Self‑host WordPress with Docker and Strip Every Third‑Party Tracker

说明与用途

使用 Docker 自托管 WordPress 并删除所有第三方跟踪器，可将站点的外部请求限制为自身域名，从而实现私有化。

问题

A stock WordPress 6.x Docker install automatically contacts external services (api.wordpress.org, Gravatar, Google Fonts, etc.), leaking visitor data and violating privacy requirements.

结果

The site now communicates only with its own domain, eliminating third‑party telemetry while retaining core WordPress functionality.

工作流

• 1. Set up a Docker compose stack with wordpress:6‑php8.3‑fpm, mariadb:11, and nginx:alpine on a dedicated bridge network.
• 2. Mount wp‑content as a bind mount for easy inspection.
• 3. Add a wp‑cli sidecar for quick plugin and cron checks.
• 4. Capture outbound traffic using a pre_http_request filter in a mu‑plugin and browser DevTools.
• 5. Identify external domains (e.g., api.wordpress.org, secure.gravatar.com, fonts.googleapis.com).
• 6. Update wp‑config.php with constants to block update checks, avatar requests, and font URLs.
• 7. Create a mu‑plugin that removes actions for Jetpack, Akismet, and other phone‑home plugins.
• 8. Host Google Fonts locally and enqueue them via the theme.
• 9. Verify with tcpdump and nginx egress logs that only the site’s domain is contacted.
• 10. Deploy the stack to a VPS or personal cloud server.
• 11. Maintain the setup by updating Docker images and monitoring outbound traffic.

证据

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

来源

The fix is mechanical and takes an afternoon: a three-container compose stack, roughly a dozen constants in wp-config.php, a handful of remove_action calls in a must-use plugin, locally hosted fonts, and a network capture to prove the page now talks to exactly one domain.

来源