No Phone Home

=== No Phone Home ===

Contributors: webguyio Donate link: https://webguy.io/donate Tags: telemetry, privacy, security, sandbox, firewall Requires at least: 5.0 Tested up to: 6.9 Requires PHP: 8.0 Stable tag: 0.1 License: CC0 License URI: https://creativecommons.org/public-domain/cc0/

Sandbox your WP installation.

== Description ==

💬 Ask Question | 📧 Email Me

Sandbox your WP installation.

WordPress core, themes, and plugins routinely make outbound connections to external servers without your knowledge. These calls can include update checks, license validation, usage tracking, and third-party API requests.

No Phone Home blocks these outbound connections as aggressively as possible at multiple layers, giving you full control over what leaves your server.

== Installation ==

• Download
• Install (Plugins > Add Plugin)
• Activate

There are no settings to adjust. Simply activate the plugin to enable and deactivate to disable.

== Frequently Asked Questions ==

= Will this break my site? =

Probably not. You should likely continue to be able to use your admin normally, just as visitors should be able to navigate your site normally.

Things that will definitely break:

1. Automatic updates.
2. External dependencies in themes and plugins like fonts and scripts.
3. Google Analytics and similar services.

= Does it truly sandbox my site completely? =

No. The goal is to stop WordPress core, themes, and plugins from making external calls.

It does this with multiple layers, but with so many different types of installations and server setups, it's impossible to guarantee no leaks whatsoever.

If you'd like to lock down your site further, here are some additional steps you can take:

1. Add firewall rules to block outbound connections from your web server user (iptables/ufw).
2. Disable allow_url_fopen and allow_url_include in php.ini.
3. On Nginx, manually add XML-RPC and fingerprinting file blocks to your server config.
4. If wp-config.php was not writable, manually add: define( 'WP_HTTP_BLOCK_EXTERNAL', true );
5. Replace WP-Cron with a real server cron and set define( 'DISABLE_WP_CRON', true );
6. Disable the REST API if not needed.

== Changelog ==

= 0.1 =

• New