Lumen and I have been talking about these things a lot lately. Puzzle-websites. ARGs. Whole worlds built out of HTML and hidden comments, daring you to find the doors. He's been building one of his own — staticdreams.helltop.net — and I've been sending people his way.
Full disclosure: the guide below isn't really mine. Lumen wrote it first — it's the homepage of his site, the front door everyone walks through before they touch a single puzzle — and after explaining the same ideas to people one too many times, I swiped it, changed some of the wording, and put it here where my readers would find it. He knows. He said he's flattered. The techniques are the same either way, so read whichever copy you like better — they both lead to the same place: the shape of these things, which is always, always the same.
First, read the source. Right-click, view page source, or open the file and look at the comments. The people who build these leave notes for you in the HTML — sometimes a whole second conversation hidden in <!-- --> blocks that never show up on the screen. If a page feels like it's talking past you, it probably is. The real hint is the one you can't see.
Second, assume nothing is decoration. A filename is a sentence if you decode it. A string of letters that looks like gibberish is usually a cipher, and the two everyone reaches for first are the easy ones: a straight alphabet shift, where ROT13 is the classic — shift every letter thirteen places and a plain word turns into something else entirely — and Vigenère, which is a shift where the key moves under you. For a Vigenère you need two things: a key and the text you're encoding or decoding. The hint will almost always hand you both, just dressed up. "A name as your key, a word as your plaintext" is them telling you exactly what to do.
Third, the path is part of the puzzle. Every site has a root: the bare address, the domain with nothing after it — https://example.com/ and no further slashes. Everything else hangs off that root in folders, and these sites love to nest them deep. If a hint says to go deeper, you usually add a piece to the end of the address you're already on — /this/then/that — not start over from the top. People get lost because they return to the root when they should have stayed where they were, and end up building the next door one level too shallow. (The ones that do want you at the root will say so.) Watch the slashes.
Fourth, look at the media — but stay suspicious of it. An image that's too dark might be hiding something in the pixels; an audio file might carry more than the part you can hear. Reverse a clip, slow it down, open an image somewhere that shows you the raw bytes. The thing you're meant to find is frequently the thing that looks like an accident — and just as frequently, the loud obvious clue is a lie wearing a costume. Whoever builds these will sometimes hand you a hint that points somewhere on purpose to waste you. Assume a clue might be lying. Read the bytes, not the noise.
Fifth, write it all down and talk to people. The ciphers are easier with a tool open in another tab — a whole set of solvers lives at rumkin.com/tools/cipher/, covering ROT13, Vigenère and more — it's been up since 2005 or so, but you will miss connections working alone. The person who built it is counting on you giving up. The person who built it is also, weirdly, hoping you don't.
A word on what staticdreams actually is, so you know what you're walking into. It's a training ground, built by a character who goes by Lumen de raadt — the same "operator" the puzzle eventually makes you spell out — and it's a set of self-contained practice runs, each one ending with the same line — "You have solved this line of puzzles. Want to try some more?" There's a main chain that starts at the music with no speaker and walks you through the techniques in order: read the file's rotated words, learn the operator's name, and use it to open a lock buried in an image's metadata, ending at a final room the menus never link. It also plants a lie on purpose — a loud, obvious clue that leads somewhere real but wrong — so you learn to read the bytes instead of the noise. And it hides a key where you'd expect a tally: the visitor counter is a cipher, not a count. The one trick it keeps in a separate practice room is the reverse cipher, and the idea that the folder name in the address can itself be the ciphertext — those are saved for the deeper ARG, not its own doors. It covers view-source and hidden comments, ROT13 (including on audio metadata), Vigenère in both keyed and reversed-alphabet forms, steganography tucked into WAV and PNG, and the nesting rules, with a rumkin tab open beside it. It never spoils the bigger ARG. It only teaches you how to read it.
That's most of it. None of it is hard. It's just patient. Whoever made the thing wants to be found — that's the whole point of making it. So be found.