The direct answer to your question:
There is not really a 100% foolproof method to prevent the illegal downloading of custom fonts in 100% of cases.
There might be others, but some common practices that can prevent it:
- Only put the fonts used on the site on your server. No sense in loading the entire font family anyways
- Configure server to deny Hotlinking
In Apache, to deny hotlinking this would be sort of boilerplate via htaccess.
RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)example.com/.*$ [NC]
RewriteRule \.(woff
|woff2|webp|gif|jpg|jpeg|bmp|zip|rar|mp3|flv|swf|xml|php|png|css|pdf)$ - [F]
Since Nginx does not do htaccess it is different, you handle it via conf files. Conventional practice would be to handle this in the "sites enabled" configuration file:
sudo vim /etc/nginx/sites-enabled/website.conf
You could block the whole dir that your fonts are in like this:
location /fonts/ {
valid_referers none blocked yourexamplesite.com *.yourexamplesite.com;
if ($invalid_referer) {
return 403;
}
}
Hopefully this helps, happy to provide additional info if you still have questions.