Self‑host WordPress with Docker and Strip Every Third‑Party Tracker

Описание и применение

Собственный WordPress‑сайт на Docker без сторонних трекеров: три контейнера, mu‑плагин, локальные шрифты и сетевой захват подтверждают, что сайт общается только с собственным доменом.

Задача

A stock WordPress 6.x install on Docker automatically contacts external services (api.wordpress.org, Gravatar, Google Fonts, etc.), leaking visitor data and violating privacy requirements such as GDPR.

Результат

The site now only communicates with its own domain, eliminating telemetry to api.wordpress.org, Gravatar, and Google Fonts, while preserving core WordPress functionality and optional self‑hosted analytics.

Рабочий процесс

• 1. Create a docker‑compose.yml with wordpress:6‑php8.3‑fpm, mariadb:11, and nginx:alpine services on a dedicated bridge network.
• 2. Mount ./wp-content to the host for easy grep of theme functions.
• 3. Add a wordpress:cli sidecar for WP‑CLI commands.
• 4. Deploy a must‑use plugin (wp-content/mu‑plugins/strip‑telemetry.php) that calls remove_action for avatar, font, and analytics hooks.
• 5. Configure wp‑config.php with constants to block api.wordpress.org, disable file mods if desired, and set DISALLOW_FILE_MODS.
• 6. Run tcpdump or nginx egress logs to capture outbound DNS and TCP traffic.
• 7. Use browser DevTools Network tab to verify no external domains are loaded.
• 8. Verify Jetpack, Akismet, and other plugins are deactivated or removed, and clean up residual options.
• 9. Optionally replace Google Analytics with a self‑hosted analytics tool.
• 10. Document the final state and keep the mu‑plugin for future sites.

Доказательства

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

Источник

The fix is mechanical and takes an afternoon: a three-container compose stack, roughly a dozen constants in wp-config.php, a handful of remove_action calls in a must-use plugin, locally hosted fonts, and a network capture to prove the page now talks to exactly one domain.

Источник

Run wp cron event run --due-now to force the scheduled checks instead of waiting 12 hours.

Источник

The dashboard calls out to check whether the visiting browser or your PHP version is considered outdated, which fires from wp-admin rather than the front end.

Источник