend
X-User
X-Planisys-CDN-Cache
X-Generated-In
State
X-Planisys-CDN-TTL
X-Planisys-CDN-Rules
X-TT-LOGID
Yjs-Id
Ohc-Cache-HIT
X-CUA
X-Lb-Nocache
X-Varnish-Director
Vha6-Origin
PICS-Label
X-Fastly-Country-Code
X-Via-Ucdn
X-Dw-Trace-Id
CF-Cached-On
Ohc-File-Size
X-Vgn-Hpd-Variations-Key
X-Fastly-Cache
X-Vgn-Hpd-Ssi
X-EC-Lua
X-Release
X-Vgn-Hpd-Cached
X-Upstream-Ct
X-Upstream-Ht
X-Iplb-Request-Id
X-Iplb-Instance
X-Provided-By
Fusion-Content-Id
Fusion-Source
Fusion-Content-Source
X-Lb-Id
Type
Warning
Fusion-Template-Id
Fusion-Deployment-Id
Fusion-Component-Id
X-CDN-Cache-Status
X-Cache-Remote
Inserted-Into-Cache-At
X-Fastly-Cache-Hits
X-Snapshot-Date
Cache
CACHE-MISS-TO-ORIGIN
X-Traceid
X-Rocket-Build-Number
X-Sigma
X-Sigma-Backend
X-Cached-Since
X-ElasticPress-Query
X-Miniprofiler-Ids
Cneonction
X-CF-Cache-Header-Cache-Control
X-CF-Cache-Header-Vary
X-RAMCache
X-HS-Status
X-Litespeed-Cache-Control
Ngx
Log-Origin
X-Udemy-Cache-App-Namespace