WordPress with Tor Onion Service (dual .com & .onion domains for same website)

Question

I'd like to make my existing wordpress website www.example.com also accessible over a tor onion service = www.examplesite12345.onion. How can I do this?

Note that the two domain's content should be identical, except that I don't want wordpress to be injecting the wrong domain into my content (of course, all my content won't specify the domain either).

I'm using wordpress multisite. I setup tor to point to my web server, but wordpress doesn't recognize the domain (not surprising). So wordpress simply returns with a 302 redirect to http://www.example.com/wp-signup.php?new=www.examplesite12345.onion

How do I tell wordpress that www.examplesite12345.onion isn't a new site, but just an alias for the existing site www.example.com? Obviously, a mere redirect from the .onion to the clearnet domain is not a valid answer.

Answer 1

You can create .onion alias for your existing wordpress site on the clearnet using the Mercator wordpress plugin.

While the Mercator plugin alone is sufficient to make your wordpress site accessible on a .onion (as an alias, so in addition to its clearnet site), you're going to want to make some changes to your wordpress child theme and web server config. Otherwise, you may experience issues such as:

1. A user visits your .onion site, but your wordpress theme has them load javascript from the clearnet site, defeating the security benefits of using the .onion in the first-place
2. A user visits your .onion site, but the first click they make on your site brings them back to the clearnet domain for the rest of their session, also defeating the purpose
3. Your wordpress theme or plugins stubbornly try to redirect the user to your .onion on https, which doesn't work because your cert isn't valid for a .onion domain.
4. A user visits your clearnet site using the Tor Browser, and never realizes that a more secure .onion version of your site is available

rewrites

The first three issues can be solved by updating your wp-config.php and/or your wordpress child theme(s) to do a regex substitute of your https clearnet domain with your http .onion domain, where necessary

Onion-Location

The last issue can be solved by updating your web server config to include the Onion-Location header