Tor Security Best Practices

1. Never use Tor and non-Tor browsers simultaneously — Correlation attacks can link your Tor and non-Tor activities by timing.
2. Never log into personal accounts — One login to your real Gmail through Tor links your anonymous session to your identity.
3. Keep Tor Browser at default window size — Resizing creates a unique fingerprint. Tor Browser starts at a specific size to blend in.
4. Don't install browser extensions — Extensions change your fingerprint and may leak data outside Tor.
5. Use the highest security level you can tolerate — "Safest" disables JavaScript, which is the #1 de-anonymization vector.
6. Never open downloaded files while connected — PDFs, DOCs, and other files can make external connections that reveal your IP.

• Use VPN + Tor — Connect to a VPN first, then Tor. Your ISP can't see you use Tor.
• Use Tails or Whonix — Full OS-level protection instead of just browser-level.
• Separate identities completely — Each anonymous identity should use different circuits, different sessions, different behavioral patterns.
• Be aware of writing style analysis — Stylometry can identify you by how you write. Vary your style for different identities.
• Use cryptocurrency for payments — Monero (XMR) is preferred for privacy. Bitcoin is pseudonymous, not anonymous.

• Traffic correlation — An attacker watching both ends of your connection can correlate timing. Use VPN to prevent ISP-side observation.
• JavaScript exploits — Malicious JavaScript can reveal your real IP. Use "Safest" security level.
• Browser fingerprinting — Window size, installed fonts, timezone, and other browser properties can identify you. Don't modify Tor Browser.
• Behavior patterns — Logging in at the same time every day, using the same phrases, or accessing the same sites creates patterns.

If you're running a .onion service, server-side security is equally important. AnubizHost provides hardened Tor hosting with IP leak prevention, DDoS protection, and offshore jurisdiction — so your service is as secure as your browsing.