NulNetHow to Host a Website Anonymously — the 2026 Walkthrough
Five links decide it: registrar, payment, DNS, host, content habits. XMR invoice, neutral records, keys-only SSH — walk the chain in order.
长文正文为英文。页头、目录与结账已翻译。
VPS from $3* (fund $50+), storage 1–5 TB NVMe from $24/mo annual-eff, dedicated with IPMI from $30.80/mo. Crypto invoice, no KYC.
Launch nowThe five-link chain
Five links de-anonymize a website: domain registration, payment, DNS records, the hosting account, and content habits. Each link is fixable — in order.
| Link | Risk | Fix |
|---|---|---|
| Domain | WHOIS + registrar KYC | Proxy registrar (Njalla) or privacy-whois + crypto |
| Payment | Card trails | Monero invoice — NulNet is crypto-only |
| DNS | Named nameservers leak you | Registrar DNS or self-hosted; neutral labels |
| Hosting account | Email reuse | Dedicated alias, used for nothing else |
| Content | Style, schedule, metadata | Clean files, no EXIF, no admin pages leaking versions |
The build, step by step
- Register the domain at a privacy registrar, paid in XMR — or skip the domain altogether when a raw IP or an onion service fits.
- Provision a NulNet VPS: email alias, XMR invoice, about 60 s to SSH.
- Install the stack (Caddy or Nginx + static site or CMS); put TLS via Let’s Encrypt on it from day one.
- Point DNS with neutral record names; set a generic PTR.
- Harden: keys-only SSH, a default-deny firewall, unattended updates — the checklist takes 20 minutes.
Where to host it
Reykjavik suits speech-heavy projects; Zurich suits Swiss-process needs; both bill under the same SKN contract. See the jurisdiction ranking.
The anonymous site stack — DNS through TLS
Anonymous hosting is a chain: private email, XMR payment, a neutral hostname, a privacy registrar (or onion-only), and a hardened reverse proxy. Sentry ($7.50) drives Caddy or nginx plus a static site or small CMS without strain. Reykjavik or Zurich for the flag. Keep your legal name out of WHOIS, TLS org fields, and HTML footers when that is the threat model.
Favor static or minimal dynamic surface. Keep admin panels off the public hostname. Reach deploy over Tor or VPN. A CDN up front can shield the origin IP — and opens another vendor relationship demanding evaluation. Readers, analytics scripts, and payment processors embedded in the site can re-identify you even with a spotless VPS file.
Opsec runs end to end. The VPS is one link; content, payment buttons, and support mailboxes are the others. Plan them before launch day.
Launch checklist: privacy email, XMR invoice, Reykjavik or Zurich flag, Debian, Caddy with automatic HTTPS only after DNS is deliberate, security headers, no third-party analytics by default, and an admin path reachable solely over WireGuard. Choose static generators wherever content allows. A CMS, when unavoidable, gets isolated and patched weekly. The anonymous VPS is wasted when the donate button routes through a KYC'd processor mirroring your passport.
Operational footnote: ship static when possible, patch the CMS when not, and keep legal names out of TLS fields for show. Sentry at $7.50 on the Reykjavik or Zurich flag, XMR invoice, privacy DNS or none at all. Analytics and donate processors undo anonymity faster than any host policy — vet those vendors with the same care as the VPS.
Final note: anonymous sites break at DNS, analytics, and donate buttons more often than at VPS signup. Sentry $7.50, XMR, Reykjavik or Zurich, static preferred, admin over VPN, no legal names in TLS. Plan vendors end to end. The host can decline KYC; it cannot decline your decision to embed a tracking pixel that carries your name.
Ship the headers, patch the CMS you truly need, and keep staging off the public hostname. Fifteen minutes of hardening after provision prevents months of cleanup.
Site anonymity limits
We rent KVM without documents. Screenshots, style correlation, and payment processors demanding KYC on donations sit outside our reach.
Content and vendor decisions that undo a private VPS
Once Sentry ($7.50) runs in Reykjavik or Zurich on XMR, audit the site itself: no legal names in footers or TLS org fields, no KYC'd donate processors when that breaks the model, no third-party analytics by default. Prefer static generators; a CMS, when unavoidable, gets admin isolated over WireGuard and weekly patches. The VPS can decline documents; embedded trackers can still carry your name.
Recommended setup
Plan: Sentry — $7.50/mo (2 vCPU/4 GB carries a hardened Caddy + static or small CMS with ease). Scout (from $3*) if the site is tiny. Location: Reykjavik. Payment: Monero.
Anonymous website hosting from $3*.
Launch nowMore rankings and guides
- How to buy an anonymous VPS
- Anonymous VPS opsec guide
- Best clean-IP anonymous VPS
- Best port 25 VPS
- Best privacy jurisdictions 2026
- Full opsec checklist
Is anonymous hosting legal?
Yes. Privacy itself is lawful; content must still obey criminal law and the AUP (no CSAM/phishing/spam).
Do I need Tor?
Not necessarily — XMR hosting plus a privacy registrar already strips the obvious links. Tor/onion adds a layer when the audience can reach it.
Can I use WordPress?
It runs, but every plugin widens the surface: keep the set minimal, patch on automation, and isolate the admin path behind your VPN.
Is a domain required?
No - an IP or onion service works; domains are convenience carrying history risk.
WordPress or static?
Static shrinks attack surface; WordPress demands relentless patching if chosen.
Ready to launch?
Build the box — VPS, storage or bare metal — create the password, pay the invoice that follows.