Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: HTTP Header Usage Statistics HTTP Header Usage Statistics


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

This is a continuation of work started by Brough Davis as part of his software security project for his Masters in Information Security Engineering. The main goal of this project is to find how many sites use security relevant headers, like for example the X-XSS-Protection or X-Frame-Options headers.

Below you will find a table/histogram showing how many times we found each header (security relevant or not). We access the index page of each site using a "head" request. The list of sites is derived from Alexa's Top 1 Million sites. We try to poll as many sites as possible each day.

As we collect more data, we will plot changes over time.



All Headers Active In The Past Month
Header Popularity
Set-Cookie
Content-Type
Date
Connection
Server
Cache-Control
Vary
Expires
X-Frame-Options
Strict-Transport-Security
Content-Length
X-Content-Type-Options
Link
Last-Modified
Cf-Request-Id
CF-Cache-Status
ETag
Expect-CT
Accept-Ranges
X-Powered-By
Pragma
X-XSS-Protection
CF-RAY
X-Cache
Via
Age
Content-Security-Policy
Report-To
NEL
Referrer-Policy
Access-Control-Allow-Origin
Content-Language
X-Amz-Cf-Pop
X-Amz-Cf-Id
Alt-Svc
P3P
X-Cache-Hits
X-UA-Compatible
X-Xss-Protection
X-Served-By
CF-Ray
X-Download-Options
X-Request-Id
X-Timer
Access-Control-Allow-Headers
Access-Control-Allow-Methods
X-Varnish
X-Adblock-Key
Access-Control-Allow-Credentials
X-Permitted-Cross-Domain-Policies
Content-Security-Policy-Report-Only
X-AspNet-Version
X-Runtime
X-Drupal-Cache
X-Cache-Status
X-Generator
X-Check
X-Cacheable
X-Envoy-Upstream-Service-Time
X-FRAME-OPTIONS
X-DNS-Prefetch-Control
Timing-Allow-Origin
X-Iinfo
X-Dns-Prefetch-Control
Server-Timing
X-Drupal-Dynamic-Cache
Feature-Policy
X-Content-Security-Policy
Access-Control-Expose-Headers
Content-Encoding
X-CDN
Status
X-XSS-PROTECTION
Upgrade
X-Request-ID
X-AspNetMvc-Version
Access-Control-Max-Age
X-Amz-Request-Id
X-Via
X-Amz-Id-2
Request-Context
X-Ua-Compatible
X-Backend
X-Cache-Group
X-Turbo-Charged-By
X-Robots-Tag
Cf-Edge-Cache
Keep-Alive
Host-Header
X-AH-Environment
X-UA-Device
X-Vhost
X-Hacker
X-Proxy-Cache
X-Server
Allow
X-Rq
X-Server-Powered-By
X-Ws-Request-Id
X-Dispatcher
X-Age
EagleId
X-Varnish-Cache
X-Amz-Version-Id
P3p
Nel
Grace
X-LiteSpeed-Cache
Cf-Apo-Via
Cf-Railgun
X-OneAgent-JS-Injection
X-Page-Speed
X-Styx-Req-Id
X-Pantheon-Styx-Hostname
EagleEye-TraceId
X-Device
X-Swift-CacheTime
X-Swift-SaveTime
X-Aws-Lambda-Call-Status
Ali-Swift-Global-Savetime
X-Pingback
X-Host
Accept-CH
X-Cache-Lookup
X-CST
X-Node
X-WebKit-CSP
X-Backend-Server
Surrogate-Control
Permissions-Policy
X-Readtime
X-Nginx-Upstream-Cache-Status
X-Nginx-Cache-Status
X-Akam-SW-Version
X-Server-Id
X-EdgeConnect-Origin-MEX-Latency
X-EdgeConnect-MidMile-RTT
X-Application-Context
Request-Id
Accept-CH-Lifetime
X-Ruxit-JS-Agent
Xkey
X-Cloud-Trace-Context
X-Content-Security-Policy-Report-Only
X-Response-Time
X-HW
X-Trace
X-Edge
Content-Location
X-Clacks-Overhead
X-Mod-Pagespeed
X-Url
Rating
X-ESI
X-Midtier
X-Amz-Server-Side-Encryption
X-ECACHE
Cache-Tag
X-Mcache
X-Country
X-Aspnetmvc-Version
Accept-Ch-Lifetime
X-Rack-Cache
X-Powered-By-Plesk
X-MS-InvokeApp
X-D2id
Service-Worker-Allowed
X-GoogleNews-Bot
X-Use-Magma
X-Kinja
X-Exp-Variant
X-Kinja-Build
X-Kinja-Revision
X-Exp-Id
X-Cdn-Fetch
X-Kinja-Server
X-Vcap-Request-Id
Verso
X-Element-Page-Cache
Accept-Ch
X-Upstream
Edge-Control
X-Litespeed-Cache
X-Country-Code
Origin-Trial
RTSS
X-Vname
X-Ac
X-TtlSet
X-PC
X-Goog-Hash
X-Webkit-CSP
X-VARITI-CCR
X-Navigation-Version
X-Kinja-CCPA
X-Abt-Application-Version
X-Cache-TTL
X-Browser-Type
Fastly-Restarts
X-Varnish-TTL
X-Amz-Rid
X-NWS-LOG-UUID
X-Oneagent-Js-Injection
X-GitHub-Request-Id
Cross-Origin-Opener-Policy
X-Server-ID
X-Cached
X-Server-Name
X-Dw-Request-Base-Id
X-Amzn-Trace-Id
Display
X-Sol
Pagespeed
X-Middleton-Display
X-Times
X-WebKit-CSP-Report-Only
SPRequestGuid
X-SharePointHealthScore
Pinterest-Generated-By
X-Pinterest-Rid
X-Content-Type
Pinterest-Version
SPIisLatency
SPRequestDuration
X-Kraken-Loop-Name
X-Erf-Bev-Bev
X-Instrumentation
X-Erf-Bev-Bev-Is-Generated
X-Server-Lifecycle-Phase
X-Cache-Key
X-ORACLE-DMS-RID
X-ORACLE-DMS-ECID
X-Ruxit-Js-Agent
AR-SID
AR-Request-ID
X-Ttl
AR-PoweredBy
AR-ATIME
X-Powered-CMS
X-B3-Traceid
Arr-Disable-Session-Affinity
X-FastCGI-Cache
X-Mg-S
X-Cnection
X-Version
X-Client-IP
X-Middleton-Response
Response
X-Ser
Nginx-Cache
X-Jurisdiction
X-HP-Trace-Id
X-HP-Webp
X-Accel-Expires
Cache-Tags
X-SRCache-Fetch-Status
X-Fastly-Request-ID
X-T
X-SRCache-Store-Status
AR-CACHE
Cache-Status
Edge-Cache-Tag
X-B3-TraceId
X-Hits
X-MSEdge-Ref
X-Px
Public-Key-Pins
X-NF-Request-ID
Front-End-Https
X-Recruiting
S
X-Shield-Request-Id
Payment
X-Daa-Tunnel
X-LLID
X-RateLimit-Remaining
X-Frontend
Server-Node
X-Ua-Browser
X-Request-Received
X-Request-Processing-Time
X-B3-TraceId-Primal
MRF-Tech
Mrf-Cache-Status
Content-MD5
X-GUploader-UploadID
X-Goog-Metageneration
X-Webkit-CSP-Report-Only
X-TTL
MicrosoftSharePointTeamServices
Access-Control-Request-Method
X-Content-Digest
X-RateLimit-Limit
X-Amzn-RequestId
X-DIS-Request-ID
X-Amz-Apigw-Id
X-Ratelimit-Remaining
X-Forwarded-For
TP-Cache
Realpath
X-Protected-By
X-Request-Handler-Origin-Region
X-Microsite
X-PressLabs-Stats
X-Distributor
X-FB-Debug
X-HS-Cache-Config
Fastcgi-Cache
X-Xrds-Location
X-HS-Hub-Id
X-HS-Combine-CSS
X-HS-Content-Id
Access-Control-Allow-Method
X-Page-Id
X-LB-Cache
Accept-Charset
X-Cluster-Name
X-Rid
Count-Hit
X-Goog-Storage-Class
X-Goog-Stored-Content-Encoding
X-Goog-Stored-Content-Length
X-Goog-Generation
X-Hostname
X-Id
X-B3-Sampled
X-Ratelimit-Limit
X-Kinsta-Cache
X-Edge-Location-Klb
X-Geo-Country
TP-L2-Cache
X-Aspnet-Version
Cross-Origin-Resource-Policy
X-Fastcgi-Cache
X-Ua-Device
X-Seen-By
X-App-Server
TCN
Cleartype
X-Ezoic-Cdn
X-Varnish-Backend
X-Logged-In
X-Content-Options
X-Git-Hash
X-Erf-Stays-Pdp-Viaduct-Migration-Web
X-Correlation-Id
X-Mobile
Referer-Policy
X-Hosted-By
DC
X-Newrelic-App-Data
Retry-After
X-Origin-Cache
X-Fb-Rlafr
X-Contextid
X-Flags
X-Request-Guid
X-Is-Crawler
X-Providence-Cookie
X-Route-Name
X-Aspnet-Duration-Ms
X-TEC-API-VERSION
X-TEC-API-ROOT
X-TEC-API-ORIGIN
X-Forwarded-Proto
X-F-Cache
X-Grace
Surrogate-Key
X-Debug-Info
X-TT
X-Revision
X-Amz-Replication-Status
Frame-Options
X-App-Environment
X-Amz-Meta-S3cmd-Attrs
X-Varnish-Grace
X-IPS-LoggedIn
X-Envoy-Decorator-Operation
X-Azure-Ref
MS-Author-Via
X-Magnolia-Registration
Section-Io-Cache
X-Proxy-Cache-Info
X-Www-Served-By
X-Wix-Request-Id
X-App-Version
X-Whom
Healthy
Charset
X-Az
X-Activity-Id
X-Language
X-AppVersion
X-Akamai-Edgescape
Filterid
X-Nf-Request-Id
X-RateLimit-Reset
X-COUNTRY
X-Trace-Id
Alternate-Protocol
Viewport
X-Webkit-Csp
Amp-Access-Control-Allow-Source-Origin
WPO-Cache-Status
WPO-Cache-Message
X-Origin-Server
X-Varnish-Server
Server-Name
X-Backend-Name
X-Kong-Upstream-Latency
X-Kong-Proxy-Latency
Paypal-Debug-Id
X-Datadog-Sampling-Priority
X-Datadog-Parent-Id
X-Datadog-Trace-Id
X-EdgeConnect-Cache-Status
X-B
X-Original-Request-Id
X-Response-Served-From
VIX-Pulpo-Node
SRV
X-Http-Reason
VIX-Pulpo-Upstream-Status
Host
X-Cache-Rule
X-Edge-Location
X-Cache-Grace
Front
X-DataDome
X-UUID
X-Vcache
X-Instance
X-User-Agent
X-Akamai-Request-ID2
X-Region
X-Jobs
X-Yottaa-Optimizations
X-Yottaa-Metrics
X-Cacheable-TTL
X-Environment-Context
X-ARC
From-Origin
Protected
SD-X-WS
X-L-Path
X-Page-View
X-Rule
X-Unique-Id
Country
Content-Disposition
X-FW-Type
X-FW-Hash
X-Signature
X-Adobe-Loc
X-B-Cache
X-FW-Static
X-Time
Akamai-GRN
X-Adobe-Content
X-ProcessESI
X-FW-Version
X-Is-Bot
X-RemovedCookies
X-Rendered-As
X-Status
X-Rocket-Nginx-Serving-Static
X-Client-Ip
X-Varnish-Age
X-FW-Serve
X-FW-Server
X-Load-Cache
X-N
X-FW-Dynamic
X-Tumblr-Pixel-0
X-Tumblr-User
X-Tec-Api-Origin
X-Tumblr-Pixel
Fastly-SIE
X-Tec-Api-Version
Fastly-SWR
X-Proxy
X-Tec-Api-Root
X-Tumblr-Pixel-1
X-Framework
X-Datadog-Sampled
X-Mg-Request-UUID
X-G
X-Type
X-Cache-Time
X-Debug-IsConnected
X-Amzn-Remapped-Content-Length
X-Debug-IsPreview
Access-Control-Request-Headers
ServerID
X-WP-CF-Super-Cache-Cache-Control
X-WP-CF-Super-Cache
X-CDN-Forward
X-ECache
Backend
X-Cache-Age
X-Cache-Control
Refresh
X-Nginx-Cache
Countrycode
X-Servername
Xet-Cookie
X-Tt-Trace-Tag
X-DynaTrace
Url
X-Httpd
X-Tt-Trace-Host
X-Erf-Web-Scheduler
Accept-Language
CF-IPCountry
X-Drupal-Cache-Tags
X-Template
X-Device-Type
X-DynaTrace-JS-Agent
X-Mode
X-NYM-Debug-Backend
X-Content-Powered-By
X-Generated-By
X-HTML-Minification-Powered-By
Xserver
X-Storage
X-Cache-Hit
X-Source
X-Hcs-Proxy-Type
GEO-INFO
Version
X-CCDN-Origin-Time
X-CCDN-CacheTTL
X-Say-TTL
Locale
X-Loop
X-Director
X-Content-Age
Meta-Geo
X-Cache-Operation
X-UPSTREAM-Address
Filters
X-ServerID
X-FTR-Request-ID
X-Rewrite-Enabled
Webserver
X-GeoCode
X-LAGOON
X-SaId
X-Tncms
S-Rt
X-Say-Cacheable
X-SayCDN-TTL
X-GeoCountry
X-Urbn-Context-Path
OT-Force-Account-Verify
X-Urbn-Site-Id
Load-Balancing
X-JoinUs
X-Rn-Rsrv
X-Varnish-Cache-Hits
Cross-Origin-Window-Policy
X-Git-Commit
X-Tt-Logid
Onion-Location
X-Cluster-Node
X-Soup
X-Container-Uri
X-Cache-Action
X-Forwarded-Host
X-NGENIX-Cache
X-Adobe-Source
X-Detected-As
Web-Mar-Node
X-Varnish-Hostname
X-Ms-Version
X-VC-Cache
X-VCT
Azure-RegionName
X-Ms-Request-Id
X-Sql-Count
Azure-SiteName
X-Skip-Cache
X-Served-From
X-Tb
X-Lambda-Id
X-Sql-Duration-Ms
Azure-SlotName
Azure-InstanceId
Azure-Version
X-Labrador-Cache-Channel
X-Routing-Service
X-URL
X-Zipkin-Id
X-XRDS-LOCATION
X-RCS-CacheZone
Mn-Server-Ip
X-Extlb
X-PHP-Host
X-FB-TRIP-ID
Node
DB-Nickname
X-RM-Cache-TTL
X-Cache-Server
X-Proxied
X-R9-Blue-Green-Version
TWC-Device-Class
TWC-Connection-Speed
Selected-Fe
Property-Id
X-Redis-Cache
X-Tumblr-Pixel-3
X-Tumblr-Pixel-2
X-Timing-Wait
X-Logging-Id
X-Origin-Hint
X-Proxy-Build
X-Uri
X-Generation-Time
X-Format
Webcakes-App-Name
TWC-Privacy
TWC-Locale-Group
Webcakes-App-Version
Webcakes-Region
X-Fetched-On
X-Debug
TWC-GeoIP-LatLong
TWC-GeoIP-Country
X-MCACHE
Fastcgi-Useragent
X-Endurance-Cache-Level
X-Proto
Uber-Trace-Id
Source
X-B3-SpanId
X-Ratelimit-Reset
X-LSADC-Cache
X-Zen-Fury
X-Ua
X-Sucuri-Cache
X-Sucuri-ID
CDN-RequestId
X-S
Section-Io-Id
X-XRDS-Location
Section-Io-Origin-Status
Section-Io-Origin-Time-Seconds
Section-Origin-Responded
X-Newrelic-Synthetics
X-Origin-TTL
X-Origin-CC
NGB
X-TimeS
X-Srv
X-Oracle-Dms-Rid
X-Drupal-Cache-Contexts
X-Oracle-Dms-Ecid
X-Origin-Date
X-MP-GENERATED-AT
Upgrade-Insecure-Requests
X-Akamai-Transformed
Fastly-Drupal-HTML
X-Real-IP
X-Handled-By
X-Pass-Why
X-Cache-Expired-At
X-Varnish-Hits
X-Reqid
X-Optimistic-Header
X-No-Session
X-Xfnlog-Site
X-Cms-Context
Liferay-Portal
Ms-Operation-Id
MS-CV
Apigw-Requestid
X-RTag
ServedBy
X-GEO
X-CACHE-AGE
X-Restarts
X-AB
X-Cache-Host
X-ProxyCache-Key
X-ProxyCache-Status
X-TraceId
X-BYPASS-REASON
X-Hl-Ver
X-Tx-Id
X-Cache-TTL-Remaining
X-UA-Device-Type
WP-Super-Cache
X-Correlation-ID
X-LJ-Flow-ID
X-VWS-Id
X-Upgrade-Enabled
X-IPLB-Request-ID
X-Cache-Type
X-AWS-Id
X-CSRF-Token
X-Cluster
X-IPLB-Instance
X-Node-Name
X-Varnish-Ttl
X-Via-JSL
X-Geo-Region
X-Parent-Response-Time
X-Fastly-Request-Id
CDN-EdgeStorageId
CDN-CachedAt
X-Pubstack
CDN-Cache
X-Proxy-Cache-Status
CDN-RequestPullSuccess
CDN-PullZone
CDN-RequestCountryCode
CDN-RequestPullCode
CDN-Uid
X-Micro-Cache
X-PAYTM-SRV-ID
X-Request-Host
X-Cache-NE
X-Cache-Status-Check
X-External-Request-Id
X-B-Cookie
X-A-Dam
Ngx.Var.Host
X-A-Ccd
Odigeo-Trace-Id
N-Cache
Meta-Geo-Continent
Magicmarker
MD5-Digest
X-A-Dgt
X-A-Dcw
Origin-Agent-Cluster
X-A
True-Client-Country-4JS
Sslversion
Surrogated-Key
T-Server
Vix-Hermes-Req-Id
Server-Host
Web-Mar-Region
Redirect-Candidate
Rendered-Blocks
W
X-A-Wwc
Lang
X-FC-Vary-Parameters
BehaviorPad-Version
X-Application
X-App
X-Rojux
X-Fastly-Backend
X-Bl-Debug
X-BCube-Filmed-By
X-Bc-Bl
Cache-Provider
Canary
Candidate-Md5Url
Ha-Gx-Prefs
HA-Ipaddr
L
L5d-Success-Class
Gannett-Cam-Experience-Id
Fastly-SSL
DCR-Decision-By
DCR-Processing-Time-Ms
X-Aed
X-Ec-GeoHdr
X-Eu-Site
X-SRCache-Key
X-Worker
X-Debug-Cache-Fetch
X-Slack-Shared-Secret-Outcome
X-Slack-Backend
X-Csrf-Jwt
X-D
X-Epic-Correlation-Id
X-Debug-Cache-Store
X-We-Are-Hiring
X-Destination
X-Vdms-Version
X-Vdms-Path
X-Developer
X-Viewer-Country
X-Dispatcher-Number
X-Vtex-Remote-Cache
X-Conf
Xc-Version
X-S-Cookie
X-CGP
X-CF-Lambda-Fn
X-Ec-Custom-Error
X-CacheTTL
X-Ec-Fail
X-ScT
X-CF-Lambda-Version
X-Server-W
Cache-Name
X-Loc
Host-ID
TDXMobile
X-VG-TLSProxy
Is-Eu
X-Accel-Buffering
X-VServer
X-Vmg-Version
X-Generated-On
Req-Svc-Chain
Gh-Request-Id
X-Mid
X-Gdpr
Environment
VNS-Cache
X-Varnishpool
Expect-Staple
Fastly-Backend-Name
X-Mly-Id
Thinkindot-CacheControl
X-DefHash
X-Accel-Expires-Debug
X-Irp-Debug
Thinkindot-Control
X-Thanos
X-Varnish-Remaining-TTL
Origin
X-Dispatcher-Server
X-Human
X-Hash
X-Pool
X-Geo-Header
X-Qloud-Router
X-DPWN-IS-SECURE
X-AIR-PT
X-Owner
We-Hiring
Release
Mail-Subject
Platform
X-Level-Front-Cache
X-Wikidot-Backend
X-Wix-Viewer-Type
X-Wikidot-Static-Cache
Producers
X-Bip
VNS-Age
CloudFront-Viewer-Country
X-Sorting-Hat-ShopId
X-Origin-Time
X-Sorting-Hat-PodId
X-Sn-Servicetimems
X-ShopId
X-Shopify-Stage
X-Storefront-Renderer-Rendered
X-SVT-ORM-RULES
Datacenter
X-Old-Content-Length
X-Orig-Expires
X-Tenant
X-SVT-ORM-VERSION
X-Core-Value
X-Shop-Environment
X-Cache-Debug
X-SD-PageType
X-Cdn-Origin
X-Refresh
X-Request-Time
X-Cdn-Diag
X-Platform
X-Clientip
X-Core-Mission
X-ShardId
X-Server-IP
X-CMSURLCustom
X-PERF
X-Nyt-Route
X-Date
X-B3-Spanid
X-ApacheServer
X-Varnish-CookieINHashed-On
X-NodeID
X-Varnish-CookieHashed-On
X-Alternate-Cache-Key
X-Forwarded-Path
CPC-Age
CPC-Cache
Cmstype
Cmsid
Thinkindot-CacheControl-Type
X-App-Name
X-Nananana
X-Nitro-Cache
Adler-Geo
X-BBC-Edge-Cache-Status
X-Thinkindot-L3
AKAMAI
X-Up
X-Variation
X-Var-Ttl
X-DefElseHash
User-Cache-Control
X-TIME
X-Forwarded-Site
X-From
X-Cache-Info
X-Device-Os
X-Block-Status
X-Auto-Login
X-Gen-Mode
X-Cache-Bucket
X-GeoIP
X-Origin-Response-Time
Apple-News-Services-Request-Url
Apple-News-Services-Parsed-Url
Apple-News-Services-Host
Apple-News-Services-Handled
X-Nginx-Cache-Key
CDCHOST
DSUID
Country-Code
Cf-Device-Type
X-WA-Info
X-Node-Id
X-GeoIP-Country-Code
X-RateLimit-Remaining-Second
X-S-Maxage
X-Test
X-Vgn-Hpd-Reason
X-RateLimit-Limit-Second
X-VG-WebCache
X-Op-Id-All
X-Org
X-Origin
X-Policy
X-Mvc-Supplant-Cachable
X-NCache
Sever-Int
X-INCAP-ABP
X-Hnp-Log
NM-Fastcgi-Cache
Esi-Enabled
Fastly-GeoIP-CountryCode
Server-Hostname
Server-Ext
X-GeoIP-Region-Code
X-Is-Supported-Browser
X-Tcp-Rtt
X-Accel-Version
X-Is-Tablet
X-Is-Mobile
X-Browser-Name
X-Is-Desktop
Ssr
X-Esi-Check
X-Cache-Id
X-Section
Content-Secure-Policy
X-Cdn-Srv
Server-Info
X-Cache-Enabled
X-Clara-WADP
X-Gzip
X-Via-Fastly
X-Instance-Name
X-Ah-Environment
X-Mvc-Supplant-OutputCached
X-LB-NoCache
X-Access
X-WADP-Cache
C-Via
X-Fmm-Version
Machine
Pics-Label
Wxu-Next-Commit
Wxu-Next-Hostname
NGX
Wxu-Next-Region
X-Datadome
X-Vcl-Version
X-Buckets
X-Varnish-Beresp-Ttl
Server-ID
X-Varnish-Beresp-Grace
X-Amz-Meta-Cb-Modifiedtime
X-Dc
X-Akamai-Device-Characteristics
X-API-Version
AMP-Access-Control-Allow-Source-Origin
X-Zone
X-HA-Backend
IsBot
X-CACHE-GROUP
X-SIPLIST1
X-Presslabs-Stats
X-Origin-Cache-Key
YJS-ID
X-B3-Parentspanid
Cdn-Requestid
Sid
X-ID
X-Has-Esi
Memcached
X-Platform-Cluster
X-Platform-Router
X-JWT-State
X-Is-Gdpr
X-Platform-Processor
X-WP-CF-Super-Cache-Active
X-Cached-By
CF-Ctrl
Time
X-Wp-Cf-Super-Cache-Active
Location
X-Frame-Option
Hostname
Memory
X-TA-CDN-Provider
Origin-CC
X-Scale
X-Fpc
X-Air-Hostname
X-Internal-Host
Origin-EX
X-Tb-Optimization-Total-Bytes-Saved
Cache-Hits
X-TIM-N
X-Air-Source
X-Air-Trace-Id
X-Hyper-Cache
X-FTR-Backend
X-FTR-Cache-Status
X-FTR-Balancer
X-FTR-Backend-Server
X-FTR-Expires
X-Country-Code-Real
X-Backend-Instance
X-PHP-Backend
X-Webstats-RespID
X-ZONE
X-Cs
X-DC
Resin-Trace
X-Service
X-VC
X-LiteSpeed-Cache-Control
LB
Epwk-X-Cache
X-Site-Version
X-NewRelic-App-Data
X-DataCenter
Uri
True-Client-Ip
X-Azure-Ref-OriginShield
X-NGINX-Cache
X-Locale
GeoIP-Country-Code
X-SRV
X-Microcachable
GeoIP-Latitude
X-NMSegId
X-NODE
X-Edge-Server
Cache-Host
X-Nitro-Rev
GeoIp-Country-Code
X-Nitro-Cache-From
WZWS-RAY
Cdn-Host
Cdn-Request-Time
Req-ID
X-Origin-Expires
X-VCache
WebServer
X-Datacenter
XM
Cdn
X-Info
X-Cache-Ttl
X-Ad-Load-Variation
XServer
X-CSRF-TOKEN
X-Request-URI
X-Pod-Name
X-HN
M-TraceId
X-Request-Start
X-Scope-Id
PFcat
Pramga
X-Vercel-Cache
X-VarnishDD-TTL
X-M-Log
True-Client-IP
NtCoent-Length
X-Pad
X-Vercel-Id
X-M-Reqid
HostName
SID
X-Web-Node
X-Geo
Cluster
Content-Script-Type
X-Github-Request-Id
X-Shield-Cache-Expires
X-Ad-Defer-Variation
X-Varnish-Beresp-Status
User-Agent
X-Qnm-Cache
Content-Style-Type
X-WP-CF-Super-Cache-Cookies-Bypass
X-FL-QIT-DEBUG
Fastly-Drupal-Html
X-FL-EDGE
X-FPC
X-MSEdge-Flight
X-Via-SSL
Locid
X-Via-Edge
X-Via-CDN
X-Cache-Date
A
Cache-Tv-Group
X-CS
X-MSEdge-Features
Edge-Copy-Time
Srvid
X-HostName
Tcn
Edge-Cache
X-TH-Server
Cf-Ipcountry
X-Cdn-Request-ID
CountryCode
X-Api-Version
X-APP-VERSION
X-AK-Request-ID
X-Wa
X-Via-Popv
Cdncip
X-Via-Popn
X-NWS-UUID-VERIFY
X-Via-Poph
Tube-Got-Results
Tube-Got-Eval
Tube-Get-Contents
Tube-Return
X-Acquia-Purge-Cdn-Unconfigured
X-B3-Trace-ID
X-Aicache-OS
X-Cache-FS-Status
Click-Count-Error
X-V-Cache
X-Contensis-Viewer-Groups
X-Amz-Meta-Opti
X-Servedbyhost
X-Nc
Click-Count-Action-Start
X-LB-ID
X-Cache-ASPX
Cdnsip
X-Webkit-Csp-Report-Only
X-Varnish-Authentication
X-Moov-Xdn-Version
X-Esi
Path
X-FireWall-Port
X-Moov-T
X-ATG-Version
X-LiteSpeed-Tag
X-Men
On-Server
X-Vary
X-Branch-Name
Cache-Key
X-SB
V-Age
X-Req
X-VCL-Version
X-Wp-Cf-Super-Cache-Cookies-Bypass
Priority
X-Proxy-CacheRZ
Ngx-Var-Key
MIME-Version
X-TRACE-ID
XkeyRZ
Yak-Timeinfo
X-CACHE-KEY
X-UA
CDN
My-App
Geoip-Latitude
Proxy-Connection
X-Cdn-Forward
X-Wp-Cf-Super-Cache
X-Acquia-Purge-Tags
Wpo-Cache-Message
X-Render-Time
Wpo-Cache-Status
Srv
X-Acquia-Application-Trace
X-Akamai-Pragma-Client-IP
X-Tim-N
X-Acquia-Application-UUID
X-Wp-Cf-Super-Cache-Cache-Control
X-Acquia-Site
X-Rebelmouse-Surrogate-Control
X-Rebelmouse-Cache-Control
X-Lb-Cache
X-Provided-By
X-User
X-Platform-Server
X-Fastly-Backend-Reqs
X-Planisys-CDN-TTL
Lb
X-Planisys-CDN-Rules
X-Generated-In
X-Air-Pt
X-Planisys-CDN-Cache
X-HS-Content-Campaign-Id
X-Fastly-Country-Code
Server-Id
X-Ha-Backend
State
X-TT-LOGID
X-Release
Type
X-Lb-Nocache
X-Via-Ucdn
X-Vgn-Hpd-Ssi
PICS-Label
X-Cdn-Cache-Status
Fusion-Deployment-Id
X-Dw-Trace-Id
X-EC-Lua
X-Vgn-Hpd-Variations-Key
X-Vgn-Hpd-Cached
X-Fastly-Cache
CF-Cached-On
Ohc-File-Size
Fusion-Template-Id
Fusion-Content-Id
Fusion-Source
X-CUA
Ohc-Cache-HIT
Fusion-Content-Source
X-Varnish-Director
Fusion-Component-Id
X-Iplb-Instance
X-Iplb-Request-Id
X-Upstream-Ht
X-Upstream-Ct
Yjs-Id
Inserted-Into-Cache-At
X-Cache-Remote
Ngx
Log-Origin
X-Litespeed-Cache-Control
X-ElasticPress-Query
X-Fastly-Cache-Hits
X-GoCache-CacheStatus
Cache
Vha6-Origin
X-Cached-Since
Warning
X-HS-Status
X-CF-Cache-Header-Cache-Control
X-Sigma
X-CF-Cache-Header-Vary
X-Udemy-Cache-App-Namespace
X-Rocket-Build-Number
X-Sigma-Backend
X-Snapshot-Date
X-RAMCache
X-Miniprofiler-Ids
X-Traceid
Cneonction
CACHE-MISS-TO-ORIGIN