We put our Magento site on Sucuri and it is much slower than running it off our own server. Looking further, we notice that Apache is sending two Vary: Accept-Encoding headers and, as per Sucuri support, these duplicate headers are preventing the site from being cached properly by Sucuri CDN.

Here's the curl output:

curl -IL https://domain.com
HTTP/1.1 200 OK
Server: nginx
Date: Mon, 26 Jun 2017 15:21:07 GMT
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Vary: Accept-Encoding |------> First header

Set-Cookie: frontend=fotji70ieh366b5k165u3mcd63; expires=Mon, 26-Jun-2017 16:22:19 GMT; Max-Age=3600; path=/; domain=domain.com; HttpOnly
Expires: Mon, 26 Jun 2017 18:22:19 GMT
Cache-Control: public, max-age=10800
Last-Modified: Wed, 14 Sep 2016 07:13:12 GMT
Set-Cookie: frontend_cid=sugOUAWt3WMknsbW; expires=Mon, 26-Jun-2017 16:22:19 GMT; Max-Age=3600; path=/; domain=domain.com; secure; httponly
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000

Vary: Accept-Encoding,User-Agent |------> Second header
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
X-Sucuri-Cache: MISS
X-Sucuri-ID: 16007

I have gone nuts trying to figure out why these duplicate headers are occurring. I removed moddeflate and modexpires <IfModule> declarations from the Apache vhost and Magento's .htaccess but the duplicate headers are still showing up.

I would greatly appreciate any pointers towards fixing this. Thanks in advance.