The question people actually type is short: is NordVPN safe. The honest answer has to start by splitting it in two, because most of what gets published under that title answers a question nobody asked.
There is the service: the encryption, the no-logs policy, who owns the company, what happens when a court asks. And there is the website: the thing you type your card number into. The second one can be measured from the outside, right now, by anyone. The first one cannot.
So we measured the second one, on thirty vendors at once.
What we did, on 20 August 2026
One GET request to each vendor's homepage, checking for six HTTP response headers that browsers act
on: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options,
X-Content-Type-Options, Referrer-Policy and Permissions-Policy. Present or absent, scored out
of six. Twenty-nine of thirty hosts answered.
The raw file, the vendor list and the scoring rule are published as a dataset under DOI 10.5281/zenodo.22032840, so you can disagree with our reading of it without having to take our word for the numbers.
The result
| header | vendors serving it |
|---|---|
| Strict-Transport-Security | 26 of 29 (90%) |
| X-Content-Type-Options | 25 of 29 (86%) |
| X-Frame-Options | 23 of 29 (79%) |
| Referrer-Policy | 14 of 29 (48%) |
| Content-Security-Policy | 10 of 29 (34%) |
| Permissions-Policy | 8 of 29 (28%) |
Mean score: 3.66 of 6.
Five vendors scored 6 of 6: cryptostorm.is, mullvad.net, nordvpn.com, torguard.net and windscribe.com. One scored 0 of 6: fastestvpn.com served none of the six.
The headline is the middle of that table. HSTS is nearly universal, because it is a one-line
configuration and every hosting guide mentions it. Content-Security-Policy is the one that takes
actual work, because it means auditing every script your marketing team has ever added. Two out of
three VPN vendors have not done it.
Nothing in the photo above is what this article measures. Security headers are configuration, not cabling, and that gap is roughly the size of the gap between "the website is well configured" and "the service is trustworthy".
So, is NordVPN safe?
On this measurement, its website is among the best configured in the field. That is a real signal, and a small one.
It is real because it is the cheapest possible test of whether an organisation that sells security applies it to itself. A vendor with a full header set has someone who cares about the boring parts.
It is small because a header scan measures the website, not the VPN service. It cannot tell you whether logs are kept. It cannot tell you what the tunnel actually does with your traffic. It cannot tell you who owns the company this quarter. If you came here to find out whether NordVPN is safe in the sense that matters most, this article has given you one data point out of many, and you should be suspicious of anyone who hands you six out of six as an answer.
The part we would rather not print
We checked our own headers before publishing this. vpnsmith.com serves a
Content-Security-Policy, which puts us in the 34% and on the right side of our own table.
Read it, though:
script-src 'self' 'unsafe-inline' 'unsafe-eval' https:
That policy allows inline scripts, allows eval, and allows script from any host over HTTPS.
Against the injection attacks a CSP exists to stop, it protects very close to nothing. We ship
the header. We do not really ship the defence.
Which is the actual lesson of the dataset, and the reason the caveat is printed on the record itself: presence is not correctness. Ten vendors have a CSP. We did not check how many of those ten have a CSP worth having, because that requires reading each policy line by line, and we have not done that work yet. When we do, this article gets an update and a new date.
How to read this dataset without overreading it
Four limits, all of them in the published record:
- One observation, one moment. 20 August 2026. Headers change, sometimes weekly.
- One vantage point. A CDN can inject or strip headers per edge node. Your result may differ.
- Homepage only. The checkout page and the account page are the ones that matter most, and they are not in this scan.
- Presence, not correctness. As above, and it is not a small footnote. It is the main risk of misreading the whole table.
None of that makes the measurement useless. It makes it a starting point that you can reproduce in an afternoon, which is more than most "most secure VPN" listicles can say for themselves.
What to do with it
If you are choosing a VPN, use this the way you would use a restaurant's clean kitchen: it tells you something about how the place is run, and nothing about whether you will like the food. Read the audit reports, read the jurisdiction, read what happened the last time the vendor was subpoenaed.
If you run a website, the useful takeaway is not about VPNs at all. It is that shipping a header and shipping a defence are different projects, and the first one is easy enough that its presence proves much less than people assume. We know, because we did exactly that.
★ Nuremberg GDPR datacenter · ✓ Dedicated IPv4 included · 200+ Mbps guaranteed
Get Contabo30-day money-back guarantee→
