I understand that web fonts are distributed in one of two ways:

  • They are hosted by the type foundry, who can, to a degree, enforce license restrictions (e.g., hit rate, referral host, etc.)

  • You just get the .woff/.woff2 file and host it yourself.

In either case, what stops anyone from downloading the font file and using it themselves? I’m not advocating this, but surely font piracy must be rife; especially if you use something like GitHub Pages, where you can simply checkout the repository, fonts and all.

2 Answers 2


From a technical POV, nothing stops you from "pirating" -. If you are found to be infringing you may face legal consequence for copyright infringement.

This is no conceptually no different to grabbing images of another website.


The direct answer to your question:

There is not really a 100% foolproof method to prevent the illegal downloading of custom fonts in 100% of cases.

There might be others, but some common practices that can prevent it:

  • Only put the fonts used on the site on your server. No sense in loading the entire font family anyways
  • Configure server to deny Hotlinking

In Apache, to deny hotlinking this would be sort of boilerplate via htaccess.

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)example.com/.*$ [NC]
RewriteRule \.(woff
|woff2|webp|gif|jpg|jpeg|bmp|zip|rar|mp3|flv|swf|xml|php|png|css|pdf)$ - [F]

Since Nginx does not do htaccess it is different, you handle it via conf files. Conventional practice would be to handle this in the "sites enabled" configuration file:

sudo vim /etc/nginx/sites-enabled/website.conf

You could block the whole dir that your fonts are in like this:

location /fonts/ {
   valid_referers none blocked yourexamplesite.com *.yourexamplesite.com;
   if ($invalid_referer) {
      return 403;

Hopefully this helps, happy to provide additional info if you still have questions.

  • @davidgo If we want to discuss further, let's take to a chat. I'm going to delete my comments and the unnecessary comment from my answer. This might distract users just looking for information. Commented Aug 9, 2021 at 18:38
  • Ive likewise deleted my comments.
    – davidgo
    Commented Aug 9, 2021 at 19:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.