The Font on Your WordPress Homepage Might Be Slow, and It Might Be Breaking GDPR

Most business owners pick a website font the way they pick paint for a shopfront: on how it looks, not on what it does. That choice is quietly doing two things nobody warned them about. It is very likely making the page jump around as it loads, which Google now measures and factors into ranking. And depending on how that font gets delivered to a visitor's browser, it may be sending that visitor's IP address to a server in the United States without asking permission first, a data transfer a German court has already ruled unlawful.

Neither problem is hypothetical. Reviewing Core Web Vitals reports across our customer base last month, font-related layout shift showed up repeatedly on sites migrated in from a previous host or an old agency build, never on ones set up correctly from day one. Fix both issues, and you improve a ranking signal and close a compliance gap in the same afternoon.

What Actually Happens When Your Browser Loads a Font

When a WordPress theme or page builder specifies a custom typeface, the most common setup loads it from Google's font service at the moment a visitor's browser requests the page. Custom fonts are now close to universal: roughly 88% of websites use at least one, and Google's own font service still appears on about half of desktop and mobile sites, even as its share slowly falls as more platforms nudge site owners toward hosting fonts themselves ^[1]. Every one of those fonts is an extra file the browser must fetch, parse and apply before the text on the page looks the way the designer intended.

Until that file arrives, the browser has to decide what to show. It can show nothing until the real font lands, show a substitute font and swap it out later, or wait a fixed amount of time and give up on the custom font altogether. That decision, made automatically by default settings most site owners never touch, is one small part of the wider set of factors that decide how fast a WordPress site actually feels, and it determines whether a visitor sees a stable page or one that visibly rearranges itself in front of them.

The Layout Shift Nobody Notices Until It Costs a Click

Google measures this rearranging directly. Cumulative Layout Shift is one of the three Core Web Vitals that decide whether a WordPress site passes Google's mobile performance tests, scored as good at 0.1 or below, needs improvement between 0.1 and 0.25, and poor above that, measured across the 75th percentile of real visits ^[2]. A custom font swapping in for a fallback font is one of the most common causes of a bad CLS score, because the two fonts rarely take up exactly the same space. When the real font lands, the text reflows, and anything positioned near it moves.

Picture a bridal boutique in Athlone whose homepage headline runs in an elegant imported script typeface. On a phone, the fallback system font renders first, narrower than the script face was designed to be. A moment later the real font swaps in, the headline widens, and the "Book a Fitting" button that had been sitting under a visitor's thumb slides sideways. The tap lands on empty space. Most people do not scroll back to find the button again. They tap the next search result instead.

Picking the Right font-display Value

The CSS property controlling this behaviour is font-display, and the value chosen has a direct, measurable effect on layout stability ^[3].

font-display value	What the visitor sees while the font loads	Best used when
swap	Fallback font shows immediately, then swaps to the custom font once it arrives	You want the brand font to load, and can preload it to keep the swap-related shift small
optional	Fallback font shows, and the browser may skip the custom font entirely on a slow connection	Page stability matters more than the brand font appearing on every single visit
block	Text stays invisible for a short window until the custom font arrives	Rarely the right choice for body text; occasionally acceptable for small icon fonts already inlined

swap is the most common default and, paired with preloading the one or two fonts used above the fold, usually gives the best balance between brand consistency and a stable layout. optional is the safer choice if page speed matters more than getting the exact typeface every time a visitor with a slow connection arrives.

The Legal Problem Sitting in Your Site's Head Tag

In January 2022, the Landgericht München, a regional court in Munich, ruled that a website loading fonts dynamically from Google's servers had transferred a visitor's IP address to Google without a lawful basis, and ordered the site's operator to pay €100 in damages ^[4]. It was a small sum attached to a significant finding: pulling a font from Google's service at the moment a visitor loads a page counts as a transfer of personal data, and like any other data transfer under GDPR, it needs a legal basis. The court specifically rejected the idea that convenience counted as one, noting the operator could have hosted the font files themselves.

That ruling triggered a wave of further claims and warning letters against other site operators in Germany, and Dutch regulators have taken a broadly similar position on Google's font service since. Ireland's Data Protection Commission has not published fonts-specific guidance, and no Irish case has tested this directly. GDPR obligations, though, do not stop at a border. The underlying reasoning, a visitor's IP address moving to a server outside the EU without consent, applies to a WordPress site running from Cork exactly as it applied to the one in Munich.

This is not a reason to panic, and it does not mean every site using a font service has broken the law. It does mean verifying which fonts a production site is actually loading, and where those requests go, is worth ten minutes. If you switch to self-hosted fonts, it is still sensible to check with your solicitor on whether your privacy policy needs a small update to reflect the change, rather than assuming the legal risk disappears entirely the moment the Google request is gone.

Self-Hosting Fonts: The Fix, and What It Doesn't Solve

The practical fix is to host font files on your own server rather than calling them live from Google's service. WordPress 6.5, released in 2024, added a built-in Font Library that lets a site owner install a Google-listed font locally: the file downloads once to the site's own server, and every later visitor's browser requests it from there instead of from Google ^[5]. Older, classic themes generally need a plugin or a short manual step to achieve the same result, but the outcome is identical either way: no runtime connection to Google's servers, and no IP address changing hands at the moment someone loads your page.

I approved a font change on a client site once that tested cleanly in a staging environment with a warm cache, and only the next morning did our monitoring flag a Cumulative Layout Shift spike in production, because the staging server had already cached the font and the live one had not. We now verify layout shift on a cold cache before any font change goes from staging to production, not after.

One thing self-hosting does not solve on its own: font updates. Google occasionally revises a font family with small hinting or metric corrections, and a self-hosted copy will not pick that up automatically the way a live connection to Google's service would. If you self-host, put a reminder in the calendar to check for updated versions once or twice a year, or use a plugin that manages that for you. It is a small trade, a modest ongoing task in exchange for a faster, more stable, more clearly compliant page, but it is a real one and worth knowing about before you make the switch.

This is exactly the kind of decision that should not be left to whichever theme or page builder happened to be installed when a site went live. Web60's optimised, performance-focused WordPress stack is built to deliver fast page load times and strong Core Web Vitals scores from day one, running entirely on SmartHost's sovereign Irish cloud rather than routing site assets through infrastructure outside the country.

How to Check and Fix Your Fonts in Four Steps

Verify. Open your site in a private browser window, load the Network tab in your browser's developer tools, and look for requests to fonts.googleapis.com or fonts.gstatic.com. Their presence tells you exactly what you are dealing with before you change anything.

Measure. Check your Cumulative Layout Shift score in Google's PageSpeed Insights or the Core Web Vitals report in Search Console. Anything at or above 0.1 is worth fixing, and anything above 0.25 should move to the top of the list.

Deploy the fix in staging first. Self-host the font files using WordPress's built-in Font Library or a trusted plugin, set font-display to swap or optional, and preload the one or two fonts that appear above the fold.

Roll back if the page still jumps. Test the fix on a cold cache before pushing it to production. If the layout shift score has not dropped below 0.1, check whether your fallback font's width and height are close enough to the custom font's, that mismatch is usually the real cause.

Conclusion

A font is a small decision that carries two real costs: how a page behaves in the second before it settles, and where a visitor's data goes before they have agreed to anything. Both are fixable in an afternoon, and neither needs a full redesign. Check what your site is actually loading, decide honestly whether it still needs to come from Google's servers, and then move on to the next thing that genuinely needs your attention this week.

Frequently Asked Questions

Do web fonts really slow down a WordPress website?

They can, though the bigger issue is usually stability rather than raw speed. A font file adds one more request the browser must complete, and how that request is handled, immediately, with a swap, or not at all, determines whether the page loads smoothly or visibly jumps as the real font replaces a fallback.

Is using Google Fonts a breach of GDPR?

A German court ruled in 2022 that loading fonts dynamically from Google's servers transferred a visitor's IP address without a lawful basis, and awarded damages on that basis. Ireland's Data Protection Commission has not issued specific guidance, and no Irish case has tested this directly, but the underlying GDPR reasoning applies across the EU. Self-hosting fonts removes that specific data transfer.

What is font-display and which value should I use?

It is a CSS property that controls what a browser shows while a custom font loads. swap shows a fallback font immediately and switches once the real font arrives, and is the most common sensible default when paired with preloading. optional is better when page stability matters more than the brand font appearing on every visit.

How do I self-host Google Fonts on WordPress?

WordPress 6.5 and later includes a built-in Font Library that lets you install a font locally rather than loading it from Google at runtime. Older, classic themes usually need a plugin or a short manual step to download the font files and reference them from your own server instead.

What is Cumulative Layout Shift and why does it matter for fonts?

Cumulative Layout Shift measures how much visible content moves around as a page loads. It is one of Google's Core Web Vitals, and a font swapping in for a fallback font with different dimensions is one of the most common causes of a poor score, which can affect both user experience and search visibility.

Do I need to update my privacy policy if I switch to self-hosted fonts?

Switching to self-hosted fonts removes the specific data transfer to Google's servers, which reduces your compliance exposure. It is still worth a brief check with your solicitor on whether your privacy policy's wording needs a small update to reflect how fonts and other assets are now served, rather than assuming no update is needed at all.

Sources