Font protection

[ausblick]

Hi

I have a customer who plans to use the font they purchased in ProcessWire. They want to protect the font, but still display it (woff2, variable font).
How do you solve this font protection issue, or what ideas do you have for this scenario? 

[markus-th]

A 100% protection is impossible in a browser environment, what a browser can show has to be local.

But you can make it less easy to "steal" the files with preventing direct access and hotlinking to font files

<FilesMatch "\.(woff|woff2)$">
    RewriteEngine On
    RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
    RewriteRule .* - [F]
</FilesMatch>

The most effective way to protect a font is to make it "incomplete" for anyone who steals it. By using the fonttools library (specifically pyftsubset), you can strip away all characters that aren't needed for your specific site. There is a little benefit too, the filesize shrinks 😉

[ausblick]

many thanks @markus-th