Web Security Header Adoption Across 35 Cloud & VPS Hosting Providers (2026)

An open, reproducible dataset measuring which HTTP security response headers the websites of 35 well-known cloud and VPS hosting providers send (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy). Adoption is uneven: HSTS 60%, X-Frame-Options 63%, CSP 43%, Referrer-Policy 43%, Permissions-Policy only 23%. A homepage snapshot of each provider's own site, fully reproducible with curl (script included). First-hand, verifiable security research maintained alongside the self-hosted VPN and VPS hardening guides at VPNSmith. Collected 2026-07-22.