Anonymous website hostingThe host is one link. Eight others are yours to close.

Anonymity is a property of the chain, not of the supplier

Somebody who wants to know who runs your site does not begin by subpoenaing your host. They begin with a browser, because eight of the nine links in the chain publish something, and most sites are undone by one of those long before a lawyer is involved.

This is written by the one link that can speak about itself with evidence: what is collected here is published as an inventory rather than described as a value. The other eight are not ours — four belong to other companies and four belong to you — and that is exactly why they are the ones worth reading about.

The nine links, and who holds each one

Every row below is a place where a name, an address or a payment can come to rest. The third column is the one that matters: for eight of the nine, the answer is not your host.

The naming layer, and the logs nobody can delete

Three of the nine sit between a name and a machine, and they are the three that keep records you cannot reach. They are also the three most people get wrong, because all three feel like plumbing rather than like disclosure.

The registration, and what privacy does not cover

A server is a machine in a rack. A domain is a contract, and a contract has a counterparty who was paid by somebody. Privacy services replace your details in the public record with a forwarding address; they do not remove them from the registrar, which still holds a name, an address and a payment method, and which answers a court in its own jurisdiction rather than in yours.

They also do nothing about the past. Historical registration data has been archived commercially for two decades, so a domain registered in the clear and made private four years later is a domain whose owner is on record. Switching privacy on is a change to the present tense only.

Certificate transparency, which is permanent by design

Every certificate a publicly trusted authority issues is written to an append-only public log. That is deliberate and it is a good thing: it is how a mis-issued certificate for your domain becomes visible instead of staying secret. The side effect is that every hostname you have ever put on a certificate is searchable by anybody, for ever, and cannot be withdrawn.

This is how staging, vpn and old-project subdomains are found — not by guessing, but by reading a public log that was built to be read. A wildcard certificate publishes one name in place of a list, which is the closest thing to a remedy that exists.

Passive DNS, which remembers where the site used to live

Resolvers and scanners record which name answered with which address and when, and sell the history. A record you deleted a year ago is still evidence of the machine it pointed at, which is why moving a site behind a proxy after it has been live in the open protects the future and not the past.

The origin address leaks around the proxy

A CDN in front of a server hides the origin from a casual visitor and from nobody else, because the address is usually published somewhere the proxy does not control. These are the six routes, in the order they actually get used:

1. DNS records from before the proxy existed, still sitting in a passive-DNS archive.
2. A subdomain nobody proxied: mail, dev, webmail, direct, cpanel.
3. The mail path — an MX record, an SPF entry, or a Received: header naming the machine that sent the message.
4. A certificate issued on the origin itself and logged before the proxy was configured.
5. Anything the application sends outbound: a webhook, a password-reset mail, an image fetched from a URL a stranger supplied.
6. Internet-wide scanners, which index every address on every port and let anybody search for a machine whose certificate, response headers or favicon match yours.

The last one is why a proxy is a half-measure on its own. What turns it into a boundary is the origin refusing every connection that does not come from the proxy’s published ranges — a firewall rule rather than a product, and the shortest paragraph on this page with the largest effect.

What you publish carries more than you wrote

The content is the part you control completely, and it is where first attempts usually fail, because the metadata is put there by tools rather than by you.

• Photographs. Camera model, serial number, editing software, and often the coordinates where the shutter was pressed.
• Documents. A PDF carries an author field and a producer string; an office file carries an author, a company and a revision history.
• Repositories. Every commit is stamped with a name and an email address, and a public repository publishes all of them, for every commit, permanently.
• Build output. Source maps, dependency manifests and stack traces name paths, usernames and internal hostnames.
• The platform itself. A default installation will happily expose an author list, a login page, a version string and a feed you never asked it to publish.
• Analytics and advertising tags. The same measurement identifier on two sites is the cheapest possible proof that one person runs both, and public tools do that lookup at scale.

The habits that undo everything else

Every control above can be defeated by the same person doing something ordinary, and the list does not change: an address reused from another life, a username that is searchable, a password that has appeared in a breach, an administrative login from a home connection, and money that traces back to an account opened with a passport.

That last one is why how you pay matters at least as much as whether the signup form asked for a name. A host holding no identity record, paid from an exchange account in your name, has produced the chain anyway — it simply lives in somebody else’s database.

And the oldest one, which no host can price and no configuration can protect: telling somebody. Anonymity that depends on another person keeping it is a schedule rather than a property.

What a host can do, and where it stops

Being exact about scope is worth more than a claim. What happens on this side is a matter of record rather than of intention:

• No identity document is collected at signup or at any point afterwards, at any spend level. The complete inventory of what is held is in the privacy and logging policy.
• Settlement is on-chain only, so no card processor sits behind the account keeping its own record of you.
• Access logs are destroyed on a 24-hour timer, and there is no netflow, no IP history and no device fingerprint that could join an address to an account after that.
• What a valid order actually produces is written down in advance in the law-enforcement guide, and the count of what has arrived is in the transparency report.

And the part that is not ours to give: no host can make a registrar forget you, remove a name from a transparency log, un-publish a DNS record from 2021, strip the author field out of a document you uploaded, or stop you signing in from home. Eight of the nine links sit outside the contract, which is the reason this is a guide and not a sales page.

A ten-minute audit, in the order to run it

Nothing below needs a tool you have to buy, and each step tells you something the one before it did not.

1. Look the domain up in a historical registration archive, not only in the live record — and look up every other domain registered with the same address.
2. Search a certificate transparency log for your domain and read every hostname it returns. Decide, for each one, whether you meant to publish it.
3. Query passive DNS for the domain and list every address it has resolved to in its life.
4. Resolve every subdomain those two steps found, and check whether any of them answers on the real origin.
5. Send yourself mail from the site and read the full headers, including every Received: line.
6. Search an internet-wide scanner for the origin address, and again for your certificate’s fingerprint.
7. Download three files you published — an image, a document, an archive — and read their metadata.
8. If any repository is public, list the distinct author addresses in its history.
9. Search your username and your account address as quoted strings, on an engine you are not signed in to.
10. Write down what you found, then fix what can still be fixed. Transparency logs and passive DNS are not on that list, which is why they are steps two and three rather than steps nine and ten.

Three things that are not worth doing

• Falsifying the registration. It is the one countermeasure with a published penalty attached: inaccurate registration data is grounds for a registrar to suspend the domain, and it acts on a complaint rather than on a court order.
• Serving a public site over Tor alone. An onion service is the right answer when the audience will install a browser for you, and the wrong one when the audience is everybody, because it removes the reach that made the site worth protecting.
• Buying “anonymous” hosting that takes cards. The processor imposes identification on the merchant and the merchant passes it down, eventually. That reasoning is set out in the guide on what no-KYC actually means.

Questions people actually ask

Every price on this estate is published in full, in one place. See the whole catalogue