How the scanner works

Method

The scanner is a plain HTTP client, not a browser. For each scan our server makes one request for the page you enter (following up to 5 redirects), then requests the stylesheets that page references: <link rel="stylesheet">, stylesheets named in <link rel="preload" as="style">, @import chains up to 3 levels deep, and font stylesheet URLs found in inline scripts. It reads <style> blocks and style attributes in the page itself.

Third-party stylesheets, for example from fonts.googleapis.com, are fetched the same way so that their @font-face rules can be read. Font files themselves are never downloaded, and JavaScript is never executed. Every finding therefore describes what is referenced in the page source, not what a browser was observed loading.

Requests identify themselves with the user agent HeyMadeFontsScanner/1.0 (+https://heymadefonts.com/scan/about). We do not crawl beyond the submitted page, so robots.txt is not consulted; we treat it as informational. No cookies, logins or credentials are ever sent.

Detection rules

Scanner version 1.0.0, rules version 2026.11.1. Each report records the versions it was produced with.

Detection rules

Rule	What it means
GF_CSS_REFERENCED	Google Fonts stylesheet referenced. The page source references a stylesheet on fonts.googleapis.com.
GF_STATIC_REFERENCED	Google Fonts font files referenced. Stylesheets referenced by the page declare @font-face sources on fonts.gstatic.com.
EXTERNAL_FONT_PROVIDER	Third-party font service referenced. The page source references fonts or font stylesheets on a third-party host.
SELF_HOSTED_FONT	Fonts served from the site's own domain. The page source references font files on the scanned site's own registrable domain (or embedded as data URIs).
FONT_PRELOAD	Font preload declared. The page declares <link rel="preload" as="font"> for one or more font files.
FONT_PRECONNECT	Connection hint to a font host. The page declares preconnect or dns-prefetch hints for a known font host.
SCRIPT_FONT_LOADER	Script that may load fonts dynamically. The page source contains a script reference or inline code associated with loading fonts at runtime.
FALLBACK_ONLY	No web fonts referenced in the page source. The page and its stylesheets reference no downloadable web fonts.
BLOCKED_SCAN	The page could not be scanned completely. The scanner could not read the page as a normal visitor would see it.
PARTIAL_SCAN	Partial scan: limits were reached. Some content was not analysed because a safety limit was reached or a stylesheet could not be fetched.

Findings carry a severity (info, review or attention) and a confidence (high, medium or low). Severity says how much a finding deserves a look; it is not a legal grade. Known font services are matched by host name, which says who usually operates a host, not where requests are processed or which agreements apply. Font references on the scanned site's own registrable domain count as self-hosted; to decide what "own domain" means we use a bundled list of common multi-part suffixes (such as co.uk or com.au) instead of the full Public Suffix List.

Limits per scan

• One page, plus at most 20 stylesheets.
• At most 25 requests and 12 MB in total; 3 MB per response.
• 30 seconds overall; 5 seconds to connect.
• Only ports 80, 443, 8080 and 8443, and only public internet addresses. Private, local and reserved networks are refused, including after redirects.
• Each website can be scanned a limited number of times per hour.

When a limit is reached the report says so and marks the scan as partial.

What a scan cannot tell you

• This is a snapshot of one public page, fetched once from our server. Other pages of the site were not checked.
• The scanner reads the page source and its stylesheets. It does not run JavaScript, so fonts injected by scripts may be missed.
• Fonts loaded only after a cookie or consent choice, for logged-in visitors, in other regions or on other devices may be missed.
• Findings say what is referenced in the page source; the scanner did not download fonts or observe a browser loading them.
• The absence of a finding does not prove that no font requests to third parties happen.
• A host name tells who usually operates a service, not where data is processed or which agreements apply.
• This report is not legal advice and not a compliance verdict.

What we store and for how long

• The scanned address (without query string once the scan is complete), the findings with redacted evidence, timings and versions.
• A hash of the private owner key. The key itself lives only in a cookie in your browser (or with your API client).
• Reports are deleted automatically 7 days after the scan. You can delete a report at any time from its page.
• Share links are off by default, last at most 7 days, and can be revoked at any time.
• Anonymous daily counts of scans (created, completed, failed) are kept for 30 days. They contain no addresses or identifiers.

More detail is in our privacy notice.

Abuse and opting out

If you run a website and want us not to scan it, or you believe the scanner is being misused, write to [email protected] or use the contact form. Tell us the domain; we can block it from future scans. We can also switch the scanner off entirely at short notice.