VLESS Reality makes a connection to your node look like HTTPS to a real website, the cover site. A censor who looks at the connection sees that site's name, and a probe that connects to your node is passed through to the real site and gets its real certificate.
Empty or set
- Empty: on first start the agent picks one at random from a built-in list of large sites, and that choice is kept.
- Set: a lowercase hostname with a dot, letters, digits, dots and hyphens only (for example
www.apple.com). You can change it later in Settings, where Regenerate picks a random one for you.
A good cover site
- Supports TLS 1.3 with the X25519 key exchange. Most large sites do, and some do not: if the dashboard says your node's last check failed with Reality handshake refused or a connection error while the node is online, try another cover site first.
- Is not behind an anti-DDoS service such as DDoS-Guard, Qrator, StormWall, ServicePipe, Variti, Kaspersky DDoS Protection or NGENIX. Reality connects to the cover site for every connection of your users, and a service that sees one server open that many connections starts dropping them: every Reality connection of your node then times out. Such a site is refused.
- Is reachable from your node: some sites do not answer from some hosting networks, and a site your node cannot reach cannot cover it.
- Is not blocked on your users' networks: a blocked cover site gets your node blocked with it.
- Has nothing to do with VPNs or with ProofKit: a large, ordinary site.
Save checks it
When you change the cover site and press Save, ProofKit tries the new site before it saves anything: from your node if it is connected (the node runs a short test of its own, up to about 20 seconds), otherwise from ProofKit's servers. A site that does not work is refused with the reason, in one sentence, and nothing changes: the field keeps what you typed, so you can correct it. The same check runs when you register a node with a cover site.
Things to know
- Two origins linked to the same edge can't use the same cover site, because the edge routes by that name. Linking, or changing to a name another linked origin uses, is refused. A name an origin had before its last change counts as used for 7 days (see below).
- Changing it restarts Xray on the node. Apps pick up the new name when they refresh their subscription. For 7 days the node also answers to the name it had, and its entries send that name to it, so apps that have not refreshed yet can still connect with it where the new site allows it. Some sites answer a name they do not serve and some do not, so this is not a promise. Settings and the node page show the old name and when it stops, and changing back to it ends the extra name.
- XHTTP uses the same cover site. Hysteria2 hides the name, so it does not matter there.
- The field has no effect on an edge.