HTTP Headers Analysis for https://ads-api.x.com

Detected Technologies from Headers

See all in URL Inspect 2

Cloudflare CDN

Envoy

HTTP Security Headers

Status

Strict-Transport-Security

Present

max-age=631138519; includeSubdomains

Content-Security-Policy

Missing

Not configured Analyze

Content-Security-Policy-Report-Only

Missing

Not configured Analyze

X-Frame-Options

Good

SAMEORIGIN

X-Content-Type-Options

Good

nosniff

Referrer-Policy

Missing

Not configured

Permissions-Policy

Missing

Not configured

Recommendations

• Increase HSTS max-age to at least 1 year and add includeSubDomains
• Add Content-Security-Policy header to prevent XSS attacks
• Add Referrer-Policy header (recommended: strict-origin-when-cross-origin)
• Consider adding Permissions-Policy to control browser features

Performance Headers

Connection

Performance

close

Transfer-Encoding

Performance

chunked

Vary

Performance

accept-encoding

connection: close
transfer-encoding: chunked
vary: accept-encoding

Caching Headers

Cache-Control

Caching

no-cache, no-store, max-age=0

cache-control: no-cache, no-store, max-age=0

Content Headers

Content-Disposition

Content

attachment; filename=json.json

Content-Type

Content

application/json;charset=utf-8

content-disposition: attachment; filename=json.json
content-type: application/json;charset=utf-8

Server Headers

Server

cloudflare envoy

server: cloudflare envoy

CORS Headers

No CORS headers found

Cookies Headers

Set-Cookie

Cookies

set-cookie: guest_id_marketing=v1%3A178752198471942025; Max-Age=63072000; Expires=Tue, 22 Aug 2028 21:53:04 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
guest_id_ads=v1%3A178752198471942025; Max-Age=63072000; Expires=Tue, 22 Aug 2028 21:53:04 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
personalization_id="v1_gnoPS0qeYZ9DbGHNg+Db4w=="; Max-Age=63072000; Expires=Tue, 22 Aug 2028 21:53:04 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
guest_id=v1%3A178752198471942025; Max-Age=63072000; Expires=Tue, 22 Aug 2028 21:53:04 GMT; Path=/; Domain=.x.com; Secure; SameSite=None
__cf_bm=8IhdgdoW8h7i.7i4rCOLdvNWglB4qJbPYUi5kVfdQnE-1787521984.7016325-1.0.1.1-nO.YW_ik1SkX2Pl0G9ZtDhQgL0odw7imQ8shQ3yzVsQetPIeA9eRQmx5WvZ2eMCqnwLl86tumNJXCnqnXyCgO_GhnhXywYdBMpGJJIIrHlC27C7hSedEoutmRTdW73qK; HttpOnly; SameSite=None; Secure; Path=/; Domain=x.com; Expires=Sun, 23 Aug 2026 22:23:04 GMT

Other Headers

Cf-Cache-Status

Other

DYNAMIC

Cf-Ray

Other

a2fd59146e4a241c-IAD

Date

Other

Sun, 23 Aug 2026 21:53:04 GMT

Origin-Cf-Ray

Other

a2fd59146e4a241c-ATL

Perf

Other

7402827104

Timing-Allow-Origin

Other

https://x.com, https://mobile.x.com

X-Response-Time

Other

80

X-Served-By

Other

t4_a

X-Transaction

Other

1c29f38814ae5d1e

X-Transaction-Id

Other

1c29f38814ae5d1e

cf-cache-status: DYNAMIC
cf-ray: a2fd59146e4a241c-IAD
date: Sun, 23 Aug 2026 21:53:04 GMT
origin-cf-ray: a2fd59146e4a241c-ATL
perf: 7402827104
timing-allow-origin: https://x.com, https://mobile.x.com
x-response-time: 80
x-served-by: t4_a
x-transaction: 1c29f38814ae5d1e
x-transaction-id: 1c29f38814ae5d1e

Recommendations

Enable compression (gzip/brotli) to improve performance