Two thirds of VPN vendors ship no Content-Security-Policy. Including, sort of, us.

I scanned the public homepages of thirty commercial VPN vendors for the six HTTP response headers
that browsers actually act on. One GET each, 2026-08-20, 29 of 30 hosts answering.

mean score 3.66 / 6

Strict-Transport-Security   26/29   90%
X-Content-Type-Options      25/29   86%
X-Frame-Options             23/29   79%
Referrer-Policy             14/29   48%
Content-Security-Policy     10/29   34%   <-- the interesting one
Permissions-Policy           8/29   28%

Two out of three companies selling security do not ship a Content-Security-Policy.

Why that particular header

HSTS is one line in a config file and every hosting guide mentions it. That is why it is at 90%.

CSP is the one that costs real work, because writing a useful one means auditing every script the
marketing department has added over the years. It is the header that separates "we followed a
checklist" from "someone owns this".

Full scores (6/6): cryptostorm.is, mullvad.net, nordvpn.com, torguard.net, windscribe.com.
One vendor scored 0/6.

The part that makes this post worth writing

We are in the 34%, and our CSP is close to worthless.

script-src 'self' 'unsafe-inline' 'unsafe-eval' https:

Inline scripts allowed, eval allowed, script from any HTTPS host allowed. Against the injection
attacks a CSP exists to stop, that policy blocks very nearly nothing. We ship the header. We do not
ship the defence.

Which is the actual finding, and the reason it is printed on the dataset itself:

Presence is not correctness.

Ten vendors have a CSP. I did not check how many of those ten have a CSP worth having, because that
means reading each policy line by line. That work is not done, so the claim is not made.

Limits, stated up front

• One observation, one moment. Headers change, sometimes weekly.
• One vantage point. A CDN can inject or strip headers per edge node.
• Homepage only. Checkout and account pages matter more and are not in this scan.
• Presence, not correctness. As above. It is the main way to misread the whole table.

Reproduce it

The vendor list, the six header names and the scoring rule are published as a dataset under
DOI 10.5281/zenodo.22032840, so you can disagree with my
reading without taking my word for the numbers. Any HTTP client reproduces it in a few minutes, and
differences from this snapshot are expected and informative in themselves.

The longer write-up, including why a header scan tells you nothing at all about whether a VPN
service is trustworthy, is on VPNSmith.

If you run any public site: check your own script-src before you feel good about having a CSP. I
did, and that is how this post got its most useful paragraph.