OpSec is habits, not products
Operational security — OpSec — is the discipline of not leaking the information that connects your anonymous activity to your real identity. It is worth being clear about what it is and is not. OpSec is not a product you buy or a tool you install. The best no-KYC, offshore, crypto-paid server in the world will not keep you anonymous if you SSH into it from your home connection while logged into a personal account. OpSec is the set of habits around the tools.
The reason habits matter more than tools is that deanonymisation almost never comes from breaking encryption or defeating a privacy technology. It comes from a single human mistake — one connection from the wrong IP, one reused username, one careless detail — that links the anonymous side of your life to the named side. This guide is about the mistakes that do the damage and the habits that prevent them. It assumes you run a server you want kept separate from your identity, and it covers how to actually keep it that way.
Build the setup on an anonymous foundation
OpSec is much easier when the foundation has no identity baked into it from the start. Several of our other guides cover the layers in detail; here is how they fit together as a base:
- An identity-free account. A no-KYC host issues you a token, not an account tied to a name, email or phone. There is nothing for the provider to leak or be compelled to disclose.
- A payment that carries no name. Crypto — Monero for no traceable record, or Bitcoin from a fresh address — so the purchase does not reconnect the account to you.
- An offshore jurisdiction. Chosen for no data retention and limited cooperation channels, so that even a determined request faces real friction.
Get the foundation right and OpSec becomes a matter of not introducing identity afterwards — which is far easier than trying to scrub it out later. Start anonymous; stay anonymous.
The connection is the most common leak
If there is one mistake that deanonymises more people than any other, it is this: connecting to the anonymous server from an identifying IP address. Your home internet connection is registered to you. The moment you SSH to your anonymous server directly from it, your ISP's logs hold a record linking you to that server — and the perfect no-KYC setup is undone by the connection to it.
The rule is absolute: never touch the anonymous server from an IP that traces to you. Reach it over Tor, or through a separate VPN that is itself anonymous, every single time — not usually, every time. A single direct connection, made once in a hurry, is enough. The same applies to everything you do for the project: registering accounts, downloading tools, testing the site. If the connection can be traced to you, it does not matter how anonymous the destination is. Treat your real IP as something the anonymous project must never see.
Compartmentalise ruthlessly
Compartmentalisation means keeping the anonymous identity and the real identity in sealed, separate boxes that never touch. It is the single most powerful OpSec habit, because most deanonymisation is a bridge accidentally built between two compartments.
- Separate everything that can carry identity. Use a different browser — ideally a different user profile, or a dedicated virtual machine — for the anonymous project. Never log into a personal email, social account, or anything tied to your name in the same session you use for it.
- Never reuse names. A username, handle or avatar reused between an anonymous project and an identified account is a direct link. Each compartment gets its own, used nowhere else.
- Do not cross-reference. Do not mention the anonymous project from a named account, or your named life from the anonymous one. Even a small, true detail — a city, a job, a distinctive phrasing — narrows the field.
- One project, one compartment. If you run several anonymous projects, keep them separate from each other too, so a problem with one does not expose the rest.
The discipline is to make the wall automatic — to never have to remember it, because the browser, the session and the identities are simply always separate.
Watch what the server and its software reveal
A server tells the world things even when you are careful about how you reach it. The leaks worth auditing:
- Banners and headers. Web servers, mail servers and SSH announce versions and sometimes hostnames by default. Trim what they advertise.
- Default pages and errors. A default error page or test page can reveal software, configuration, or that two sites share a server. Replace the defaults.
- Metadata in files. Images and documents carry metadata — device, software, sometimes location. Strip it before anything is uploaded.
- Software that phones home. Analytics, external fonts, update pingbacks and third-party APIs make outbound connections that can link the server to other properties or leak its real address. Keep an anonymous project self-contained.
- Correlation across sites. The same analytics ID, ad account, TLS certificate or favicon used on an anonymous site and an identified one ties them together. Share nothing between compartments.
The principle is to ask, for everything the server emits, what does this tell an observer — and to remove anything that answers with your identity.
Payment and renewal discipline
Anonymity is not a one-time setup; it has to survive every renewal. A server bought anonymously but renewed a year later with a card undoes itself at the renewal. Keep the money side as disciplined as the rest: pay renewals the same anonymous way you paid the first time, in crypto. A practical habit is to keep the no-KYC account topped up with a crypto balance, so renewals draw down silently and you are not making a fresh, attention-drawing payment on a schedule. The same applies to a domain — renew it through the same anonymous channel, never with a card added just this once.
The mindset: consistency over intensity
The thread running through all of this is that OpSec is about consistency, not intensity. It is not about a single heroic effort to be anonymous; it is about never being the exception. One connection from home, one reused handle, one renewal on a card, one personal login in the wrong browser tab — any single lapse can be the link, and no amount of care elsewhere undoes it.
That sounds demanding, but in practice it becomes routine. Set the foundation up anonymously, build the compartments once, make the separate browser and the Tor connection your default, and the discipline runs itself. The goal is not paranoia — it is a setup where staying anonymous is simply how the project works, with no exceptions to remember. Build it that way, and an anonymous server stays anonymous not because you are careful every day, but because there is no path by which it could be anything else.