Does my Ghost site load anything from third-party servers?

Almost nothing. Ghost's Portal, search, comments and announcement bar are all served from your own domain, so your readers' browsers never call out to anyone else to load them. The one exception is Stripe, and only if you sell paid memberships.

What we serve from your domain

Ghost normally loads its front-end scripts from cdn.jsdelivr.net, a public CDN run by someone else. We don't. We keep our own copies and serve them from your site:

• Portal powers your signup and account pop-ups. It loads on every page, unless memberships, tips and recommendations are all switched off.
• Search loads on every page. If you're on Pro, Advanced Search comes from your domain too.
• Comments load on posts where comments are turned on.
• The announcement bar loads while you have an announcement running.

They're served from https://yourdomain.com/content/files/ghost-apps/, so as far as your readers' browsers are concerned, all of it comes from you. Nothing to switch on, and nothing that needs a setting changed.

We keep them up to date

Ghost releases new versions of these files alongside new versions of Ghost, and a copy that drifts behind the rest of your site starts behaving oddly. We update our copies with each Ghost release, so this stays current without you doing anything.

The Configuration tab used to have buttons for hosting these files yourself. They're gone, because every site now gets this by default. If you run a customised build of Portal or your own search files, you can still upload them under Configuration.

What still comes from outside

Stripe. If you sell paid memberships, Ghost loads js.stripe.com/v3/ on every page. Stripe only supports serving that file from their own domain, so there's no copy we can host for you. Turning off paid memberships is the only way to remove it.

Your theme. Themes can load fonts, icons or scripts from elsewhere, and that lives in the theme's own code. If you want the full picture, read your page source.

The admin toolbar, but only for you. While you're logged in as a staff user, Ghost loads a small toolbar script from cdn.jsdelivr.net. Your visitors never request it. It does mean you'll spot a jsDelivr address in your own page source while you're logged in, which is expected rather than something left over.

If you're working through this for GDPR reasons, here's where your site and its data actually sit:

Where are the Magic Pages servers located?

Where your site, your backups and your newsletter data are stored, and why a nearby CDN edge isn’t the same as data living there.

Magic PagesJannis Fedoruk-Betschki