Hi Alex!
My theme (and most of my plugins) are custom-written, but I really should open-source more of it. If you’re developing an indieweb-friendly theme from scratch, you might learn a lot from e.g. IW Twenty Fifteen.
I’ll write a proper blog post about “how my blog works” at some point, but the short version might look like this: the important plugins I’m using are:
Classic Editor (some of my plugins, especially the ones I’ve written myself, aren’t Gutenberg-friendly yet).
A handful of plugins to help manage my custom-PESOS (e.g. this one which imports my geocaching logs) integrations.
IndieAuth for IndieAuth authentication, but IndieLogin is probably fine for most people.
Post Kinds, for post types
Webmention/Semantic-Linkbacks for webmention management
Syndication Links to streamline backend admin of my POSSE publishing
Some security-related plugins providing my backups, MFA, etc.
Then my theme:
(a) tweaks image/thumbnail sizes
(b) adds extra post types (collection, comic, and review)
(c) hides the front-end links shown by syndication-links (I manually show them in my theme templates)
(d) removes WP’s own “feed links” from the <head> (I add these manually in order to publicise different URLS for different “post type” feeds)
(e) provides shortcodes that I use to power my homepage (with its recent articles, recent “other stuff”, random old article-of-the-day, how-many-things of type etc.) and other pages (e.g. my under-development geo*stats page)
(f) replaces most Gravatar links with an internal proxy (for caching and privacy)
(g) selectively auto-approves webmentions (based on this code)
(h) adds “kinds” to the RSS feeds, as per this post!
(i) REMOVES a lot of things I don’t like; e.g. many plugins try to add their own front-end CSS and JS, which I rarely want, so I un-hook them all (for performance and privacy)
(j) adds a service worker, app manifest etc.
The whole thing then sits behind an Nginx reverse proxy which runs PageSpeed across most of the output and caches it (for performance). The net result is that you can visit danq.me with an ad-blocker on (which’ll be the subject of a future post!), and with third-party resources (JS, CSS, and images!) blocked, and virtually everything will still work as it should! No privacy-leaking/performance-degrading third-party nonsense here!
If that’s an intimidating shopping list, don’t despair: it wasn’t built in a day! It represents many gradual iterative improvements, which is absolutely the way to run a personal blog IMHO. If you don’t already, check for a local Homebrew Website Club (or consider joining me at IWC London 2020 if you’re in that neck of the woods; these folks are great for inspiring you to “go further” with your personal web presence!
Hope that helps! More in an actual blog post, someday!