As you might know, the discussion about wp_version_check() and update.php has been a hot topic for give or take a decade.

My question is this; Can we, by using the child theme / custom parent theme, "unset" or somehow replace a core file with our own version of the same and in this case -- the update.php file located in the wp-includes folder.

The idea is simple = being able to stop the sending of data to WP. Having spoken to a lot of people, not a single one wants their data transmitted to WP on each update.

That said; I understand that there might be a solution available by using the http_request_args filter hook?

Something like this:

add_filter( 'http_request_args', 'anonymize_ua_string' );
function anonymize_ua_string($args){
global $wp_version;
$args['user-agent'] = 'WordPress/' . $wp_version;

// catch the data set by wp_version_check()
if (isset($args['headers']['wp_install'])){
$args['headers']['wp_install'] = '';
$args['headers']['wp_blog'] = '';
}
return $args;
}

But how well will that work and have someone tested it?

As you might know, the discussion about wp_version_check() and update.php has been a hot topic for give or take a decade.

My question is this; Can we, by using the child theme / custom parent theme, "unset" or somehow replace a core file with our own version of the same and in this case -- the update.php file located in the wp-includes folder.

The idea is simple = being able to stop the sending of data to WP. Having spoken to a lot of people, not a single one wants their data transmitted to WP on each update.

That said; I understand that there might be a solution available by using the http_request_args filter hook?

Something like this:

add_filter( 'http_request_args', 'anonymize_ua_string' );
function anonymize_ua_string($args){
global $wp_version;
$args['user-agent'] = 'WordPress/' . $wp_version;

// catch the data set by wp_version_check()
if (isset($args['headers']['wp_install'])){
$args['headers']['wp_install'] = 'https://example';
$args['headers']['wp_blog'] = 'https://example';
}
return $args;
}

But how well will that work and have someone tested it?

• updates
• wordpress-version

1 Answer 1

I think your method will work because if you make a POST (even with GET) request using Postman or Insomnia the API URL to check the WP version still works. It returns the required data to update WP.

But I would add more validations to avoid errors with another HTTP requests:

add_filter( 'http_request_args', 'stop_sending_wp_data', 10, 2 );
function stop_sending_wp_data( $parsed_args, $url ) {
  $wp_url = 'api.wordpress/core/version-check/';
  
  if ( false === strpos( $url, $wp_url ) ) {
    return $parsed_args;
  }
  
  if ( ! isset( $parsed_args['headers'] ) || ! isset( $parsed_args['headers']['wp_install'] ) ) {
    return $parsed_args;
  }
  
  $parsed_args['headers']['wp_install'] = 'https://example';
  $parsed_args['headers']['wp_blog']    = 'https://example';
  
  return $parsed_args;
}

Run your code only if $url matches the API URL, the $wp_url variable. So it will run for that very specific request and not every request.