VPS opsec mistakes and how to avoid them.

Identity reuse

• The same username, email or avatar used elsewhere.
• A writing style or signature phrase carried between identities.
• Personal contact details in WHOIS, a certificate or a page footer.

Connection leaks

See hide your origin IP and VPS vs VPN.

• Logging into the server or admin panel from your home IP while the site is meant to be separate.
• A DNS record or certificate that points straight at the origin.
• Mixing personal and project browsing in one browser profile.

Payment leaks

Read how payment works and paying with Monero.

• Paying from an exchange account tied to your ID.
• Sending the exact payment from a wallet used for other things.
• Reusing one address on a public chain.

Metadata and files

• Photos with location data in them.
• Documents with author and company fields.
• Backups with personal files included.

Server hygiene

Fix these with the hardening checklist and SSH keys and fail2ban.

• Weak SSH setup and no updates.
• Open database and admin ports.
• Secrets in a public repository.

A quick pre-launch check

1. Search your own identity details against the site.
2. Check WHOIS and certificate fields.
3. Check which IP your DNS reveals.
4. Confirm which device and network you log in from.
5. Review what is on the server that should not be.

Common questions