Security Headers of 99 VPN and Privacy Websites, Measured (August 2026)

When a tool's entire pitch is privacy, its own website is the first thing a visitor can actually check. So we checked it - on 99 sites across VPN providers, password managers, encrypted messengers, self-hosted tools and privacy-focused hosts.

What the score is, and what it is not

This is the part to read before the table, because a number without its meaning is worse than no number.

We measure what the web server declares to your browser. Eight headers, on the homepage, on one day. That is the whole scope.

We do not measure the product. A password manager scoring F here may have flawless cryptography; a VPN scoring A+ may still keep logs. The headers say whether someone switched on the browser-side hardening. That is a signal about engineering care, not a verdict on the software.

If you take one thing from this page: a low grade is not an accusation, and a high grade is not a guarantee.

How the score is calculated

Eight headers, weighted by what each actually prevents rather than counted equally:

Grades: A+ 90-100 · A 75-89 · B 60-74 · C 40-59 · D 20-39 · F under 20.

A site that uses frame-ancestors inside its CSP receives the X-Frame-Options points. Without that rule we would have penalised sites for choosing the more modern option - a flaw in our scoring, not in their configuration.

Seven sites could not be measured (timeout, certificate failure, or an automated client refused). Their rows are empty, not zero. A failed measurement is not a finding.

A padlock on a grid fence, the sky showing through every square. Headers work the same way: each one closes a specific opening, and the ones you leave out stay open regardless of how good the lock is.

The full ranking, August 2026

Did your site earn an A+, A or B? Take the badge

If your site scored B or better, you are welcome to display it. The badge links back to this page so anyone can verify the grade against the published table and re-run the scanner themselves - which is the only reason a badge like this is worth anything.

There is one badge per grade. Swap -aplus for -a or -b to match the grade in the table above.

<a href="https://www.vpnsmith.com/en/blog/vpn-privacy-security-headers-2026">
  <img src="https://www.vpnsmith.com/badges/security-headers-2026-aplus.svg"
       alt="Security Headers 2026 - grade A+ - measured by VPNSmith" width="184" height="40">
</a>

Each badge is a static SVG with no script and no cookie. Being a privacy audience, you will want the rest of it stated plainly: served from our domain it is a third-party request, and our web server logs it the way any web server logs an image. So host it yourself - download the SVG, put it on your own domain, keep the link. That is the version we recommend, and it changes nothing for us: we count badges by reading public HTML, never by reading our logs.

No conditions attached. We do not ask for anything in return, we do not require the link to be followed, and the badge keeps working whether or not you tell us you used it.

Improved your headers? Ask for a re-test

The scanner is MIT-licensed and dependency-free, so you can reproduce our number before you even contact us. If you have changed your configuration and want the table to reflect it, say so and we will re-measure and update the row. A site raising its score is the outcome this page exists to encourage - a ranking that only names and shames is a ranking nobody improves for.

Reproduce every number here

The measurement is worth exactly as much as your ability to check it. The scanner queries each homepage once, reads the response headers, and applies the table above. No key, no scraping, no account.

The scanner: security-headers-scan.py — MIT, no dependencies, one argument (a text file with one domain per line). It queries each homepage once, reads the response headers, and applies the weights in the table above. Run it against this list and you should reproduce our column values exactly; if you do not, we would like to know.

If you want the wider context on why these headers matter for a self-hosted setup, our WireGuard vs OpenVPN comparison covers the transport side, and choosing a VPS for a VPN covers the host you would be hardening.