Self‑host WordPress with Docker and strip third‑party trackers

Описание и применение

Самостоятельный хостинг WordPress на Docker с удалением всех сторонних трекеров, включая обновления, аватары Gravatar, Google Fonts и Jetpack, повышает конфиденциальность посетителей.

Задача

A stock WordPress install on Docker reaches out to external services (api.wordpress.org, Gravatar, Google Fonts, etc.) leaking visitor data and IP addresses.

Результат

The site now only contacts its own domain; all third‑party telemetry and avatar requests are removed, improving privacy while retaining core WordPress functionality.

Рабочий процесс

• 1. Create docker‑compose.yml with wordpress:6‑php8.3‑fpm, mariadb:11, nginx:alpine on a dedicated bridge network.
• 2. Mount ./wp‑content:/var/www/html/wp‑content for host access.
• 3. Add wordpress:cli sidecar for WP‑CLI commands.
• 4. Add mu‑plugin audit.php to log pre_http_request and run wp cron event run --due-now.
• 5. Capture outbound traffic with tcpdump or nginx egress logs to identify external domains.
• 6. Block api.wordpress.org, secure.gravatar.com, fonts.googleapis.com, and Jetpack endpoints via wp-config constants and remove_action calls.
• 7. Host Google Fonts locally by downloading and enqueueing them in theme functions.
• 8. Verify no external calls remain by re‑capturing traffic and counting distinct domains (should be one).

Доказательства

A stock install of WordPress 6.x on Docker reaches out to api.wordpress.org on a schedule, loads visitor avatars from Gravatar, and the moment you add Jetpack, Akismet, Elementor or a theme that bundles Google Fonts remotely, your visitors' IP addresses start landing in logs you do not control.

Источник

Run wordpress:6-php8.3-fpm for PHP, mariadb:11 for the database and nginx:alpine as the front end, defined in a single docker-compose.yml.

Источник

Drop a file in wp-content/mu-plugins/audit.php that hooks pre_http_request, writes the URL and debug_backtrace() to the PHP log, and returns null so nothing is blocked.

Источник

Block api.wordpress.org, secure.gravatar.com, fonts.googleapis.com, and Jetpack endpoints via wp-config constants and remove_action calls.

Источник