How can I host a website without revealing who I am?

Can my payment identify me?

Yes, if the coins trace back to you. bitcoin.org states that all Bitcoin transactions are public, traceable and permanently stored, and that anyone can see the balance and transactions of any address. The host never sees your name in the payment. Anyone who follows the coins can still reach where they came from.

To reduce it, start with the source: a payment is only as separate from your name as the wallet that sent it. bitcoin.org also advises a new address for each payment you receive. That matters if your site takes crypto: one address printed on the page links every payment to it.

Velumhold keeps a record of each top-up for billing, listed below. It does not ask who you are.

Does my domain name reveal who I am?

It can. ICANN tells registrants to give accurate information for directories such as WHOIS and to keep it current. What the public sees is a separate matter.

Since 28 January 2025, RDAP is the definitive source for generic top-level domain data, in place of WHOIS, per ICANN. Its Registration Data Policy, effective 21 August 2025, requires redaction of personal data where the law requires it. Registrant name, street, postal code and phone are on its redaction list, and registries must redact registrant and technical emails. Registrant organization and city may be redacted, but need not be. ICANN's registrant page also mentions registrations made through privacy or proxy services.

To reduce it, choose a registrar for what it publishes, look up your own record after you register, and enter no false data. Velumhold changes none of this: Domains are not sold here: point a domain you own to the account with two nameservers or an A record. What private web hosting hides covers the other layers.

Can my email address give me away?

Yes, in three places: the contact address in your domain's record, the address printed on your site, and the headers of the messages you send.

On headers, the email standard RFC 5321 says the Received line that a mail server adds should include the IP address of the machine that connected to it. A message can therefore carry the address of the connection it came from, depending on the mail service.

Even hosts that skip ID usually want an email. According to Velumhold's survey of 2 November 2026, all 4 shared-hosting sellers with no ID check at signup ask for an email address.

To reduce it, use a separate address on the site's own domain (how to get email on your own domain). Send yourself a test message from each account and read its full headers before you rely on it. At Velumhold: Email accounts on your own domain with webmail, IMAP and SMTP; outgoing mail is rate-limited to keep spam off the servers. The account email is optional: Your account number alone signs you in; an email address is yours to add or to leave out.

What do the server's IP address and logs reveal?

The IP address names the host, not you. The logs name your visitors. Your domain's A record points to the server's address. IP network registrations are public through RDAP, served by the regional registries (RFC 9083), so the owner of the network is easy to find.

Logs are the other half. The Apache documentation says the access log records all requests the server processes, and its common format includes the client IP address. Recital 30 of the GDPR lists IP addresses among the online identifiers that can help identify people.

To reduce it, switch off the access logs you do not need. At Velumhold: We keep no logs of who you are: no connection records of the dashboard and no IP addresses of customers. The web server keeps the access logs of your own sites in your account, for you, and you can switch them off.

Can my content and analytics identify me?

Yes, often by accident. Four common leaks:

• WordPress names. The profile screen offers “Display name publicly as”, which defaults to your first and last name. The username often appears in author archive URLs, and no one can edit it later. The REST API's default user view lists name, slug and author link, and a plugin description says anyone can request /wp-json/wp/v2/users by default.
• Photos. Apple says location coordinates are embedded in photo files, and people you share with may see where each was taken. Remove the location before you upload.
• Scripts and fonts. An analytics script, font or embed is loaded from another company's server. Load only what you need.
• Your own words. A bio, a signature or an unusual phrase can name you like a form field. Read your pages as a stranger would.

Before you publish, set a nickname and a display name that are not your name, and choose the administrator username with care. Pick “WordPress, installed” at checkout and the account arrives with WordPress set up on your domain; pick “Empty account” to upload your own site.

What do DNS records and certificates show?

They publish your domain and the server it points to. The records that point your domain to your server sit on name servers, which answer queries from resolvers (RFC 1034). Plan for them to be readable.

Certificates add a second public list. Let's Encrypt submits every certificate it issues to Certificate Transparency logs, which are append-only and open to queries from anyone. Its FAQ warns that crawlers then discover your domain. At Velumhold: Free SSL certificates (Let’s Encrypt), issued and renewed automatically for every domain on the account.

To reduce it, keep your name, your city and your company out of domain and subdomain names.

What does Velumhold do, and what does it not do?

It does:

• No KYC, at signup or at any later point: no ID, no selfie, no documents, no card, no phone number (web hosting without ID verification).
• Your account number alone signs you in; an email address is yours to add or to leave out.
• We keep no logs of who you are: no connection records of the dashboard and no IP addresses of customers. The web server keeps the access logs of your own sites in your account, for you, and you can switch them off.
• We hold only what billing and running your account need: the account number and an email if you add one; every top-up and order (amount, coin, network, transaction ID, date); and per hosting account its plan, term, location, starting point, SSH public key if you gave one, and dates. No record leaves us without an order from a Panamanian court.
• Domains are not sold here: point a domain you own to the account with two nameservers or an A record.

It does not:

• Hide a payment. A top-up sits on a public blockchain.
• Hide your domain's record. Your registrar decides what shows.
• Hide your site. A public site is public, and the access logs of your own sites stay in your account.
• Take Monero. It takes BTC, USDT, USDC, ETH, SOL, LTC.
• Promise that nobody can ever find out who you are. A court order can reach what we hold, as listed above.