Does style-src cover font files?

No. The stylesheet is style-src. The .woff2 fetch is font-src.

Should brochure sites self-host fonts?

Usually yes for OPSEC. Missing font-src is not a roast F by itself if default-src is tight.

Does RoastMyOpsec score font-src?

It grades CSP quality overall and may note known third-party hosts. It does not treat font-src as the only CSP check.

Safety

CSP font-src vs Hosted Web Fonts on Public Sites

November 20, 2022

CSP font-src vs hosted web fonts on public sites is a fetch allowlist versus a privacy and supply-chain choice. font-src lists which origins may provide fonts for @font-face. style-src still controls the stylesheet that points at those files. A Google Fonts (or similar) CDN is extra DNS, cookies-on-some-networks, and a third-party that must stay in the CSP. Self-hosting WOFF2 on 'self' shrinks that blast radius. Mixed content still applies if the font URL is http://. RoastMyOpsec reads CSP quality on the landing HTML and may pattern-match common third-party hosts. It does not score missing font-src as a standalone F, does not download font files, and does not exploit @font-face.

The practical difference

img-src is pictures. font-src is font files. style-src is CSS — including a <link> to fonts.googleapis.com. connect-src is fetch. A tight font-src with style-src https://fonts.googleapis.com still lets that stylesheet run. See style-src vs unsafe-inline and img-src vs mixed content.

Third-party font CDNs are a tracker-shaped dependency even when the page has no analytics tag. First-party analytics and first-party fonts are the same instinct.

How to choose font-src

Brochure: self-host a subset of WOFF2, font-src 'self', no Google Fonts CSS. If a CMS still injects fonts.gstatic.com, name that origin in font-src and the CSS host in style-src — or remove the inject. Report-Only first. Do not set font-src https:.

Control	What it allowlists	Does not replace	Takeaway
font-src 'self'	First-party font files	style-src	Default if you self-host
Hosted font CDN	That vendor's font origin	Privacy of the CSS request	Name it; prefer self-host
style-src	Stylesheets	font-src	The CSS that points at fonts
SRI on CSS	Exact stylesheet bytes	font-src	Pair if the CSS is third-party

When hosted fonts still win

A named font CDN wins when legal or a design system forbids copying files and you accept the extra origin. Self-host still wins for OPSEC on a brochure. Missing font-src is not a roast F if default-src is already tight. Pair with third-party trackers vs first-party analytics.

What the roast can prove

CSP quality signals and known third-party hosts in HTML can surface. Missing font-src is not scored as its own finding. Confirm the directive in the header. Pair with SRI if fonts load through a third-party CSS file.

Common mistakes

The first mistake is font-src * because one display font kept moving CDNs.

The second mistake is self-hosting files but still loading fonts.googleapis.com CSS.

The third mistake is treating Google Fonts as first-party because the brand uses it everywhere.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Does style-src cover font files?: No. The stylesheet is style-src. The .woff2 fetch is font-src.
Should brochure sites self-host fonts?: Usually yes for OPSEC. Missing font-src is not a roast F by itself if default-src is tight.
Does RoastMyOpsec score font-src?: It grades CSP quality overall and may note known third-party hosts. It does not treat font-src as the only CSP check.