Content-Security-Policy Adoption on Ukrainian Corporate Websites (2025)

Content-Security-Policy (CSP) is a browser-enforced HTTP header that helps mitigate cross-sitescripting (XSS), one of the most persistent classes of web application vulnerabilities. This studymeasures the real-world adoption of CSP among Ukrainian small and medium-sized businesswebsites in the .com.ua domain zone. HTTP response headers of 83 business websites wereanalyzed for the presence of a CSP header. 10 sites (12%) returned a CSP header. At 12%, theobserved adoption rate is nearly double the historical 2020 internet-wide baseline (6-7%), yetremains roughly half the rate of top global sites (24.5%).