Security Headers of 99 VPN and Privacy Websites, Measured (August 2026)

When a tool's entire pitch is privacy, its own website is the first thing a visitor can actually check. So we checked it - on 99 sites across VPN providers, password managers, encrypted messengers, self-hosted tools and privacy-focused hosts.

What the score is, and what it is not

This is the part to read before the table, because a number without its meaning is worse than no number.

We measure what the web server declares to your browser. Eight headers, on the homepage, on one day. That is the whole scope.

We do not measure the product. A password manager scoring F here may have flawless cryptography; a VPN scoring A+ may still keep logs. The headers say whether someone switched on the browser-side hardening. That is a signal about engineering care, not a verdict on the software.

If you take one thing from this page: a low grade is not an accusation, and a high grade is not a guarantee.

How the score is calculated

Eight headers, weighted by what each actually prevents rather than counted equally:

Grades: A+ 90-100 · A 75-89 · B 60-74 · C 40-59 · D 20-39 · F under 20.

A site that uses frame-ancestors inside its CSP receives the X-Frame-Options points. Without that rule we would have penalised sites for choosing the more modern option - a flaw in our scoring, not in their configuration.

Seven sites could not be measured (timeout, certificate failure, or an automated client refused). Their rows are empty, not zero. A failed measurement is not a finding.

A padlock on a grid fence, the sky showing through every square. Headers work the same way: each one closes a specific opening, and the ones you leave out stay open regardless of how good the lock is.

The full ranking, August 2026

Did your site earn an A+, A or B? Take the badge

If your site scored B or better, you are welcome to display it. The badge links back to this page so anyone can verify the grade against the published table and re-run the scanner themselves - which is the only reason a badge like this is worth anything.

There is one badge per grade. Swap -aplus for -a or -b to match the grade in the table above.

<a href="https://www.vpnsmith.com/en/blog/vpn-privacy-security-headers-2026">
  <img src="https://www.vpnsmith.com/badges/security-headers-2026-aplus.svg"
       alt="Security Headers 2026 - grade A+ - measured by VPNSmith" width="184" height="40">
</a>

Each badge is a static SVG with no script and no cookie. Being a privacy audience, you will want the rest of it stated plainly: served from our domain it is a third-party request, and our web server logs it the way any web server logs an image. So host it yourself - download the SVG, put it on your own domain, keep the link. That is the version we recommend, and it changes nothing for us: we count badges by reading public HTML, never by reading our logs.

No conditions attached. We do not ask for anything in return, we do not require the link to be followed, and the badge keeps working whether or not you tell us you used it.

Download the raw data

The table above is not the dataset - it is a rendering of it. The measurements themselves are here, one row per site, one column per header:

vpn-privacy-security-headers-2026.csv

• 106 rows: 99 measured, 7 left with empty score fields because the request failed. A failed measurement is not a zero, and writing it as one is how surveys quietly become wrong.
• njalla.no was measured (85, grade A) and removed as the same entity as njal.la. That is why the table has 99 rows and not 100.
• Correction, 17 August: six domains redirect their homepage elsewhere, so we measured the destination and filed it under the name we started from. A homepage_redirects_to column now records every one: openziti.io→netfoundry.io, vaultwarden.dev→vaultwarden.com, threema.ch→threema.com, tutanota.com→tuta.com, www.veracrypt.fr→veracrypt.io, uptimekuma.org→uptimekuma.co. One of those makes the table double-count: openziti.io and netfoundry.io are the same server and carry identical rows, so the 99 rows cover 98 distinct hosts. We are leaving both rows visible with the redirect annotated rather than quietly renumbering, because you can check the redirect yourself and a silent edit would be worse than the error.
• Released into the public domain under PDDL 1.0. Reuse it, republish it, correct it. No attribution required - though if you cite it, cite the measurement date, because headers change.

Together with the MIT-licensed scanner, this is everything needed to reproduce, contest or extend the ranking. We would rather be corrected than believed.

We ran a second measurement over the same 106 domains, asking a different question of the same servers: whether any of them has told an AI crawler anything at all in robots.txt. Ninety of the hundred that answered have never named a single one - which is a useful reminder that a header table measures what a server was configured to say, not what its operator has thought about.

Improved your headers? Ask for a re-test

The scanner is MIT-licensed and dependency-free, so you can reproduce our number before you even contact us. If you have changed your configuration and want the table to reflect it, say so and we will re-measure and update the row. A site raising its score is the outcome this page exists to encourage - a ranking that only names and shames is a ranking nobody improves for.

Reproduce every number here

The measurement is worth exactly as much as your ability to check it. The scanner queries each homepage once, reads the response headers, and applies the table above. No key, no scraping, no account.

The scanner: security-headers-scan.py, MIT, no dependencies, one argument (a text file with one domain per line). It queries each homepage once, reads the response headers, and applies the weights in the table above. Run it against this list and you should reproduce our column values exactly; if you do not, we would like to know.

If you want the wider context on why these headers matter for a self-hosted setup, our WireGuard vs OpenVPN comparison covers the transport side, and choosing a VPS for a VPN covers the host you would be hardening.

The same method applied to a single provider: we scanned NordVPN's own security headers and published the result.

And your own exposure?

This page measures what 99 companies declare to your browser. The mirror question is what your browser declares to them, and it is the one you can act on today.

We built a short self-assessment on the same principle as this ranking: measured, not guessed, with the method stated. Browser fingerprint is a passive measurement, no questions asked: it counts how many distinctive attributes your setup exposes, and tells you plainly when your browser is defending itself. Attack surface and Phishing resistance are two short tests, under two minutes each.

Measure your browser fingerprint · Attack surface · Phishing resistance

Free, no account, nothing stored about you. It is ours, and we mark these links nofollow on purpose: we are sending you there because it is useful, not to pass ranking signal to ourselves.