Web-font licence exposure
Your build pipeline renamed the file.
The licence is still inside it.
Foundries have started auditing. Printers, agencies and in-plant shops are opening letters about fonts a developer self-hosted years ago, on a site nobody has looked at since.
Glyphwatch downloads the font files your page actually serves and reads the licence the foundry embedded in each one — not the filename, which lies.
- Exposed
- Commercial font on your own origin, no open grant.
- Check
- Served through a licensed service — verify the tier.
- Review
- Licence could not be determined. Needs a human.
- Clear
- Openly licensed, or a font the visitor already has.
Helvetica Neue LT Pro
Commercial font served from your own origin
Served from your own origin with no open-licence grant — its metadata names the commercial foundry Monotype Imaging Inc. Converting a desktop font for web use is the single most common finding in foundry audits.
- Copyright
- © 2019 Monotype Imaging Inc. All rights reserved.
- Embedded licence
- “This font may not be embedded in web pages without a separate licence for @font-face use.”
01 — Method
It reads the part nobody renames
Every OpenType file carries a name table written by the foundry's own tooling. It travels with the binary through every subsetting step, every CDN, every rename to brand-bold.woff2.
- ID 1 Family The real family name, not the filename your pipeline invented.
- ID 8 Foundry Who made it — and therefore who audits it.
- ID 13 Licence Often the full EULA text. This is where “desktop use only” hides.
- ID 14 Licence URL Subsetted web fonts usually drop the prose and keep this. Glyphwatch reads both.
Getting this out of a .woff2 means walking a Brotli-compressed table directory to find where the name table starts. That is the whole reason a tool has to exist rather than a spreadsheet.
02 — Position
Whose side the instrument is on
Glyphwatch sells nothing but the reading. It has no font catalogue, no licences to upsell, and no relationship with any foundry.
Today, the most capable font-compliance tooling belongs to Monotype — the same company whose letters prompted you to search for this.
That is a reasonable thing for them to build. It is not a neutral instrument for the person receiving the letter.
03 — Limits
What it does not do
- It is not legal advice. It reports exposure indicators — the patterns audits look for. It never tells you that you are infringing, because that is not a thing software can know.
- It reads what your server sends. Fonts injected only by JavaScript after load are not seen.
- It scans one page. Other pages may serve other fonts. Whole-site crawling is what the paid tier is for.
- A clean report is not a licence. It means nothing obvious is exposed on that page.
Coming next
Glyphwatch Monitoring
The scan above is a snapshot. The problem is that a designer swaps a font in a theme update eighteen months from now and nobody notices until the letter arrives.
Monitoring watches every page of every site you list, re-reads the font files weekly, and emails you when something changes — plus a dated PDF of what was being served and when.
€29 per month, up to 10 sites