diff --git a/blockcheck2.sh b/blockcheck2.sh
index 73ef158..ab0a285 100755
--- a/blockcheck2.sh
+++ b/blockcheck2.sh
@@ -37,6 +37,26 @@ DESYNC_MARK=0x10000000
 CURL_MAX_TIME=${CURL_MAX_TIME:-2}
 CURL_MAX_TIME_QUIC=${CURL_MAX_TIME_QUIC:-$CURL_MAX_TIME}
 CURL_MAX_TIME_DOH=${CURL_MAX_TIME_DOH:-2}
+# CURL_PAD_KB pads every curl request with the given number of KB, useful
+# for the "16 KB" whitelist-style block (see docs): that block triggers on
+# total bytes transferred on the connection, not on how much of it was an
+# actual response, so padding the request is enough to test for it even
+# against a target with no large page of its own to download - e.g. a bare
+# IP from a provider's range rather than a known blocked domain. The padding
+# is written straight to a small temp file (nothing large ever passes
+# through a shell variable, command substitution, or argument) and attached
+# as a header with curl's own @filename form of -H, which reads the file
+# instead of taking the value on the command line - unlike an equivalent
+# amount of data passed via --data/--data-binary, this doesn't conflict with
+# HEAD requests, so it composes cleanly with CURL_HTTPS_GET either way.
+CURL_PAD_KB=${CURL_PAD_KB:-0}
+if [ "$CURL_PAD_KB" -gt 0 ] 2>/dev/null; then
+	CURL_PAD_FILE=/tmp/zapret-curlpad-$$
+	printf 'X-Pad: ' > "$CURL_PAD_FILE"
+	head -c $((CURL_PAD_KB*1024)) /dev/zero | tr '\0' A >> "$CURL_PAD_FILE"
+	printf '\n' >> "$CURL_PAD_FILE"
+	CURL_OPT="${CURL_OPT}${CURL_OPT:+ }-H @$CURL_PAD_FILE"
+fi
 USER_AGENT=${USER_AGENT:-Mozilla}
 HTTP_PORT=${HTTP_PORT:-80}
 HTTPS_PORT=${HTTPS_PORT:-443}
@@ -163,6 +183,7 @@ cleanup()
 		    pf_clean
 		    ;;
 	esac
+	[ -n "$CURL_PAD_FILE" ] && rm -f "$CURL_PAD_FILE"
 }
 
 IPT()
diff --git a/docs/manual.en.md b/docs/manual.en.md
index 0a3b5eb..51b2740 100644
--- a/docs/manual.en.md
+++ b/docs/manual.en.md
@@ -4972,6 +4972,7 @@ CURL_MAX_TIME_DOH - curl timeout for DoH servers
 CURL_CMD=1 - display curl commands
 CURL_OPT - additional curl options. `-k` to ignore certificates, `-v` for verbose protocol output
 CURL_HTTPS_GET=1 - use the GET method instead of HEAD for HTTPS
+CURL_PAD_KB - pad every curl request with a junk header of this many KB. Useful for testing a "16 KB"-style whitelist block (see [below](#why-it-wont-open)) against a target with no large page of its own to download, since that block triggers on total bytes transferred rather than on how much of it was a real response. Independent of CURL_HTTPS_GET; use whichever fits the target
 DOMAINS - space-separated list of domains or domains with URIs to test
 TEST - name of the test
 IPVS=4|6|46 - IP protocol versions to test
diff --git a/docs/manual.md b/docs/manual.md
index 9693775..dcb5451 100644
--- a/docs/manual.md
+++ b/docs/manual.md
@@ -5160,6 +5160,7 @@ CURL_MAX_TIME_DOH - время таймаута curl для DoH серверов
 CURL_CMD=1 - показывать команды curl
 CURL_OPT - дополнительные параметры curl. `-k` - игнор сертификатов. `-v` - подробный вывод протокола
 CURL_HTTPS_GET=1 - использовать метод GET вместо HEAD для https
+CURL_PAD_KB - добавлять к каждому запросу curl мусорный заголовок на указанное число КБ. Полезно для проверки блока в стиле "16 кб" (см. [ниже](#почему-не-открывается)) на ресурсе без своей большой страницы для скачивания, поскольку этот блок срабатывает по суммарному числу переданных байт, а не по тому, сколько из них было настоящим ответом. Независимо от CURL_HTTPS_GET, используйте то, что подходит для конкретной цели
 DOMAINS - список тестируемых доменов или доменов с URI через пробел
 TEST - имя теста
 IPVS=4|6|46 - тестируемые версии ip протокола