Audits @font-face CSS for proprietary foundry families, desktop-format binaries, renamed OFL families and remote Google Fonts hotlinks - the questions a webfont licence audit letter asks. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
npmMCP server (npx)Docker Hubnpx @readystack/webfont-license-audit <file> npx @readystack/webfont-license-audit --mcp docker run --rm -v "$PWD:/w" getreadystack/webfont-license-audit /w
Team? One key for every ReadyStack linter, 5 seats, $149 once
This page is the working piece. The full pack has everything below.
The 12 licence questions a foundry audit letter asks, run against your CSS
LG Muenchen I, 3 O 17493/20, 2022-01-20: 100 euro damages to one visitor for a remote Google Fonts call; a solicitor's reply bills by the hour.
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.
Fourteen findings from twelve rules on a single stylesheet: that is what a front-end developer shipping a site into the EU gets back the first time their CSS is read as a licence document instead of as code. Seven of those fourteen are errors.
Type is the one asset on a web page that is almost always licensed and almost never tracked. Nobody writes a ticket called "confirm the webfont licence". The font arrives in a brand handover, in a theme, or in a pull request from an agency that has since been replaced, and from then on it is simply what the site looks like. The licence, if there ever was one, is a PDF in somebody's mailbox.
Then a letter arrives. Foundries run audits; in Germany a separate wave of warning letters targets one line of CSS. On 2022-01-20 the Landgericht Muenchen I decided case 3 O 17493/20: a website had loaded a font from fonts.googleapis.com, the visitor's IP address went with the request, and the court awarded that visitor 100 euro. One visitor. One ground. One @import line.
Webfont License Audit reads the file the way the letter does. It walks every .css, .scss and .less file in the workspace, parses each @font-face block, and answers four questions with line numbers attached.
Which families does this site serve to a browser? The rule proprietary-selfhost holds 25 foundry names - Helvetica Neue, Gotham, Avenir, Proxima Nova, DIN Next, Frutiger, Graphik, Canela, Apercu among them - and fires when one of them is served from your own server, because a desktop purchase almost never carries a webfont grant.
In which format? desktop-format-served fires on a .ttf, .otf or .eot handed to browsers, since a desktop EULA typically licenses the installed binary, not the one visitors download. font-data-uri fires when the binary is base64-embedded into the stylesheet, which several EULAs treat as a separate grant.
From whose server? google-fonts-remote, adobe-typekit-remote, third-party-font-cdn, myfonts-counter and fontawesome-pro each name a remote host and say what its licence is actually tied to - a domain list, a pageview tier, a per-seat plan.
Under what licence, in writing? no-license-note fires when a stylesheet declares @font-face and carries no licence line anywhere. ofl-attribution-missing fires when one of 23 SIL OFL families is served without the OFL notice travelling beside it. ofl-reserved-font-name fires when an OFL family ships under a modified name, which the Reserved Font Name clause forbids.
The numbers in this article come from the fixtures inside the extension, not from an estimate. _fixtures/clean.css - an Inter and JetBrains Mono stack with its OFL notice present - returns 0 findings. _fixtures/dirty.css returns 14: seven errors, six warnings, one info, and every one of the twelve rules fires on it, so you can read each message before pointing the linter at your own repository.
A language model will recite the SIL Open Font License accurately. It will not tell you that the stylesheet you are shipping tonight has four remote @import lines and five @font-face blocks, and it will not give you the line numbers. Generic CSS linters check syntax and performance; none carry a foundry name list.
The free scan is the whole scan: every file in the workspace, every finding, every line number, all twelve rules, no key. That job finishes on its own. What the full version adds is a different job - turning the finding list into a dated FONT-LICENSE-AUDIT.md and a CSV evidence pack you own and can hand to an auditor, because when the letter arrives what you need is not a linter run, it is a document.
It reads every .css, .scss and .less file in your workspace, parses each @font-face block, and reports webfont licence risks with a rule id, a severity and a line number. Twelve rules cover the declared font-family, every src url including base64 data URIs, remote font hosts in @import lines, and whether the stylesheet carries a licence line at all.
Front-end developers and agency teams shipping websites into the EU and the UK, especially anyone who inherited a stylesheet whose font stack nobody can name a licence for. It is written for the moment a foundry audit letter or a German Google-Fonts warning letter lands and somebody has to answer it with file names and line numbers.
A language model can recite the SIL Open Font License, but it cannot see the four @import lines and the five @font-face blocks in the stylesheet you are shipping tonight, and it will not hand you line numbers. Generic CSS linters check syntax and performance; none of them hold a list of foundry families or the OFL Reserved Font Name clause.
Free, with no key: the entire scan across the whole workspace, every finding, every line number, all twelve rules. Nothing is hidden or counted down. The full version adds a different job - exporting that finding list as a dated FONT-LICENSE-AUDIT.md plus a CSV evidence pack you own, keep, and hand to an auditor or your legal team.
A solicitor reading one stylesheet's font stack and writing the reply to a warning letter bills by the hour. For scale, on 2022-01-20 the Landgericht München I decided case 3 O 17493/20 and awarded a single visitor 100 euro because a site fetched a font from fonts.googleapis.com. That is one visitor, on one ground, from one line of CSS.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Webfont License Audit checks the file you open against 12 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.