Your website is probably telling on you
I did a privacy audit of my own website last year and nearly had a heart attack. My WHOIS records showed my real address. My Google Analytics account was linked to my personal Gmail. The EXIF data on my photos contained GPS coordinates of my apartment. And my SSL certificate had been issued to a name I use in my personal life.
All of this was publicly accessible to anyone who knew where to look. And "anyone who knew where to look" includes stalkers, doxxers, and people who get a weird kick out of outing sex workers.
If you have a website and haven't done a privacy audit, this is your wake-up call. Let's go through it.
The checklist
1. Domain registration (WHOIS)
When you register a domain, your name, address, email, and phone number become part of the public WHOIS record by default. Some registrars offer WHOIS privacy for free, but not all of them, and not all privacy services are equally thorough.
What to do:
- Check your WHOIS record right now: go to whois.domaintools.com and look up your domain
- If you see your real details, enable WHOIS privacy through your registrar immediately
- Better yet: register through Njalla (njal.la) — they register the domain in their name, not yours. Your personal details never enter the WHOIS system at all
- If you need to transfer an existing domain, do it. The temporary inconvenience is worth it
2. Hosting provider
Your hosting company knows who you are (they have your payment details), and some hosting companies will comply with informal requests for customer data without requiring a court order.
What to do:
- Use a hosting provider with a strong privacy policy and a track record of not voluntarily disclosing customer data
- Pay with cryptocurrency if possible — it breaks the link between your hosting account and your real identity
- European hosts (especially Swiss, Dutch, or Icelandic) generally have stronger privacy protections than US-based hosts
3. SSL certificate
Free SSL certificates from Let's Encrypt don't expose personal information — they only contain the domain name. But if you purchased an OV (Organization Validated) or EV (Extended Validated) certificate, it may contain your real name or business name.
What to do:
- Use Let's Encrypt (free, automatic, no personal info required)
- If you're using a paid certificate, check what information it contains by clicking the padlock in your browser
4. Photo metadata (EXIF data)
Every photo taken with a phone contains metadata: GPS coordinates, device model, date and time, and sometimes even your phone's serial number. If you upload photos directly from your phone to your website without stripping metadata, all of this is embedded in the image file.
What to do:
- Strip EXIF data from every photo before uploading. No exceptions
- Tools: ExifTool (command line), ImageOptim (Mac), GIMP, or online tools like exifremove.com
- Better yet: use a workflow that automatically strips metadata. Most image editing software does this when you "Save for web"
- Test your existing photos: download an image from your site and check its EXIF data. If you see GPS coordinates, your location has been exposed for as long as that photo has been live
This one is so important. I know a girl who was doxxed because someone downloaded her gallery photos and extracted her home address from the GPS data. She didn't even know EXIF data was a thing.
5. Analytics and tracking
Google Analytics, Facebook Pixel, Hotjar — these are all tracking scripts that link your website to your personal accounts and share your visitors' data with third-party companies.
What to do:
- Remove Google Analytics. If you need analytics, use Matomo (self-hosted) or Plausible (EU-based, privacy-focused)
- Remove Facebook Pixel and any social media tracking scripts
- Check for hidden tracking: use Blacklight (themarkup.org/blacklight) to scan your website for trackers you might not know about
- Every tracking script is a privacy liability — for you AND your visitors
6. Email address
If your contact form sends emails to yourrealname@gmail.com, you've just linked your escort persona to your real identity through Google's servers.
What to do:
- Use a separate email address for your escort business. ProtonMail (Swiss, encrypted) or Tutanota (German, encrypted) are good choices
- Even better: use a custom domain email (you@yourescortdomain.com) hosted on a privacy-respecting provider
- Never use your personal email for anything work-related. Not even once. One slip creates a permanent link
7. Contact forms and third-party services
Your contact form or booking form might be routing data through third-party services. Google Forms stores data on Google servers. Typeform stores data on AWS. Even if the form looks like it's on your site, the data might be going somewhere else.
What to do:
- Check where your form data goes — not just the form itself, but the backend
- Avoid forms that route through US-based services (see: why Google Forms will ban you)
- Use forms hosted on privacy-respecting infrastructure. BlushDesk's booking forms are Swiss-hosted and encrypted end-to-end
8. CDN and third-party assets
Content Delivery Networks (CDNs) like Cloudflare, and external resources like Google Fonts, can log your visitors' IP addresses and browsing data.
What to do:
- If using Cloudflare, check your privacy settings — disable analytics sharing and email obfuscation (which injects JavaScript)
- Self-host your fonts instead of loading them from Google Fonts. Google Fonts sends your visitors' IP addresses to Google with every page load. Download the fonts, add them to your site's files, done
- Audit all external resources your site loads: open Developer Tools → Network tab and look for requests to third-party domains
9. Server configuration
Your web server itself can leak information.
What to do:
- Disable directory listing (so people can't browse your server's files)
- Remove server version headers (don't broadcast that you're running Apache 2.4.51 or Nginx 1.21)
- Set proper security headers: X-Frame-Options, Content-Security-Policy, X-Content-Type-Options
- Disable XML-RPC if you're on WordPress (it's an old API that's mostly used for brute-force attacks now)
10. Social media crossover
This isn't technically your website, but it's worth mentioning: make sure your escort social media accounts are completely isolated from your personal ones.
What to do:
- Different email addresses (not even the same provider)
- Different phone numbers
- Never access both from the same device if possible, or at minimum use separate browsers
- Don't follow your personal friends from your work accounts (or vice versa)
- Be careful with photo backgrounds — your personal Instagram and your escort Twitter shouldn't show the same apartment
The nuclear option: assume it's compromised
If you've had a website for a while and never done a privacy audit, assume that some information has already been exposed. Cached WHOIS records, indexed EXIF data, archived pages — the internet has a long memory.
The good news: you can still lock things down going forward. New domain with proper privacy, new photos with stripped metadata, new hosting with better practices. It doesn't undo the past, but it protects your future.
Tools I recommend
- WHOIS check: whois.domaintools.com
- EXIF viewer: exifdata.com or ExifTool
- Tracker scanner: themarkup.org/blacklight
- Privacy-focused analytics: Matomo (self-hosted) or Plausible
- Privacy-focused email: ProtonMail or Tutanota
- Private domain registration: Njalla (njal.la)
- Security headers check: securityheaders.com
Spend an hour going through this list. Just one hour. The peace of mind is worth it.
---
Want to go deeper on digital security? Check out our security and trust & privacy pages for how BlushDesk approaches these problems at the platform level.
Enjoyed this article?
Get new posts delivered to your inbox.