What prevents self-hosted licensed fonts being pirated?

Question

I understand that web fonts are distributed in one of two ways:

• They are hosted by the type foundry, who can, to a degree, enforce license restrictions (e.g., hit rate, referral host, etc.)

• You just get the .woff/.woff2 file and host it yourself.

In either case, what stops anyone from downloading the font file and using it themselves? I’m not advocating this, but surely font piracy must be rife; especially if you use something like GitHub Pages, where you can simply checkout the repository, fonts and all.

Answer 1

From a technical POV, nothing stops you from "pirating" -. If you are found to be infringing you may face legal consequence for copyright infringement.

This is no conceptually no different to grabbing images of another website.

Answer 2

The direct answer to your question:

There is not really a 100% foolproof method to prevent the illegal downloading of custom fonts in 100% of cases.

There might be others, but some common practices that can prevent it:

• Only put the fonts used on the site on your server. No sense in loading the entire font family anyways
• Configure server to deny Hotlinking

In Apache, to deny hotlinking this would be sort of boilerplate via htaccess.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)example.com/.*$ [NC]
RewriteRule \.(woff
|woff2|webp|gif|jpg|jpeg|bmp|zip|rar|mp3|flv|swf|xml|php|png|css|pdf)$ - [F]

Since Nginx does not do htaccess it is different, you handle it via conf files. Conventional practice would be to handle this in the "sites enabled" configuration file:

sudo vim /etc/nginx/sites-enabled/website.conf

You could block the whole dir that your fonts are in like this:

location /fonts/ {
   valid_referers none blocked yourexamplesite.com *.yourexamplesite.com;
   if ($invalid_referer) {
      return 403;
   }
}

Hopefully this helps, happy to provide additional info if you still have questions.