Self‑host WordPress with Docker and strip third‑party trackers

Description and use

Self‑host WordPress on Docker and strip all third‑party trackers, improving visitor privacy by blocking updates, Gravatar avatars, Google Fonts, and Jetpack.

Problem

A stock WordPress install on Docker reaches out to external services (api.wordpress.org, Gravatar, Google Fonts, etc.) leaking visitor data and IP addresses.

Outcome

The site now only contacts its own domain; all third‑party telemetry and avatar requests are removed, improving privacy while retaining core WordPress functionality.

Workflow

• 1. Create docker‑compose.yml with wordpress:6‑php8.3‑fpm, mariadb:11, nginx:alpine on a dedicated bridge network.
• 2. Mount ./wp‑content:/var/www/html/wp‑content for host access.
• 3. Add wordpress:cli sidecar for WP‑CLI commands.
• 4. Add mu‑plugin audit.php to log pre_http_request and run wp cron event run --due-now.
• 5. Capture outbound traffic with tcpdump or nginx egress logs to identify external domains.
• 6. Block api.wordpress.org, secure.gravatar.com, fonts.googleapis.com, and Jetpack endpoints via wp-config constants and remove_action calls.
• 7. Host Google Fonts locally by downloading and enqueueing them in theme functions.
• 8. Verify no external calls remain by re‑capturing traffic and counting distinct domains (should be one).

Evidence

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

Source

Run wordpress:6-php8.3-fpm for PHP, mariadb:11 for the database and nginx:alpine as the front end, defined in a single docker-compose.yml.

Source

Drop a file in wp-content/mu-plugins/audit.php that hooks pre_http_request, writes the URL and debug_backtrace() to the PHP log, and returns null so nothing is blocked.

Source

Block api.wordpress.org, secure.gravatar.com, fonts.googleapis.com, and Jetpack endpoints via wp-config constants and remove_action calls.

Source