Fonts are loaded from Google's servers

Why it matters

This page loads web fonts directly from Google's servers (fonts.googleapis.com / fonts.gstatic.com). Each visitor's browser therefore sends its IP address to Google to fetch the font. Self-hosting the font files keeps that request on your own domain and avoids the third-party transfer — some EU courts have treated the hot-linked version as an avoidable disclosure of visitor IPs.

How ShipReady detects it

Per-page privacy signals read straight from the fetched HTML and response headers — no extra requests. Page-scoped because trackers, cookies and forms genuinely differ between routes (a marketing homepage vs a bare /login), and the route that carries the signup form is exactly the one worth seeing.

Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.

How to fix it

This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.

This page loads web fonts from Google's CDN (fonts.googleapis.com / fonts.gstatic.com), so every visitor's browser sends its IP address to Google to fetch them. Self-host the fonts instead: download the font files, serve them from your own domain, and reference them with a local @font-face declaration. Tools like Fontsource (npm packages per font) or the Next.js `next/font` loader do this automatically and also remove the extra third-party connection, which is slightly faster as well.

Frequently asked questions

What does "Fonts are loaded from Google's servers" mean?

This page loads web fonts directly from Google's servers (fonts.googleapis.com / fonts.gstatic.com).

How serious is it?

ShipReady rates this low. Worth fixing. Small individually, and they accumulate.

How do I fix it?

Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.

Can I check my own site?

Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.

Related checks

• A device-fingerprinting script is presentmedium
• A form collecting personal data submits via GETmedium
• Session-replay or behaviour-recording script is presentmedium
• Tracking cookie is set before the consent banner can be answeredmedium
• Tracking cookie is set on the first responsemedium
• Analytics or advertising tracker loads without a detected consent steplow