Self‑host WordPress with Docker and Strip Every Third‑Party Tracker

说明与用途

通过 Docker 和自定义 mu‑插件，可以完全去除 WordPress 的第三方跟踪器，禁用更新、Gravatar 头像、Google 字体和 Jetpack，并验证站点仅访问自身域名。

问题

A stock WordPress install on Docker automatically contacts external services (api.wordpress.org, Gravatar, Google Fonts, etc.), leaking visitor data and violating privacy requirements.

结果

After an afternoon of configuration, the WordPress site no longer contacts external trackers, only the site’s own domain is reachable, and privacy compliance is achieved without sacrificing core functionality.

工作流

• 1. Create a docker‑compose.yml with wordpress:6‑php8.3‑fpm, mariadb:11, nginx:alpine and a dedicated bridge network.
• 2. Mount ./wp-content:/var/www/html/wp-content to inspect theme functions.php for external fonts.
• 3. Add a wordpress:cli sidecar for WP‑CLI commands.
• 4. Deploy a mu‑plugin (wp-content/mu‑plugins/audit.php) that hooks pre_http_request to log all WP HTTP API calls.
• 5. Run wp cron event run --due-now to trigger scheduled update checks.
• 6. Capture front‑end requests with Browser DevTools (Network tab) and server‑side requests with tcpdump or nginx egress logs.
• 7. Remove Jetpack via wp plugin deactivate jetpack && wp plugin delete jetpack and clean remaining options.
• 8. Disable Gravatar by setting show_avatars to 0 via wp option update or the Settings UI.
• 9. Self‑host Google Fonts by downloading the font files and enqueueing them locally in the theme.
• 10. Verify outbound traffic only contacts the site’s domain using the captured logs.

证据

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

来源

Run wordpress:6-php8.3-fpm for PHP, mariadb:11 for the database and nginx:alpine as the front end, defined in a single docker-compose.yml.

来源

Drop a file in wp-content/mu-plugins/audit.php that hooks pre_http_request, writes the URL and debug_backtrace() to the PHP log, and returns null so nothing is blocked.

来源

Turn avatars off globally: Settings, then Discussion, then uncheck Show Avatars. From the CLI that is wp option update show_avatars 0.

来源