Tor onion service on a VPS.

Why use one

• Reach a service without exposing the server's IP in DNS.
• Put admin panels behind Tor so they are not reachable from the open internet.
• Offer your site to people who browse over Tor.

Install Tor and a web server

apt update && apt install -y tor nginx

Bind the web server to localhost

Make nginx listen only on 127.0.0.1:8080 so the site is not directly reachable from the internet.

# /etc/nginx/conf.d/onion.conf
server { listen 127.0.0.1:8080; root /var/www/html; }

Configure the hidden service

The hostname file contains your .onion address. Back up the key files in the same directory. Whoever holds them controls the address.

# /etc/tor/torrc
HiddenServiceDir /var/lib/tor/my_site/
HiddenServicePort 80 127.0.0.1:8080

systemctl restart tor
cat /var/lib/tor/my_site/hostname

Test it

Open the address in Tor Browser. If it loads, the service is live.

Stay private

• Do not serve content that mentions your clearnet IP.
• Keep software patched. See the hardening checklist.
• Remember the host can still see that the VPS exists. An onion service hides the address, not the server from its provider.

Operational notes

• An onion service hides the server's network location from visitors, not what the site publishes.
• Keep the hidden service directory private and back up the keys.
• Do not run the same site on a clearnet address with identifying details.

Common questions