WordPress on a Tor-only onion is the highest-risk configuration in this catalog because WordPress carries a substantial vulnerability surface. We still support it because the editor UX is irreplaceable for many publishers. Our setup minimizes the attack surface: PHP-FPM on unix socket, wp-admin IP-restricted to localhost (accessed via SSH-over-Tor port forward), file-system writes locked down, automatic core updates enabled.
Need this done for your project?
We implement, you ship. Async, documented, done in days.
WordPress + plugins + PHP + MySQL is a deep stack. Most plugin vulnerabilities have public exploits within days of disclosure. For a .onion site this still matters because exploitation can lead to deanonymization (the attacker plants code that makes outbound clearnet connections from the server).
Mitigation: minimal plugin footprint, no plugin without active maintenance, outbound network blocked except to Tor.
iptables OUTPUT chain by default DROP except connections to the Tor SOCKS port. If WordPress code attempts to phone home it fails. This is the single most important hardening step for onion WordPress.
Restrict wp-admin to 127.0.0.1 in nginx. Access wp-admin by SSH-over-Tor port forward: ssh -L 8080:127.0.0.1:80 root@onion-ssh. Then browse http://localhost:8080/wp-admin/. This denies the entire internet (Tor or clearnet) any path to wp-admin.
BTC and XMR.
Related: Ghost onion, Tor-only static, v3 onion Romania, Tor hosting parent, Mastodon onion.
Skip the research. Tell us what you need, and we'll scope it, implement it, and hand it back — fully documented and production-ready.