title: How to detect/prevent third party code dialling home?
body: <h1>Context:</h1>
  
  <p>Third-party code is common to any open-source CMS e.g WordPress plugins and themes. I've recently encountered articles online regarding plugins/themes sending information to authors.</p>
  
  <h1>My concern:</h1>
  
  <ol>
  <li>I cannot tell <strong>WHEN</strong> a plugin/theme is sending information to the author.</li>
  <li>I cannot tell <strong>WHAT</strong> information a plugin/theme is sending to the author (email, URL, site visit tracking, limited to full database access etc).</li>
  </ol>
  
  <p>Whether an author is using this information maliciously or not, the lack of visibility on this matter is frustrating to me. I'd simply like to know on principle.</p>
  
  <h1>What I've tried:</h1>
  
  <ol>
  <li>I've disabled various functions such as CURL and fopen but it's my understanding that fall-back functions might exist to achieve the same functionality.</li>
  <li>I've secured my website in a multitude of ways including modifying directory/file permissions, malware scans, black-listing, security audits, fire-walls etc.</li>
  <li>I keep an eye on script-blocker for FireFox to detect third parties.</li>
  <li>I run various code scans of plugins/themes for known malicious code and update definitions regularly.</li>
  <li>I've looked at Ghostery for FireFox however this requries the plugin/theme to be active which could be already too late should the plugin/theme be malicious.</li>
  </ol>
  
  <h1>My question:</h1>
  
  <p>How can I tell what plugins/themes are calling home / sending information and exactly what information is being sent? </p>
  
  <ul>
  <li>Do plugins or online solutions exist to detect this?</li>
  <li>Is at simple as disabling certain PHP functions?</li>
  <li>If I need to manually look for code (bearing in mind that malicious code is already scanned for) what functions should I watch out for?</li>
  </ul>