Site Key Mutator
This module anonymizes the unique site key sent by the Drupal Core Update module to prevent third parties from fingerprinting your site. It achieves this by either removing or replacing the site ID with a random one for each new request. This privacy feature separates telemetry tracking from the functional aspect of reporting update status.
Site Key Mutator will anonymize the deployment unique site key transferred by the Drupal Core Update module.
It is still possible that third parties could correlate requests to fingerprint a site. This module only disables/randomizes the tracking ID's sent in request.
Features
Anonymizes the site id for each new request by either:
- Removing the site id
- Replacing with a random site id
Why?
Site owners have seen from the 2024 WP Engine Tracker incident that update API's can reveal information site owners would otherwise desire to keep private
The presence of a unique per deployment/per site(domain) identifier in the update module allows for Drupal.org and other actors to profile site owners.
While the Drupal Update API is currently not as invasive as some other CMS API's are (Down The Rabbit Hole - A Look At The WordPress Update API) it still allows gathering unique information about site owners.
This module provides what should already be a core feature, to separate the telemetry tracking from the functional aspect of reporting update status.