The adult site stack — what's actually different

Ninety percent of building an adult site is the same as building any site. This guide is about the other ten percent — the places where the normal advice gets you deplatformed or sued.

Hosting: pick one that says "adult" in the terms

Most mainstream hosts prohibit adult content in their acceptable-use policy, and they enforce it — sometimes months in, once you have traffic. Do not build on one and hope.

Hosts that explicitly allow adult content and have for years:

• MojoHost — the default for serious adult operators. Managed, expensive, knows the industry.
• VICE Temple — adult-focused, offshore options, crypto payment.
• FlokiNET, Abelohost, Shinjiru — offshore, privacy-oriented.
• Hetzner and OVH — general hosts that tolerate adult on dedicated/VPS as long as it is legal content and you handle abuse reports. Cheap. Read the current AUP; it shifts.

Cloudflare will proxy an adult site (it is a network, not a host) but has terminated adult accounts over specific content categories and payment disputes. Fine as a CDN, do not make it a single point of failure.

Rule: your host, your CDN, and your registrar should be three different companies, and at least your DNS should be portable within an hour.

CDN and media delivery

If you host video, bandwidth is your biggest cost and your biggest fragility.

• BunnyCDN — adult-friendly, cheap, good dashboard. Common choice.
• CDN77, KeyCDN — allow adult, pay-as-you-go.
• Bunny Stream or self-hosted with Video.js / HLS.js for the player.
• Avoid Cloudflare Stream and most "developer-friendly" video products — their terms exclude adult.

For images and galleries a plain CDN in front of object storage (Backblaze B2, Wasabi, or Bunny's storage) is enough. Backblaze and Wasabi both allow legal adult content.

The age gate

Two different things get called an "age gate":

1. The click-through disclaimer — "Are you 18+? [Enter] [Leave]". This is a cookie-set modal. It is trivial to build, it is what almost every adult site has had for 20 years, and in many jurisdictions it is now not enough.
2. Real age verification — a third-party check against ID, a credit-card auth, or a face-age estimate. Required by a growing list of US states and the UK for sites over the one-third-adult-content threshold. See the compliance guide.

Build the click-through gate as useSyncExternalStore over a cookie or localStorage flag, server-render nothing sensitive above it, and set an X-Robots-Tag / rating meta so search engines classify the site correctly. If you cross the verification threshold, integrate a provider (AgeChecked, Yoti, VerifyMy, Incode) rather than rolling your own — you do not want to be the one storing ID scans.

What to build the site with

• Directory / review / blog (like this site): a static-site generator or a framework with static export. Next.js, Astro, Hugo, Eleventy. The content is the product; keep the runtime boring and the pages cacheable.
• Tube: this is a media application, not a content site. Existing scripts (KVS — Kernel Video Sharing, or a custom build) handle transcoding, thumbnails, and the player. Do not underestimate transcoding cost and storage growth.
• Paysite: NATS/MPA3 (Too Much Media) for member management and affiliate tracking is the industry standard. Smaller ones run WordPress + a membership plugin + a high-risk payment gateway.
• AI tool / companion: a normal web app. The adult-specific parts are the model hosting (many API providers ban NSFW — you will likely self-host an open model or use one of the few permissive providers) and the payment processor.

Email

Transactional email (password resets, receipts) from an adult domain gets blocked by the big senders. Mailgun and Postmark prohibit adult; SMTP2GO, SMTP.com, and self-hosted Postal on a clean IP are the usual answers. Warm the IP slowly and keep the sending domain separate from your main domain.

Analytics

Google Analytics works on adult sites and does not ban them, but sends your traffic data to Google. Privacy-respecting alternatives that allow adult: Plausible (self-host or cloud), Matomo (self-host), Umami (self-host). Self-hosting one keeps the data yours, which is worth something when the traffic is sensitive.

The portability rule, restated

Every critical service in this stack has, at some point, terminated an adult customer with little notice. Assume each one will. Keep DNS portable, keep backups off the primary host, keep the member database exportable, and know your second choice for every box before you need it.

Maintained by [PORNAGG](/). Our own stack: static Next.js, a headless crawler for the [Safety Index](/methodology), flat files in git, self-hosted deployment. Deliberately little to deplatform.