Font files are small and on the critical path. A third-party font host adds DNS, TLS and privacy surface. Self-host WOFF2 on Cloud CDN under your hostname.

WOFF2 is enough

Current browsers speak WOFF2. Skip extra legacy formats unless you still have a reason. Version the filename when the face changes and long-cache it.

CORS on the font hostname

If fonts are on a sibling host, set CORS so the site origin can use them. Many teams simply put fonts on the same distribution as the site.

Preload without over-preloading

Preload the one or two faces used in the first paint. Preloading every weight fights LCP.

Licensing still applies

Self-hosting does not change the foundry licence. It changes the delivery path.