People who get identified are seldom caught by a clever attack on the encryption. They are identified by links: the same username, the same email, the same IP, the same writing habits. Operational security (OpSec) is the discipline of removing those links. This is a practical checklist for anyone running a server who values privacy, whether for safety, business or principle.
1. Decide who you are hiding from
A competitor, a stalker, a hostile government and a bored scraper need very different defences. Write down your threat first, then spend effort where it matters. "Everyone" is not a threat model.
2. Keep identities separate
Use a distinct username, email address and password for each project. Never reuse a handle from a personal or older account. One shared detail is enough to join the dots.
3. Never log in from home without protection
Your home IP address is the strongest identifier you have. Reach the server through a VPN or Tor, and be consistent. A single direct login from your home connection is recorded in the provider's logs and your server's auth.log for good.
4. Pay in a way that matches your threat
Card and bank payments are tied to your name. Coins differ in how traceable they are, and exchanges ask for ID. Read crypto privacy basics and fund the account with coins that fit your goal.
5. Watch your metadata
- Documents and images carry author names and GPS data. Strip them before publishing.
- WHOIS records expose domain owners unless privacy is on. See buying a domain anonymously.
- TLS certificates are public. A certificate for a name you use elsewhere links the two.
6. Keep the server's public face minimal
Close every port you do not use, hide software versions and use a default virtual host that reveals nothing on a bare IP request. The UFW and fail2ban guide covers the steps.
7. Do not mix clear-web and hidden services
Running a public site and an onion service from the same machine invites correlation through timing, uptime and software banners. Use separate servers.
8. Handle email carefully
Mail headers show the sending IP. Send from a relay and not from the origin, and see self-hosting email do's and don'ts.
9. Back up and encrypt
An unencrypted backup in your personal cloud account undoes everything. Use encrypted backups and keep the keys apart from the data.
10. Remember your own habits
Posting at the same hours, using the same phrases and making the same typos all identify a person. Be aware of it, and do not talk about your project in places tied to your real name.
No setup makes you invisible, and no host can promise it. Aim to make identification costly and to avoid the easy mistakes above. For the limits, read how anonymous hosting really is.