Kipphard GDPR Web Fonts
| 开发者 | kipphard |
|---|---|
| 更新时间 | 2026年7月10日 21:22 |
| PHP版本: | 7.4 及以上 |
| WordPress版本: | 7.0 |
| 版权: | GPLv2 or later |
| 版权网址: | 版权信息 |
详情介绍:
- Scans your whole site: the homepage plus all published pages and posts (capped at 200 URLs per run purely as a performance safeguard)
- Detects 14 categories of known external services: fonts, analytics/tracking, video embeds, maps, avatars, CAPTCHAs, social-media pixels, CDN scripts, and more
- Classifies every finding by risk level (High / Medium / Low) with a concrete recommendation
- Shows example URLs for each detected external request
- Free quick fixes: remove Google Fonts (strips external
<link>tags and@importrules — see the FAQ for the WordPress 6.9 requirement), disable WordPress emoji scripts (removes thes.w.orgrequest), replace Gravatar with a local SVG placeholder - No tracking, no external requests from the plugin itself — everything runs locally on your server
安装:
- Upload the
kipphard-gdpr-webfontsfolder to/wp-content/plugins/, or install it from the Plugins screen in your WordPress admin. - Activate the plugin through the "Plugins" menu in WordPress.
- Go to GDPR Webfonts → Dashboard and click "Start scan".
- Review the results, then go to GDPR Webfonts → Settings to enable the desired quick fixes.
屏幕截图:
常见问题:
Does this plugin make my site automatically GDPR-compliant?
No. This is an audit tool, not a compliance overlay. It shows you which external requests your site makes and provides recommendations, but the actual work — hosting fonts locally, obtaining consent, replacing services — has to be done by you or your development team. When in doubt, consult a data-protection professional or lawyer.
How many pages are scanned?
All of them: the scan covers your homepage plus every published page and post. Very large sites are capped at 200 URLs per run — a performance safeguard, not a feature limit.
Is any data sent to external servers during a scan?
No. The plugin fetches your own URLs internally over HTTP and analyses the returned HTML locally. No data is transferred to any third party.
Why does the scan not detect all external requests?
The plugin analyses the HTML that your server delivers on initial load. Requests triggered later by JavaScript (for example on scroll or click) are not visible in the static HTML and are therefore not detected. For a complete picture, also check your browser's Network tab.
Why does removing Google Fonts need WordPress 6.9?
Removing a font reference that a theme has hard-coded into its templates, or written as an @import rule inside a <style> block, means rewriting the finished HTML page. WordPress 6.9 introduced a standard way for plugins to do that — the template enhancement output buffer — and this plugin uses it rather than opening an output buffer of its own, which is unreliable when several plugins do it at once.
On WordPress 6.4 to 6.8 the quick fix still removes Google Fonts stylesheets that were enqueued through WordPress (the common case) and the preconnect / dns-prefetch hints. Hard-coded <link> tags and @import rules are left in place; the scan report continues to list them so you can remove them from your theme by hand.
Why is Google Fonts classified as "High risk"?
On 20 January 2022 the Munich Regional Court I (LG München I, Az. 3 O 17493/20) ruled that embedding Google Fonts without visitor consent violates the GDPR, because the visitor's IP address is transmitted to Google servers in the USA without a legal basis. This plugin flags that risk and lets you remove the external requests entirely.
The scan fails or returns no results. What can I do?
Make sure your site is reachable from itself — no "coming soon" mode, no HTTP authentication. The plugin fetches your own URLs internally over HTTP. Also verify that the PHP dom and libxml extensions are available on your server.
更新日志:
- Fixed: the "Free version" information card was shown on the settings page even in the Pro plugin, where it does not apply.
- Fixed: the bundled German translation now loads. WordPress only auto-loads translations shipped as language packs, so the de_DE catalog included with the plugin was never used; it is now loaded explicitly.
- Fixed: admin styles and scripts now load on the Settings page. The submenu hook suffix is derived from the menu title, so the previous check never matched and the page rendered unstyled.
- The plugin no longer opens an output buffer of its own. Rewriting the rendered page now uses the template enhancement output buffer that WordPress 6.9 provides, so the output-buffer stack is left entirely to WordPress core.
- The WordPress.org build contains no licensing code of any kind. Removal of Google Fonts from enqueued stylesheets and resource hints is unchanged on all supported versions.
- Output-buffer handling hardened; added an "External services" documentation section.
- Renamed to Kipphard GDPR Web Fonts. Full-site scanning is available to everyone (no page-count limit). All internal option/hook/action names now use a unique plugin-specific prefix. The free version contains no license-gated code; automatic scheduled scans are available as a separate Pro plugin.
- Shared Kipphard admin design system for a consistent, theme-safe look in the WordPress admin.
- English source baseline with a German (de_DE) translation.
- Initial release.
- Detects 14 categories of external services: Google Fonts, Analytics/Tracking, YouTube, Maps, Gravatar, reCAPTCHA, Facebook Pixel, Hotjar, Font Awesome, JS CDNs, WordPress emojis, and more.
- Risk classification (High / Medium / Low) with actionable recommendations per service.
- Quick fixes: remove Google Fonts, disable WordPress emojis, replace Gravatar with a local SVG placeholder.
- SSRF protection: only URLs on your own host are scanned.
- No external dependencies, no tracking.