Wonderful Selfhosted Fonts

Why self-host fonts at all?

Every web font a page pulls from someone else’s server tells that server who is
visiting. Before a single letter appears, the browser has to send the visitor’s
IP address, the referring page and the user agent to that provider. Nothing is
cached away, nothing is anonymous — it happens on every page view, for every
visitor.

In the EU that is a data transfer, and it needs a legal basis. A German court
decided in January 2022 (LG München I, 3 O 17493/20) that embedding Google Fonts
without consent violates the GDPR, and awarded damages to the plaintiff; a wave
of warning letters followed. The same reasoning applies to Font Awesome, to icon
fonts pulled from a CDN, and to any other font host.

Serving the fonts from your own domain removes the problem at its source: no
third party is contacted, so there is nothing to consent to and nothing to
declare. Your pages also stop depending on someone else’s uptime.

This plugin removes those requests. Whether your site is compliant overall is a
legal question, and no plugin can answer that for you.

Why another font plugin?

Web fonts arrive on a WordPress site in more than one way. A theme may enqueue a
stylesheet, a page builder may write the font CSS straight into the page, and a
stylesheet from a CDN may pull in font files of its own. Tools that only filter
enqueued stylesheets see the first case and miss the rest — which is why fonts
often still load from a third party after a font localiser reports success.

This plugin looks in all three places, lists what it finds, and tells you where
each request came from. Nothing is downloaded until you say so.

What it does

• Lists every third-party font the site loads, with the family name, the provider and the page it was first seen on.
• Names the source. Each entry shows the plugin or theme that requested it and the stylesheet handle behind it, so you can go and fix the cause rather than only the symptom.
• Stores fonts locally on request. One setting, “Store pending fonts locally”: tick it and everything the table lists as waiting is mirrored — stylesheets together with the font files they reference.
• Survives a move. Mirrored files reference each other by name, not by address, so copying the site from staging to the live domain — or from an IP to a host name — leaves the fonts working.
• Works with page builders. Font CSS written directly into the page is picked up too, not just properly enqueued stylesheets. Divi is supported through its own filter as well.
• Removes the leftovers. Preconnect and DNS-prefetch hints for hosts you no longer load from are dropped, because a hint still opens a connection.
• Respects font licences. Providers whose terms forbid self-hosting — Adobe Fonts, Monotype and the like — are listed with an explanation and never downloaded.

What it deliberately does not do

• reCAPTCHA cannot be fixed this way. The widget runs inside an iframe served by Google. What happens in there is out of reach for any WordPress plugin. If that matters for you, replace the captcha rather than trying to localise it.
• Fonts injected by JavaScript at runtime are not visible to server-side detection.
• Icons are not fonts. Recent Font Awesome versions ship SVG plus JavaScript; this plugin mirrors font files, not icon sprites.

External services

This plugin exists to end the connections your site makes to third-party font
hosts. It never loads a script, stylesheet, image or font from a remote server
into your pages, and it contacts no service of ours: there is no account, no
API key, no registration and no telemetry.

The one thing it does over the network is the localisation itself, and it is
the service this plugin provides: it downloads a copy of the font stylesheets
and font files your site is already loading from a third party, stores them
under wp-content/uploads/wonderful-selfhosted-fonts/, and serves them from
your own domain from then on. A request happens only after you tick “Store
pending fonts locally” in the settings and save, or on the hourly schedule if
you switch that on yourself. Nothing is downloaded while a page is rendered.

Which hosts are contacted therefore depends entirely on what your own site
loads, and on nothing this plugin decides. The names below are the detection
list — the hosts the plugin recognises as font providers so that it can offer
to take their files off your pages. They are not assets it loads:

• Google Fonts — fonts.googleapis.com, fonts.gstatic.com, themes.googleusercontent.com — privacy policy: https://policies.google.com/privacy , terms: https://policies.google.com/terms
• Bunny Fonts — fonts.bunny.net — privacy policy: https://bunny.net/privacy , terms: https://bunny.net/tos
• Font Awesome — use.fontawesome.com, kit.fontawesome.com, ka-p.fontawesome.com, kit-free.fontawesome.com — privacy policy: https://fontawesome.com/privacy , terms: https://fontawesome.com/license
• jsDelivr — cdn.jsdelivr.net — privacy policy: https://www.jsdelivr.com/terms/privacy-policy , terms: https://www.jsdelivr.com/terms
• BootstrapCDN — maxcdn.bootstrapcdn.com, stackpath.bootstrapcdn.com — operated by jsDelivr, privacy policy: https://www.jsdelivr.com/terms/privacy-policy , terms: https://www.jsdelivr.com/terms
• cdnjs — cdnjs.cloudflare.com — privacy policy: https://www.cloudflare.com/privacypolicy/ , terms: https://www.cloudflare.com/website-terms/
• unpkg — unpkg.com — served on Cloudflare, privacy policy: https://www.cloudflare.com/privacypolicy/ , project page: https://unpkg.com/

Providers whose licence forbids self-hosting are recognised as well, so that
they can be reported to you with an explanation. They are listed and never
downloaded from: Adobe Fonts (use.typekit.net, p.typekit.net), Monotype
(fast.fonts.net) and Hoefler & Co. (cloud.typography.com).

Any other font host can be added by name in the settings, one per line; those
are treated exactly the same way and are contacted only by the same explicit
action. Only the URL of the font resource is requested — no data about your
site or its visitors is transmitted.

The “Check front page now” button requests a page of your own site, nothing else.