Self‑host WordPress with Docker and Strip Every Third‑Party Tracker

Описание и применение

С помощью Docker и пользовательского mu‑плагина можно полностью убрать сторонние трекеры из WordPress, отключив обновления, аватары Gravatar, Google Fonts и Jetpack, и убедиться, что сайт обращается только к своему домену.

Задача

A stock WordPress install on Docker automatically contacts external services (api.wordpress.org, Gravatar, Google Fonts, etc.), leaking visitor data and violating privacy requirements.

Результат

After an afternoon of configuration, the WordPress site no longer contacts external trackers, only the site’s own domain is reachable, and privacy compliance is achieved without sacrificing core functionality.

Рабочий процесс

• 1. Create a docker‑compose.yml with wordpress:6‑php8.3‑fpm, mariadb:11, nginx:alpine and a dedicated bridge network.
• 2. Mount ./wp-content:/var/www/html/wp-content to inspect theme functions.php for external fonts.
• 3. Add a wordpress:cli sidecar for WP‑CLI commands.
• 4. Deploy a mu‑plugin (wp-content/mu‑plugins/audit.php) that hooks pre_http_request to log all WP HTTP API calls.
• 5. Run wp cron event run --due-now to trigger scheduled update checks.
• 6. Capture front‑end requests with Browser DevTools (Network tab) and server‑side requests with tcpdump or nginx egress logs.
• 7. Remove Jetpack via wp plugin deactivate jetpack && wp plugin delete jetpack and clean remaining options.
• 8. Disable Gravatar by setting show_avatars to 0 via wp option update or the Settings UI.
• 9. Self‑host Google Fonts by downloading the font files and enqueueing them locally in the theme.
• 10. Verify outbound traffic only contacts the site’s domain using the captured logs.

Доказательства

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

Источник

Run wordpress:6-php8.3-fpm for PHP, mariadb:11 for the database and nginx:alpine as the front end, defined in a single docker-compose.yml.

Источник

Drop a file in wp-content/mu-plugins/audit.php that hooks pre_http_request, writes the URL and debug_backtrace() to the PHP log, and returns null so nothing is blocked.

Источник

Turn avatars off globally: Settings, then Discussion, then uncheck Show Avatars. From the CLI that is wp option update show_avatars 0.

Источник