The Full Opsec Checklist for an Anonymous Server — 12 Items

The complete anonymous-server opsec checklist: account, access, network, data and payment discipline — 12 concrete items, each doable in under an hour.

Published 2026-08-30 · Updated 2026-10-21 · BitCloudVPS Editorial

The checklist

1. Dedicated email alias for the hosting account — used nowhere else.
2. Monero payments from self-custody; never exchange-withdrawals straight to invoices.
3. SSH keys only; password auth off; named sudo user, not root.
4. Default-deny firewall: 22 (moved), 80/443, service ports only.
5. fail2ban + moved SSH port: log noise drops an order of magnitude.
6. Unattended security upgrades on the base OS.
7. 2FA on the hosting panel — the panel is attack surface too.
8. Panel over Tor/VPN if local observers are in your threat model.
9. Neutral PTR/DNS: no names, no patterns in record labels.
10. LUKS container for data at rest (see the encryption guide).
11. Off-box encrypted backups — Restic/Borg to a Storage VPS.
12. Monthly review: canary check, DNS audit, credential rotation.

The matrix of failures

Where each item lives

Hosting-side, BitCloudVPS already gives: no documents, crypto-only billing, editable PTR, no traffic logs (≤24 h connection metadata). The other eight items are yours — each links to a guide on this site.

Full checklist - buy through first month

1. Dedicated privacy email; unique password; 2FA.
2. Checkout via Tor/VPN if local observers matter.
3. Privacy flag (IS/CH) unless latency model says otherwise.
4. Pay XMR from self-custody; exact amount; one tx.
5. SSH keys only; disable passwords; firewall default-deny.
6. Neutral PTR; privacy DNS or none.
7. Unattended upgrades; snapshot before risky changes.
8. Encrypted offsite backups; test restore.
9. Separate admin device habits from daily browsing.
10. Re-read limits page; check warrant canary monthly.

Plus ($10.80) in Zurich is the default room-to-split-services build; Starter works if the checklist is followed ruthlessly on one service. Completing a list once is not opsec - schedules and renewals are where people slip.

Print the list or keep it in an encrypted note. Blog posts you skimmed once will not save you at renewal time.

Month-two additions: verify backup restore to a second location, rotate SSH keys if any laptop left your control, confirm 2FA recovery codes still exist offline, and re-read the limits page after you feel comfortable - comfort is when leaks creep in. Plus in Zurich at $10.80 remains the balanced default. If the checklist feels long, that is the cost of private infrastructure; there is no shorter honest version.

Operational footnote: renewals and restores are where checklists fail. Keep Plus in Zurich ($10.80) as the default, XMR for payments, Tor or VPN to the panel, and a tested backup. Re-read limits when you feel safe. Private infrastructure is a practice, not a purchase.

Final note: checklists die at renewal and restore time. Plus $10.80 Zurich, XMR, Tor or VPN to panel, tested backups, quarterly drills, limits page reread when comfortable. Private infrastructure is practice. There is no shorter honest list.

Store 2FA recovery offline. Name servers generically in password managers. If the alias provider account dies, treat the panel as burned and migrate. Boredom is the skill.

Checklist arrogance

High-risk nation-state models need specialist advice beyond a VPS article. This checklist is a solid baseline for lawful private infrastructure, not a cosplay shield.

Month-two controls after the honeymoon

After the first renewals: restore a snapshot to a second flag, rotate SSH keys if any laptop left your control, confirm 2FA recovery still exists offline, and re-read limits while comfortable. Plus ($10.80) in Zurich remains the balanced default; XMR for payments; Tor or VPN to the panel. Checklists fail at renewal and restore - schedule those drills or the day-one work evaporates.

Month-two proofs, not just day-one ticks

After the twelve items are green once, prove them again: restore a backup to a second datacenter, rotate panel 2FA, verify the canary date, and re-check PTR for name leaks. Plus ($10.80) in Zurich is the usual checklist home; Starter works if you run one service ruthlessly. Schedules beat blog posts you skimmed once.

Recommended setup

Plan: Plus — 4 vCPU/8 GB, room for the LUKS container and backup tooling, $10.80/mo. Location: Zurich. Pair with the opsec guide and its honest limits.

More rankings and guides

• Anonymous VPS opsec guide
• Limits of no-KYC anonymity
• How to buy an anonymous VPS
• How to pay a VPS with Monero
• Best privacy jurisdictions 2026
• VPS for a privacy tools stack

Budgeting the stack without leaving a paper trail

Every control on the checklist has a price, and paying with a card defeats the point of the control. The checkout accepts 19 crypto assets, so the cheapest compliant stack stays fully unlinked to your identity: a Nano VPS at the flat $36/yr annual rate (an effective $3/mo) is enough for a hardened relay or proxy box, while a Starter plan at $8.50/mo (2 vCPU EPYC 7443P, 4 GB ECC RAM, 60 GB NVMe) carries the actual workload. If you upgrade later, renewal happens in the same token-only flow — no re-KYC step exists to fail.

• Pay quarter or year: periods are month (list price), quarter −10%, year −20%, so the annual term effectively halves the per-month cost of the Starter tier.
• Keep the asset choice consistent. Mixing BTC one month and USDT-TRC-20 the next creates correlations a ledger analyst can join; a single funding path is simpler to reason about.
• Track your own spend off-box. A server that bills itself forever is a server nobody remembers to destroy — the checklist ends when you decommission it.

Threat-model the checklist before you run it

A checklist applied without a threat model produces busywork with gaps in exactly the wrong places. Before the twelve items, answer three questions in writing. Who do you expect to correlate your activity — a commercial tracker, a platform's abuse desk, a state actor, or simply your own future mistake? What is the blast radius if one layer fails — embarrassment, account loss, or physical safety? And what is your renewal horizon — a server you plan to keep for years needs different durability than a two-week operation. The checklist items then fall into place: Tor-only admin paths matter against network observers, token-only signup matters against subpoenas to the host, and payment hygiene matters against chain analysis.

Map each layer to its failure mode rather than treating the list as a ritual. Signup hygiene (token account, optional email left empty) fails if you later add a personal email for convenience — the host-side record becomes a link, and links are forever. Payment hygiene fails not at checkout but at the exchange where the coins were bought with a verified account; an XMR payment from a KYC exchange wallet ties a real name to the invoice in that exchange's records even though our checkout never asks. Operational hygiene fails through SSH from a home IP, through a domain registered with real WHOIS data, through a browser session where you log into the panel and your personal mail in the same window.

Write the model down and keep it offline. Every section below — the buy, month two, the quarterly audit — assumes you know which adversary you are spending effort on. A checklist without a model is twelve locks on a door whose location you posted publicly.

Paying for the stack so the invoices do not cross-link

The billing side of an anonymous stack deserves its own discipline, because invoices accumulate. Each payment is a public-chain event with an amount, an address and a timestamp; a year of monthly invoices is twelve correlation points for anyone watching the chain. Three practices shrink that surface. First, pay long terms: the annual bill takes −20% off and collapses twelve events into one — a Starter year is $81.60 paid once, Business is $288 once. Second, use XMR when the graph itself is the concern, or USDT on TRC-20 when fees dominate; both are in the 19-asset checkout alongside BTC, LTC, DOGE and the rest. Third, never reuse the same wallet across projects — one wallet per server keeps the UTXO graph from braiding your identities together.

The fund-account bonus tiers are the one billing feature that cuts both ways, and the honest checklist says so. A $1,000 top-up adds +10% in credit and $2,000 adds +40%, which is the cheapest way to prepay a long deployment — $2,000 becomes $2,800 of hosting. But a large balance is also a larger single record on whatever chain funded it, and a longer claim on the account. Fund big only when the funding path itself is clean (coins acquired without a verified identity), and only for workloads you intend to keep. A two-week op does not need a $2,000 balance; it needs one correct XMR transaction.

Renewals close the loop. Set a panel reminder before the term ends and pay from the same clean path you used initially — a lapsed renewal paid in a panic from a KYC exchange app undoes a year of discipline in one tap.

The quarterly audit: re-running the checklist on a live server

Checklists decay, so the opsec guide that matters is the one you re-run. Every quarter, walk the original twelve items against the live server and record drift. Verify the admin path still starts from Tor or a dedicated jump box, not from whatever convenience shortcut appeared in month five. Check SSH: keys only, no password auth, root login disabled, and the authorized_keys file actually containing the keys you think it does — a teammate's "temporary" key is the classic leak. Review listening ports with ss -tulpn and compare against the intended service list; an unnoticed panel daemon or a forgotten test listener is a door you did not plan. Confirm automatic updates actually applied with the package manager's log, because a silent failure in unattended-upgrades leaves known CVEs open for months.

Then audit the identity layers, which drift faster than the technical ones. Has any DNS record started pointing at a registrar account with your real data? Did a Let's Encrypt registration email get attached to a personal mailbox? Are the server's outbound habits still what they were — a cron job that started resolving a personal sync service is a correlation beacon. On the billing side, confirm the next renewal is funded from the clean path, and that no card or verified wallet has drifted into the payment flow.

Finish with a rebuild rehearsal: prove you can stand the server up again from your notes in under an hour. The cheapest audit is the one where you discover, in a calm quarter, that your restore procedure is fiction — while it is still fiction on your schedule and not an attacker's.

Where the limits are (October 2026)

Keep the threat model precise. Anonymous-adjacent hosting removes the host-side identity trail: token-only signup, optional email, no KYC review, crypto invoices that record a txid rather than a name. It does not blind the host to traffic it must carry, it does not make a logged-in panel session anonymous, and it does not protect workloads that identify themselves — an admin login from your home IP defeats the whole design. Exact limits of no-KYC anonymity. OPSEC guide. Full checklist. Payment-side note: chain analysis happens on public blockchains, not at the host. Coin choice and network choice are your OPSEC knobs, and the checkout keeps 19 of them open.