Shared Hosting 
WordPress Hosting 
Cloud VPS Hosting 
Dedicated Servers 
Censorship-resistant hosting is one of the few things in this industry where the marketing and the engineering have genuinely diverged. Providers still advertise "unblockable" servers. Meanwhile the filtering systems in the countries where it matters most have moved from blocking addresses to identifying protocols, and a plain WireGuard tunnel to a European server now fails within minutes on several major networks.
This article is for people running their own infrastructure to get themselves, their colleagues or their readers through a national filter. It covers what censorship looks like technically in 2026, what a private server changes and what it does not, which protocols survive, and the risks that no amount of hosting fixes. If you came here looking for free speech hosting for a website, that has its own section further down.
We sell hosting, so read this with that in mind. We have tried to be clear about the points where buying a server is not the answer, because sending someone into a hostile network with false confidence is worse than selling them nothing.
What Censorship Looks Like Now
Filtering is layered, and each layer defeats a different circumvention technique. Knowing which layer is stopping you is most of the work.
DNS manipulation. The cheapest method. Your resolver returns the wrong address or nothing at all. Encrypted DNS gets around DNS-only interference, but only while the encrypted resolver itself stays reachable. Connecting straight to an IP address sometimes works for simple services, though virtual hosting, certificate validation and additional IP or SNI filtering usually get in the way. Few networks rely on this layer alone any more.
IP, subnet and ASN blocking. The filter drops traffic to known addresses. This is what catches commercial VPN providers, whose server ranges are public and get enumerated. The important change is that the unit of blocking has grown. In May 2026 Russian filtering escalated to blocking whole subnets and autonomous systems, and censors in Iran have been observed targeting hosting providers associated with VPN services. Your individual address can be collateral damage in a decision that was never about you.
Protocol fingerprinting via DPI. The significant change. Deep packet inspection does not need to decrypt anything. It recognises the shape of a handshake. WireGuard has a distinctive initiation packet. OpenVPN has a recognisable pattern even on TCP 443. Once the equipment knows the signature, changing ports buys you days, not months.
Throttling instead of blocking. Politically cheaper than an outright block, because the service appears broken rather than banned. Traffic is squeezed to a few hundred kilobits until video and calls fail on their own.
Protocol and service allowlisting. Instead of identifying everything forbidden, a network permits only selected protocols, destinations or users and drops the rest. Iran has operated a protocol filter of this kind for years, with measurement work published in 2025 finding only DNS, HTTP and HTTPS forwarded. The January 2026 shutdown expanded the model into broader whitelist-based access, with researchers tracking the network also reporting a shift toward automated rather than manual blocking decisions. In that environment, making a tunnel look like ordinary HTTPS may not be enough if its destination is not on the permitted list.
Full shutdown. Nothing routes. No server, protocol or provider helps. Worth stating plainly because it is the scenario people plan least for.
The legal machinery behind this has been formalised too. Russia's Government Decree No. 1667, adopted on 27 October 2025 and in force since 1 March 2026, reissued and formalised the rules for centralised management of the public communications network, allowing Roskomnadzor to issue binding instructions to participating operators and infrastructure owners. By mid-January 2026 the regulator had restricted 439 VPN services, around 70 percent more than three months earlier.
What a Private Server Changes
The reason a VPS outperforms a commercial VPN in a censored network has almost nothing to do with speed or privacy policy. It is arithmetic.
A commercial provider serves millions of users from a published range of addresses. A censor can enumerate that range once and block it permanently. Your own server sits on an address that has not been advertised or catalogued as a VPN endpoint and may be used by a handful of people, which makes enumeration far harder. It does not make you invisible, because IP allocations are public and, as above, whole ranges can be blocked at once.
You also control the protocol. Commercial apps ship what their vendor supports. On your own machine you can run a protocol designed for the specific filter in front of you, change it the week it stops working, and run two in parallel so a failure is an inconvenience rather than a blackout.
The trade-off is real and we cover it in detail in Self-Hosted VPN: What You Gain and What You Give Up. A single-user exit address is excellent against censorship and poor against traffic correlation, because everything leaving it is yours.
What Censorship-Resistant Hosting Requires From the Provider
Most hosting is unsuitable for this work for reasons that never appear on the pricing page.
| A permissive AUP | Some hosts prohibit VPN operation outright, others allow it only under specific abuse or network conditions. Read the policy before you order, not after a suspension. |
| A dedicated IPv4 address | Strongly preferable. NAT and shared-IP services may restrict which inbound ports you can use, and the address reputation is shared with other customers. |
| A replacement path for that IP | Addresses do get blocked, sometimes as part of a wider range. Ask what a new one costs before you need it. |
| Full root and port freedom | Some of these protocols need custom software, particular networking configuration or kernel support. A restricted managed environment may not give you the control required. |
| The right jurisdiction | A server inside the filtering country defeats the purpose entirely. One in a state that cooperates closely with it raises your legal and operational exposure to a degree that depends on the countries involved. |
| Payment that works from inside | Crypto can be one of the few practical cross-border routes where cards and conventional payment services are unavailable, and it does not identify the buyer the way a card does. |
| Signup without identity documents | A provider holding your passport scan is a single point of failure you cannot undo later. |
On our side: our acceptable use policy permits VPN operation for personal use, a small group or a commercial service, with no separate approval process, in both Finland and Switzerland. Every Cloud VPS includes a dedicated IPv4 with full root, signup takes an email address and nothing else, and Bitcoin and Monero settle through our own BTCPay Server rather than a processor. Tor exit nodes are not permitted in either location, which we would rather tell you here than in a suspension email.
Protocols That Survive DPI
This changes faster than any other part of the subject, and it varies by country, by carrier and sometimes by city. Treat the table as a starting point and test from the network you care about.
| Protocol | How it hides | Status in heavily filtered networks |
|---|---|---|
| WireGuard | It does not | Readily fingerprinted and frequently disrupted on heavily filtered Russian and Iranian networks. Availability varies by ISP and current policy, and it still works fine where no active DPI is deployed. |
| OpenVPN (TCP 443) | Looks like HTTPS at a glance | Its TLS handshake carries its own signature, so it is commonly disrupted where DPI is aggressive. Usable behind stunnel or comparable obfuscation. |
| AmneziaWG | WireGuard with varied headers, packet sizes, sequences and timing, developed in direct response to Russian filtering | Close to WireGuard's speed with far better resistance, and the most commonly recommended primary option for Russian networks in 2026. Open source. |
| VLESS with Reality | Borrows the TLS handshake of a real high-traffic site, so the connection resembles a browser visiting it | One of the stronger options under aggressive filtering, but no longer untouched: technical reports from June 2026 describe behavioural and fingerprint-based filtering affecting common VLESS and Reality configurations. Configuration matters, and nothing stays unidentifiable forever. |
| Shadowsocks with plugins | Obfuscation layers such as cloak or obfs wrappers | Bare Shadowsocks is detected. With a current plugin it remains usable, and it is light on resources. |
| Hysteria2 and other QUIC tunnels | Rides UDP-based QUIC, which carries real web traffic | Fast where it works, but QUIC itself is selectively throttled or dropped on some networks, which takes the whole approach with it. |
Three rules hold across all of them. Run two protocols, not one, because blocks arrive in waves and the one that failed this morning may work again next month. Prefer ports that carry real traffic, since a tunnel on an unusual port is suspicious before anyone inspects the packets. And configure everything before you need it, because circumvention tools and their download pages are themselves blocked inside the networks where you want them.
Our step-by-step build for the AmneziaWG option is in the knowledge base: setting up an AmneziaWG tunnel.
What Hosting Does Not Fix
This is the part the market leaves out, and it is the part that determines whether someone gets hurt.
The legal exposure is on the user, not the server. In Russia, individual VPN use is not itself an offence, but since 1 September 2025 deliberately searching for material on the federal extremist register is, including when done through a VPN, and using circumvention tools while committing a crime is an aggravating circumstance. Advertising tools or services for accessing restricted resources carries substantially larger administrative fines than the search offence does. In Iran, a Supreme Council of Cyberspace resolution published in February 2024 prohibited the use of unlicensed circumvention tools, though prohibition is not the same as criminalisation and the position is genuinely contested: a reported June 2025 Tehran criminal court ruling acquitted a person prosecuted for advertising and selling VPN services. People involved in distribution have faced enforcement regardless of how the courts eventually settle it. A server in Helsinki does not travel with the person using it.
Device seizure defeats a different layer. Your tunnel protects traffic in transit. It does nothing to protect data exposed on an unlocked device at a checkpoint.
Identity is increasingly bound below the network layer. Where SIM registration is mandatory and account sharing restricted, the person behind a connection can often be established without breaking any encryption at all.
Your address is not entirely in your hands. Individual IPs get identified eventually, particularly when shared beyond a handful of people, and subnet or ASN-level blocking can take your address out for reasons that have nothing to do with your traffic. Plan for replacement rather than treating it as failure.
Nothing survives a shutdown. When the routes go, they go. The answer to that is offline preparation and mesh or satellite communication, not hosting.
There is also a scale question worth being blunt about. A tunnel for yourself or a few people is inconspicuous. As usage grows into the hundreds, the endpoint is shared more widely, traffic volume and connection diversity rise, and the address becomes far more likely to be reported, catalogued, or caught by range-level filtering. At that point it starts to look exactly like the commercial providers already being enumerated.
A Sensible Build Order
- Buy and configure from an unfiltered network. Waiting until the target network is already restricted makes every step of setup harder.
- Choose a location with a good measured path to the target network. Finland is well placed for the Nordics and Baltics, but test latency and routing rather than assuming geography guarantees the path.
- Harden the server first: keys only, no password login, firewall permitting only what you serve.
- Stand up your primary protocol, then a second one on a different port using a different technique.
- Test both from the target network before you rely on either, and keep working configurations somewhere reachable offline.
- Assume the first setup will eventually stop working, and decide in advance who changes it and how.
The smallest VPS tier is enough for a personal tunnel. The constraint is bandwidth and network path, not CPU. If you want a sense of what else can share the same machine, see things you can host on a VPS, and for how jurisdictions compare on the legal side, our hosting jurisdiction index.
Free Speech Hosting: Keeping a Website Online
Censorship resistance has a second meaning, and it is the one most people have in mind when they search for free speech hosting. The problem is not getting a connection out of a filtered network. It is keeping a website online when someone wants it gone: a government, a company, a pressure campaign or a stream of takedown notices.
No host keeps everything online. Every provider is bound by the law where its company and servers sit, and by the policies of the networks it buys transit from. So free speech web hosting, in any honest sense, means a host that removes content when a competent court orders it, not when it simply receives a complaint.
What to check before you trust a host with your speech
- Whose law applies. The jurisdiction of the servers and the company decides which courts can order removal. Our hosting jurisdiction index compares them.
- How complaints are handled. Does the host remove content as soon as a notice arrives, or tell you and let you respond first? Is there a counter-notice route? Our guide to DMCA takedowns and hosting jurisdiction explains the differences.
- What the upstream does. A host's own policy is only as strong as its network provider's. Some upstreams forward foreign notices with short deadlines that the host is contractually bound to meet.
- How defamation claims are treated. A host that decides for itself whether a statement is true will eventually remove something lawful. Look for a policy that leaves that question to the courts.
- The domain. A site can go offline at the registry or registrar without anyone touching the server, which our guide to domain seizure covers.
- The written policy. Specific rules you can read are worth more than a clause reserving the right to remove anything the host finds objectionable.
Here is how our own acceptable use policy handles it. Claims that content is defamatory are left to the courts in every location: we act on a valid order from a competent court in the relevant jurisdiction, not on informal complaints or out-of-jurisdiction demands. Copyright complaints depend on where the service runs, and in Finland on which of our two networks it sits.
| Switzerland | Finland, primary network (AS207003) | Finland, second network (AS24940) | |
|---|---|---|---|
| Copyright complaints | Need an order from a competent Swiss court or an enforceable order under an applicable treaty. Informal notices, cease-and-desist letters and unrecognised foreign court orders are not acted on. | EU and Finnish law only. DMCA notices are not actioned without a Finnish court order. You are told about a complaint and can respond before anything is restricted. | The upstream forwards copyright complaints and DMCA notices with deadlines of typically 24 hours, and we are contractually obliged to act. No counter-statement. |
| Defamation claims | Court order required | Court order required | Court order required |
| Lawful adult content | Permitted | Permitted; contact support before ordering | Not permitted |
| Torrents and P2P | Permitted | Not permitted | Not permitted |
If takedown resistance matters for your site, choose Switzerland, or ask support before you order which Finland network your service will run on. None of this covers content that is illegal where the service is hosted, and large-scale piracy is prohibited in every location. The full rules are in our acceptable use policy for Finland and Switzerland.
Frequently Asked Questions About Censorship-Resistant Hosting
What makes hosting censorship-resistant?
A dedicated address that has not been catalogued as a VPN endpoint, full root access so you can run obfuscated protocols, an acceptable use policy that permits VPN operation, a jurisdiction beyond the censor's legal reach, and a payment route that works from inside a restricted country. Speed and specification barely matter.
Does a VPS work where commercial VPNs are blocked?
It can. A private VPS avoids the known endpoint pools that commercial providers rely on, which is the single biggest reason those services fail. It can still be stopped by protocol fingerprinting, subnet or ASN filtering, destination allowlisting, or simple discovery of the address.
Which protocol should I run?
AmneziaWG for most people, because it keeps WireGuard's performance while breaking its fingerprint. VLESS with Reality as a second channel where filtering is severe, bearing in mind that it is now being targeted specifically. Run two, whichever you pick first.
Is running a VPN allowed on Packetra servers?
Yes. Our acceptable use policy permits VPN operation for personal use, a trusted group, or as a commercial service, with no separate approval process, in both Finland and Switzerland. Tor exit nodes are not permitted in either location. Torrents and P2P file sharing are permitted in Switzerland but not in Finland.
Is free speech hosting the same as censorship-resistant hosting?
They overlap, but they are not the same. Censorship-resistant hosting, in the sense this guide mostly covers, is about getting traffic through a national filter. Free speech hosting is about keeping a website online under legal or political pressure. The same things help with both: a jurisdiction chosen deliberately, a written policy you can read, and a host that acts on court orders rather than complaints.
Can I pay without a card or identity documents?
Yes. Signup requires only an email address and a password, and Bitcoin and Monero are handled by our own BTCPay Server with no third-party processor involved. Other cryptocurrencies go through CoinPayments, and fiat options exist for those who want them.
What happens if my server's IP gets blocked?
Open a ticket and we will look at the options with you. Keep a second tunnel on a different protocol running in the meantime, since the address is rarely the only thing that has changed.
Set it up before you need it. A Cloud VPS in Finland or Switzerland, root access from the first minute, no identity documents, and payment in Monero or Bitcoin direct to us.
