markdown formatted blog content

Beyond the Clearnet: How to Self-Host Your Site on the Tor Network

Most developers think about hosting in straightforward terms—spin up a VPS, point a domain at it, and you're live. But what if you could host your site in a way that makes it nearly impossible to trace back to you, resistant to censorship, and accessible to anyone in the world without revealing your server's IP address?

That's exactly what the Tor network enables. And no, before you ask—this isn't about anything illicit. The Tor network is a privacy tool used by journalists, activists, researchers, and developers who value anonymity and freedom from surveillance. The Tor Project is a nonprofit organization dedicated to advancing human rights through free and open software. Running a hidden service on Tor is one of the most honest expressions of internet freedom there is.

In this guide, we'll walk through setting up your own .onion site, step by step. By the end, you'll have a fully functional hidden service reachable by anyone running the Tor Browser.

What is a Tor Hidden Service, Exactly?

Before we dive into configuration, let's demystify what's happening under the hood.

When you visit a regular website, your request travels across the internet through multiple routers and ISPs—each one can potentially log your activity. Tor works by routing your traffic through a distributed network of relays run by volunteers worldwide. Each relay only knows the previous and next hop in the chain, so no single node can trace a connection end-to-end.

A hidden service extends this model. Instead of a domain that resolves to a public IP address, you get a .onion address—a cryptographic identifier that routes traffic entirely within the Tor network. Your server's IP address never appears publicly. Visitors connect anonymously, and your infrastructure stays hidden. This is a fundamentally different security model than anything you get from traditional hosting.

Installing and Configuring Tor

First, you'll need Tor installed on your server. On most Linux distributions, this is a simple package installation:

sudo apt update
sudo apt install tor

Once installed, you configure Tor through its configuration file, typically located at /etc/tor/torrc. To set up a hidden service, add the following lines:

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:8080

A few important notes here. The HiddenServiceDir must be its own dedicated directory owned by the Tor process—not your web server's document root. Tor generates cryptographic keys and the .onion address inside this directory, and it should have restrictive permissions. The HiddenServicePort directive tells Tor to forward incoming connections on port 80 to a local port where your web server is listening.

Restart Tor to generate your address:

sudo systemctl restart tor
sudo cat /var/lib/tor/hidden_service/hostname

The output will be a long string ending in .onion. Copy this somewhere safe—you won't be able to recover it if you lose it. Consider generating a vanity onion address for easier sharing, though that process is significantly more compute-intensive.

Setting Up Your Web Server

Tor handles all the routing and encryption internally, so your web server doesn't need TLS certificates or any special protocol handling. It just needs to listen locally on the port Tor is forwarding to.

Here's an nginx configuration for your hidden service:

server {
    listen 127.0.0.1:8080;
    server_name your_onion_address.onion;

    root /var/www/hidden_site;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Notice that there's no SSL/TLS block, no redirect from HTTP to HTTPS, and no HTTP/2 or QUIC configuration. Tor provides its own encryption layer, so your web server speaks plain HTTP over localhost. This simplicity is actually a feature—fewer moving parts means a smaller attack surface.

Reload nginx after saving the config:

sudo systemctl reload nginx

At this point, your site is live on the Tor network. Open the Tor Browser, type in your .onion address, and you should see your site.

One Site, Two Builds

Here's a detail that catches many developers off guard: static site generators typically bake absolute URLs into your pages. If you build your site with a clearnet domain as the base URL, every link on your .onion site will redirect visitors back to the public internet—breaking the privacy chain you worked so hard to establish.

The solution is to build two versions of your site, each with its own base URL. If you're using a static site generator like Hugo, that's as simple as running the build twice with different parameters:

hugo --minify --baseURL="http://your_onion_address.onion/"

Your deployment pipeline can automate this—build once per target, sync each version to its respective web root, and you're done. This approach keeps both versions in sync automatically, so you never have to remember to update a separate Tor version manually.

Why Bother?

This is a fair question. For most projects, a standard web hosting setup with HTTPS is perfectly adequate. But self-hosting on Tor solves real problems for specific use cases:

• Journalists and whistleblowers need environments where sources can reach them without fear of surveillance.
• Developers in restrictive regions may face censorship that blocks their legitimate projects.
• Privacy-conscious users actively seek out .onion sites because they offer stronger anonymity guarantees.
• Redundancy and resilience — having a .onion address means your site stays accessible even if domain registrars or DNS providers are compromised or pressured.

If any of these scenarios resonate with your work, the Tor hidden service model is worth the setup effort.

Consider Running a Relay

The Tor network only functions because thousands of people contribute bandwidth by running relays. If you have spare server capacity, consider running a relay or even a bridge—it directly supports the privacy infrastructure that makes hidden services possible. The Tor Project's documentation makes relay setup straightforward, and even modest contributions matter when the network depends on collective participation.

Final Thoughts

Self-hosting on Tor is one of those projects that feels more intimidating than it actually is. The setup takes an hour or two, and the maintenance overhead is minimal. What you get in return is a unique address that's nearly impossible to censor, link to your identity, or take down through traditional means.

Whether you're building tools for journalists, hosting a project in a hostile jurisdiction, or simply exploring the frontier of decentralized hosting, the Tor network offers capabilities that no conventional hosting platform can match. And that matters more than ever.

Ready to go dark? Your .onion address is waiting.