---
title: X-SigSci-* request headers
summary: null
url: >-
  https://www.fastly.com/documentation/guides/next-gen-waf/developer/x-sigsci-headers
---

`X-SigSci-*` headers are added to incoming requests. The end user (your customers) can't see them. However, your internal application can use these headers for various integrations.

> **HINT:** Want to customize an Edge WAF deployment using VCL? Check out our docs on [using VCL variables](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-architecture-types/#using-vcl-variables).

## Limitations and considerations

Keep in mind the following:

- Don't manipulate the `x-fastly-ngwaf` header, as this header is not intended for customer usage.
- If you are using the module-agent deployment method, your deployment module may alter the case of header names (e.g., `X-SigSci-AgentResponse` may appear as `X-Sigsci-Agentresponse`).

## Headers that are automatically added

The Next-Gen WAF automatically adds the following `X-SigSci-` headers to requests:

| Header                   | Description                                                                                                                                                                                                                                                                                                                                                                                 | Deployment type                                                                                                                                                       |
| ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `X-SigSci-AgentResponse` | A [code](https://www.fastly.com/documentation/guides/next-gen-waf/agent-response-codes/about-agent-response-codes) that indicates the Next-Gen WAF agent's decision to allow or block a request to your web application. The 200 agent response code indicates the request should be allowed, and agent response codes greater than or equal to 301 indicate the request should be blocked. | Edge WAF <br /><br />On-Prem WAF                                                                                                                                      |
| `X-SigSci-EdgeModule`    | The `edgemodule` version of your Edge WAF deployment and whether dynamic backends are enabled (e.g., `vcl 2.7.0;backendtoken`).                                                                                                                                                                                                                                                             | Edge WAF with an [in-band architecture](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/edge-deployment/edge-waf-architecture-types) |
| `X-SigSci-RequestID`     | A request ID used to uniquely identify a request. Not all requests will be assigned an ID.                                                                                                                                                                                                                                                                                                  | All                                                                                                                                                                   |
| `X-SigSci-Tags`          | A CSV string of comma-separated signals that are associated with a request. The header includes both [system and custom signals](https://www.fastly.com/documentation/guides/next-gen-waf/signals/about-signals/) (e.g., `SQLI, XSS, NOUA, TOR, SITE.CUSTOM-SIGNAL`).                                                                                                                       | All                                                                                                                                                                   |
| `X-SigSci-Decision-MS`   | The time the WAF takes to enrich a request with headers and potentially block it. This header can only be used in [VCL](https://www.fastly.com/documentation/guides/full-site-delivery/caching/manipulating-the-cache-key).                                                                                                                                                                 | Edge WAF                                                                                                                                                              |

## Related content

- [About Edge WAF deployment](https://www.fastly.com/documentation/guides/next-gen-waf/setup-and-configuration/about-deploying-the-next-gen-waf#about-edge-waf-deployment)