I've recently heard someone say WordPress does send data about your blog to back home. Is that true? and if so what data is that or where in the code can I see what's exchanged?
Yes, it does. See Ticket #16778 wordpress is leaking user/blog information during wp_version_check(). All the details are in
The user agent contains the URL of your installation, so all of these data are not anonymous anymore. To get some privacy back filter
Here is a simple example to anonymize the UA string (from a recent blog article):
You can change that to …
… and get the request URL as second parameter for your callback. Now you can check if the URL contains
WordPress sends version data back to .org when using the .org API (installing/searching/updating) to my knowledge. That data is then collated into chart graphics. You can see the data here. I assume this is also used when plotting the roadmap for environment requirements (i.e. PHP4 > PHP5, MySQL version support, etc...).
Here's a sample of what the .org stats data looks like:
As a side note, it's always imperative that you install plugins from trusted sources. Otto, and the other curators of the plugin directory have done a great job weeding out plugins that use base64+eval to send personal information back to unscrupulous plugin authors. I can guarantee there are some that pop up on a weekly basis in the repository. This applies to themes outside of the .org repo as well.
I've heard talk of creating a plugin review team (similar to the theme review team) that will secure the integrity of the repository in the future. You can join the wp-hackers mailing list and get more information there. That's where these type of discussions really are fleshed out.
Yes, you are correct. The wordpress update checker, the plugin update checker and the theme update checker sends regular information about
to the api.wordpress.org site. This is an old discussion since 2007. You can read about it more in my post WordPress phone home - Spyware or Justified post.
protected by kaiser♦ Feb 11 '13 at 19:22
Thank you for your interest in this question.
Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).
Would you like to answer one of these unanswered questions instead?