Audits @font-face CSS for proprietary foundry families, desktop-format binaries, renamed OFL families and remote Google Fonts hotlinks - the questions a webfont licence audit letter asks. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
npmMCP server (npx)Docker Hubnpx @readystack/webfont-license-audit <file> npx @readystack/webfont-license-audit --mcp docker run --rm -v "$PWD:/w" getreadystack/webfont-license-audit /w
Team? One key for every ReadyStack linter, 5 seats, $149 once
Exports the whole finding list as a dated FONT-LICENSE-AUDIT.md plus CSV evidence pack you keep and hand to a foundry auditor or your own legal team.
One payment, one licence key for this tool. The key is shown right after payment.
LG Muenchen I, 3 O 17493/20, 2022-01-20: 100 euro damages to one visitor for a remote Google Fonts call; a solicitor's reply bills by the hour.
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.
Fourteen findings from twelve rules on a single stylesheet: that is what a front-end developer shipping a site into the EU gets back the first time their CSS is read as a licence document instead of as code. Seven of those fourteen are errors.
Type is the one asset on a web page that is almost always licensed and almost never tracked. Nobody writes a ticket called "confirm the webfont licence". The font arrives in a brand handover, in a theme, or in a pull request from an agency that has since been replaced, and from then on it is simply what the site looks like. The licence, if there ever was one, is a PDF in somebody's mailbox.
Then a letter arrives. Foundries run audits; in Germany a separate wave of warning letters targets one line of CSS. On 2022-01-20 the Landgericht Muenchen I decided case 3 O 17493/20: a website had loaded a font from fonts.googleapis.com, the visitor's IP address went with the request, and the court awarded that visitor 100 euro. One visitor. One ground. One @import line.
Webfont License Audit reads the file the way the letter does. It walks every .css, .scss and .less file in the workspace, parses each @font-face block, and answers four questions with line numbers attached.
Which families does this site serve to a browser? The rule proprietary-selfhost holds 25 foundry names - Helvetica Neue, Gotham, Avenir, Proxima Nova, DIN Next, Frutiger, Graphik, Canela, Apercu among them - and fires when one of them is served from your own server, because a desktop purchase almost never carries a webfont grant.
In which format? desktop-format-served fires on a .ttf, .otf or .eot handed to browsers, since a desktop EULA typically licenses the installed binary, not the one visitors download. font-data-uri fires when the binary is base64-embedded into the stylesheet, which several EULAs treat as a separate grant.
From whose server? google-fonts-remote, adobe-typekit-remote, third-party-font-cdn, myfonts-counter and fontawesome-pro each name a remote host and say what its licence is actually tied to - a domain list, a pageview tier, a per-seat plan.
Under what licence, in writing? no-license-note fires when a stylesheet declares @font-face and carries no licence line anywhere. ofl-attribution-missing fires when one of 23 SIL OFL families is served without the OFL notice travelling beside it. ofl-reserved-font-name fires when an OFL family ships under a modified name, which the Reserved Font Name clause forbids.
The numbers in this article come from the fixtures inside the extension, not from an estimate. _fixtures/clean.css - an Inter and JetBrains Mono stack with its OFL notice present - returns 0 findings. _fixtures/dirty.css returns 14: seven errors, six warnings, one info, and every one of the twelve rules fires on it, so you can read each message before pointing the linter at your own repository.
A language model will recite the SIL Open Font License accurately. It will not tell you that the stylesheet you are shipping tonight has four remote @import lines and five @font-face blocks, and it will not give you the line numbers. Generic CSS linters check syntax and performance; none carry a foundry name list.
The free scan is the whole scan: every file in the workspace, every finding, every line number, all twelve rules, no key. That job finishes on its own. What the full version adds is a different job - turning the finding list into a dated FONT-LICENSE-AUDIT.md and a CSV evidence pack you own and can hand to an auditor, because when the letter arrives what you need is not a linter run, it is a document.
It reads every .css, .scss and .less file in your workspace, parses each @font-face block, and reports webfont licence risks with a rule id, a severity and a line number. Twelve rules cover the declared font-family, every src url including base64 data URIs, remote font hosts in @import lines, and whether the stylesheet carries a licence line at all.
Front-end developers and agency teams shipping websites into the EU and the UK, especially anyone who inherited a stylesheet whose font stack nobody can name a licence for. It is written for the moment a foundry audit letter or a German Google-Fonts warning letter lands and somebody has to answer it with file names and line numbers.
A language model can recite the SIL Open Font License, but it cannot see the four @import lines and the five @font-face blocks in the stylesheet you are shipping tonight, and it will not hand you line numbers. Generic CSS linters check syntax and performance; none of them hold a list of foundry families or the OFL Reserved Font Name clause.
Free, with no key: the entire scan across the whole workspace, every finding, every line number, all twelve rules. Nothing is hidden or counted down. The full version adds a different job - exporting that finding list as a dated FONT-LICENSE-AUDIT.md plus a CSV evidence pack you own, keep, and hand to an auditor or your legal team.
A solicitor reading one stylesheet's font stack and writing the reply to a warning letter bills by the hour. For scale, on 2022-01-20 the Landgericht München I decided case 3 O 17493/20 and awarded a single visitor 100 euro because a site fetched a font from fonts.googleapis.com. That is one visitor, on one ground, from one line of CSS.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Webfont License Audit checks the file you open against 12 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →