How to hide "fonts" folder from public?

Question

I am using premium fonts on a website and linked them using

@font-face {src: url(../fonts/fontName.ttf);}

The fonts folder is currently accessible by anyone by going to www.website.tld/fonts.

How can I be able to hide fonts directory from public access but still be able to use the fonts in our website.

Thanks.

Answer 1

If you want to prevent font files showing up in your directory listing, use this in your .htaccess

IndexIgnore *.ttf *.woff *.woff2 *.eot, *.otf *.cff *.afm *.lwfn
IndexIgnore *.ffil *.fon *.pfm *.pfb *.svg *.std *.pro *.xsf

Obviously, you should only add the ones you use.
If you want to disable the directory listing of your entire /fonts folder use this instead (same file):

<Directory /path/to/fonts>
  Options -Indexes
</Directory>

This, however, will only disable the listing of those files, not downloading. And disabling listing for resources that have publicly available download links (referenced in CSS in the case of font files) is absolutely pointless.

If you want to prevent clients (people, bots) from "illegally" downloading font files from your server... well, you can't.

You need to allow browsers (clients) to download the font file(s) so they render your website according to your designer's specs. Once used, a copy of any resource exists in the browser and you cannot stop savvy clients from accessing them, because you do not and cannot control their browser.

Your question has, probably, already been answered, in the agreement you signed with the author/vendor of the font. Using the font online is, most likely, clearly defined in that agreement.

If it's not, it is still the vendor/author that needs to provide you with the correct answer. Both technically and legally. And I believe the latter is what actually interests you.

By the way, this is the main reason the use for web is charged extra by most foundries: when they allow it, they allow a free download link (illegal if used for anything other than viewing the content it was provided for). All they can do about it is embed a notice telling the use of their font files without their knowledge and acceptance is illegal.