Every reader who opened your Ghost site on Magic Pages used to make a request to cdn.jsdelivr.net, a public CDN run by a third party, before the page finished loading. Not anymore.
Ghost has five small apps that run on the public side of a site: Portal, search, comments, the announcement bar, and the embeddable signup form. Portal and search load on every page view. Ghost points all five at jsDelivr by default, so that request happened on every page view, on every site we host.
A request to a CDN is still a request. Your reader's IP address, browser and referring domain go to whoever answers it. They do not collect any cookies and nothing is linked to individual users. But why share data if there's a safer – and faster – alternative?
What changed
Every site we host now serves those files from https://yourdomain.com/content/files/ghost-apps/. There's nothing to switch on and no setting to change.
They're the same files jsDelivr would have served. We do not just proxy the files, but keep our own copies matched to the version of Ghost your site runs. Now, the requests to these files never leave the Magic Pages infrastructure.
What still comes from somewhere else
There are still a few files that might be loaded from third parties.
The one we cannot change is Stripe, if you sell paid memberships. Ghost loads js.stripe.com/v3/ on every page, and Stripe only supports serving that file from their own domain.
The rest might be caused by your theme, if it pulls in fonts, icons or scripts of its own. That lives in the theme's code rather than ours.
And one you'll only ever see yourself: while you're logged in as a staff user, Ghost loads a small admin toolbar from jsDelivr. Your visitors never request it. So a jsDelivr address in your own page source is expected, rather than something we missed.
Where the self-host buttons went
The Configuration page inside our Customer Portal used to have buttons that downloaded the portal, comments and search files onto your own site. They solved the same problem one site at a time, and the copy they left behind froze at whatever version was current the day you clicked. Every site gets this by default now, so the buttons are gone.
If you run a modified Portal build or your own search files, you can still upload them under Configuration. Nothing about that changed.
The full picture, including what to look for in your own page source:
Jannis Fedoruk-Betschki
