5 months running my own onion site. Here's what i wish someone had told me
Launched my first hidden service about 6 months ago after only ever building clearnet stuff. Learned a bunch of things the hard way that nobody really tells you upfront, so here's the honest version.
The tech is way less special than i expected
This surprised me the most. I built it up in my head like onion hosting was some dark art. Its not. Its basically the same stack as a normal site, same web server, same input validation, same everything you'd do to secure any site. The onion part is just how its reached. If you can build a secure clearnet site, you can build an onion site, its genuinely almost identical.
The one real difference in practice is more of your visitors have javascript disabled, so if your site falls apart without JS you're gonna lose people. Build it to work without JS from the start.
The hard part isnt building it, its being found
This is the thing i completely underestimated. On the clearnet you have google. Here theres no crawler ranking you, no SEO in any normal sense. Nobody is going to stumble onto your site.
Discovery happens through directories, wikis, curated link lists and word of mouth. Getting listed in the right places is basically the entire game. I spent way too long polishing the site before realizing nobody could find it. Should have thought about discoverability from day one.
Your address is unreadable and thats a real problem
The v3 onion address is a huge random string. Nobody types it, nobody remembers it, nobody can tell a real one from a fake one at a glance. I used mkp224o to grind out a vanity address that at least starts with a recognizable word, which helps a little, but its still mostly gibberish after that. So people relying on links from places they already trust matters a lot. Your reputation and where you're linked from is your whole identity here.
Uptime and not leaking your IP are the two things that actually bite you
Two lessons that cost me some pain.
First, uptime. If your host goes down your onion is just gone, no cached version, nothing. So where you run it matters more than on the clearnet. I went through a couple options before settling, tried running it at home first (dont, your home connection and a dynamic setup will fight you), then landed on a proper always-on host. For anyone piecing a setup together, the parts that mattered for me were a stable always-on server, a host that doesnt care about tor traffic and keeps no logs, im on privatealps the tor daemon itself, Vanguards running to protect against guard discovery attacks, and a hardened web server. Nothing exotic, just the standard hidden service hygiene.
Second, leaking your real server IP. This is the classic footgun. If your server also answers clearnet requests, or leaks its IP in headers or error pages, the whole point of the hidden service is gone. Make sure it only talks through tor and doesnt respond on the clearnet at all. Worth triple checking this one.
What id tell someone starting now
Dont overthink the tech, its normal web dev. Think about discoverability from day one, not after. Build without JS. And nail your uptime and your IP hygiene before you worry about anything fancy.
Its a fun thing to run honestly, you learn a lot. Anyone else here hosting their own, what caught you off guard when you started? Curious if others hit the same walls.