Self‑host WordPress with Docker and Strip Every Third‑Party Tracker

说明与用途

在 Docker 上自托管 WordPress 并删除所有第三方跟踪：三容器堆栈、mu‑插件、本地字体和网络捕获证明网站仅与自身域名通信。

问题

A stock WordPress 6.x install on Docker automatically contacts external services (api.wordpress.org, Gravatar, Google Fonts, etc.), leaking visitor data and violating privacy requirements such as GDPR.

结果

The site now only communicates with its own domain, eliminating telemetry to api.wordpress.org, Gravatar, and Google Fonts, while preserving core WordPress functionality and optional self‑hosted analytics.

工作流

• 1. Create a docker‑compose.yml with wordpress:6‑php8.3‑fpm, mariadb:11, and nginx:alpine services on a dedicated bridge network.
• 2. Mount ./wp-content to the host for easy grep of theme functions.
• 3. Add a wordpress:cli sidecar for WP‑CLI commands.
• 4. Deploy a must‑use plugin (wp-content/mu‑plugins/strip‑telemetry.php) that calls remove_action for avatar, font, and analytics hooks.
• 5. Configure wp‑config.php with constants to block api.wordpress.org, disable file mods if desired, and set DISALLOW_FILE_MODS.
• 6. Run tcpdump or nginx egress logs to capture outbound DNS and TCP traffic.
• 7. Use browser DevTools Network tab to verify no external domains are loaded.
• 8. Verify Jetpack, Akismet, and other plugins are deactivated or removed, and clean up residual options.
• 9. Optionally replace Google Analytics with a self‑hosted analytics tool.
• 10. Document the final state and keep the mu‑plugin for future sites.

证据

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

来源

The fix is mechanical and takes an afternoon: a three-container compose stack, roughly a dozen constants in wp-config.php, a handful of remove_action calls in a must-use plugin, locally hosted fonts, and a network capture to prove the page now talks to exactly one domain.

来源

Run wp cron event run --due-now to force the scheduled checks instead of waiting 12 hours.

来源

The dashboard calls out to check whether the visiting browser or your PHP version is considered outdated, which fires from wp-admin rather than the front end.

来源