We checked 1,000 DeFi websites: 76% have no CSP and 64% can be framed by another site

Alex Simakov — Sat, 07 Nov 2026 07:49:47 +0000

A passive look at the front door of DeFi. There were no attacks; we only looked at what every visitor's browser receives.

Smart contracts get audited. The website in front of them usually does not. Yet some of the most painful losses did not touch a contract at all. In BadgerDAO (December 2021, about $120M), a script injected into the front end asked users for token approvals. In the Ledger Connect Kit incident (December 2023), a poisoned version of a widely used front-end library turned dApps into wallet drainers.

So we looked at the websites of DeFi protocols listed on DefiLlama.

Method

We took every protocol listed on DefiLlama with a website, which is about 4,000 domains, and picked 1,000 at random.
We loaded only the home page, once, like a normal visitor. We did not log in, connect a wallet, probe hidden files or submit forms.
We checked response headers, cookie flags, HTTPS, third-party scripts and broken links on the home page.
We publish no project names, only aggregated numbers.

896 sites answered. Another 39 blocked automated checks and 65 did not answer; the shares below are of the 896.

An honest limit: we looked at home pages. On many projects that is a marketing page and the app with the wallet button lives on another address, so a number here is a signal to check, not proof that a project's users are at risk.

Findings

What	Share of sites
No Content-Security-Policy	76%
Can be framed by another site (clickjacking)	64%
No HSTS	35%
Third-party scripts without Subresource Integrity	27%
Cookies without Secure/HttpOnly	6%
Broken links on the home page	5%

Why these matter more for DeFi than for a blog

Scripts without SRI. These scripts come from analytics, chat widgets and CDN-hosted libraries. If any of those vendors is compromised, the attacker's code runs on your page, right next to your "Connect wallet" button. SRI makes the browser refuse a script whose content has changed. It cannot be used on scripts whose content changes by design, such as most analytics tags; CSP is the protection for those.
Clickjacking. A dApp that can be loaded in an invisible frame lets an attacker line up your "Approve" button under their "Claim reward" button. On most sites this is a nuisance. On a site that triggers wallet signatures, it is a theft vector.
No CSP. A CSP is the second line of defence when an injected script does get in: it limits where scripts can load from and where data can be sent.

For comparison, we ran the same check on 1,000 ordinary websites, of which 571 answered. DeFi sites do better on HSTS (35% missing vs 61%), cookies (6% vs 26%) and third-party scripts without SRI (27% vs 64%). On the two protections that matter most for a site that asks for wallet signatures they are no better: framing (64% vs 58%) and CSP (76% vs 79%).

The good news

The fixes are configuration, not code:

Content-Security-Policy with an explicit script allow-list and frame-ancestors 'none';
integrity= on every third-party <script>, or self-hosting;
Strict-Transport-Security.

A team can ship all three in an afternoon.

Check your own front end

We built a free passive check. It looks for exactly these issues and gives you the top 3 with a fix: https://mcp.pasportoo.com/check?utm_source=devto

The full audit covers the main user journey on desktop and mobile, bugs and passive security first, and a human reviews every finding before delivery: https://mcp.pasportoo.com/services/website-ux-audit?utm_source=devto

If you run a project and found something serious with our check, we are happy to explain the finding. Ask us at work@pasportoo.com.