As you might know, the discussion about wp_version_check() and update.php has been a hot topic for give or take a decade.

My question is this; Can we, by using the child theme / custom parent theme, "unset" or somehow replace a core file with our own version of the same and in this case -- the update.php file located in the wp-includes folder.

The idea is simple = being able to stop the sending of data to WP. Having spoken to a lot of people, not a single one wants their data transmitted to WP on each update.

That said; I understand that there might be a solution available by using the http_request_args filter hook?

Something like this:

add_filter( 'http_request_args', 'anonymize_ua_string' );
function anonymize_ua_string($args){
global $wp_version;
$args['user-agent'] = 'WordPress/' . $wp_version;

// catch the data set by wp_version_check()
if (isset($args['headers']['wp_install'])){
$args['headers']['wp_install'] = 'https://example.com';
$args['headers']['wp_blog'] = 'https://example.com';
return $args;

But how well will that work and have someone tested it?


I think your method will work because if you make a POST (even with GET) request using Postman or Insomnia the API URL to check the WP version still works. It returns the required data to update WP.

But I would add more validations to avoid errors with another HTTP requests:

add_filter( 'http_request_args', 'stop_sending_wp_data', 10, 2 );
function stop_sending_wp_data( $parsed_args, $url ) {
  $wp_url = 'api.wordpress.org/core/version-check/';
  if ( false === strpos( $url, $wp_url ) ) {
    return $parsed_args;
  if ( ! isset( $parsed_args['headers'] ) || ! isset( $parsed_args['headers']['wp_install'] ) ) {
    return $parsed_args;
  $parsed_args['headers']['wp_install'] = 'https://example.com';
  $parsed_args['headers']['wp_blog']    = 'https://example.com';
  return $parsed_args;

Run your code only if $url matches the API URL, the $wp_url variable. So it will run for that very specific request and not every request.

  • Hi Roel, Ok, and you're sure that the API is done over http and not https? Makes sense what you're saying, just wanted to be sure. Looking at line 135, it seems to be, but with an added ? at the end. http://api.wordpress.org/core/version-check/1.7/? – Moa Andersen Jul 20 '20 at 21:13
  • @MoaAndersen I extracted that URL from the code, but I think it changes to HTTPS later. You can remove the http:// if you're not sure. Also ignore the /1.7/, this might change in the future that's why I didn't include it in the $wp_url variable. – Roel Magdaleno Jul 20 '20 at 21:26
  • @MoaAndersen I removed the http:// in the code to be even more specific. – Roel Magdaleno Jul 20 '20 at 21:31
  • Alright. Smart. Thanks for helping. – Moa Andersen Jul 21 '20 at 4:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.