Self‑host WordPress with Docker and Strip Every Third‑Party Tracker

Описание и применение

Самостоятельный хостинг WordPress с Docker и удаление всех сторонних трекеров позволяет создать приватный сайт, ограничив внешние запросы до собственного домена.

Задача

A stock WordPress 6.x Docker install automatically contacts external services (api.wordpress.org, Gravatar, Google Fonts, etc.), leaking visitor data and violating privacy requirements.

Результат

The site now communicates only with its own domain, eliminating third‑party telemetry while retaining core WordPress functionality.

Рабочий процесс

• 1. Set up a Docker compose stack with wordpress:6‑php8.3‑fpm, mariadb:11, and nginx:alpine on a dedicated bridge network.
• 2. Mount wp‑content as a bind mount for easy inspection.
• 3. Add a wp‑cli sidecar for quick plugin and cron checks.
• 4. Capture outbound traffic using a pre_http_request filter in a mu‑plugin and browser DevTools.
• 5. Identify external domains (e.g., api.wordpress.org, secure.gravatar.com, fonts.googleapis.com).
• 6. Update wp‑config.php with constants to block update checks, avatar requests, and font URLs.
• 7. Create a mu‑plugin that removes actions for Jetpack, Akismet, and other phone‑home plugins.
• 8. Host Google Fonts locally and enqueue them via the theme.
• 9. Verify with tcpdump and nginx egress logs that only the site’s domain is contacted.
• 10. Deploy the stack to a VPS or personal cloud server.
• 11. Maintain the setup by updating Docker images and monitoring outbound traffic.

Доказательства

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

Источник

The fix is mechanical and takes an afternoon: a three-container compose stack, roughly a dozen constants in wp-config.php, a handful of remove_action calls in a must-use plugin, locally hosted fonts, and a network capture to prove the page now talks to exactly one domain.

Источник