Fonts, icon sets, analytics libraries and embedded widgets are usually loaded from somebody else's server. That is convenient, and it has three costs people underestimate: performance, privacy obligations, and a dependency you do not control.
The performance argument has changed
The old case for a shared CDN was caching: a visitor who had already loaded that font on another site would have it cached.
Browsers now partition their cache by site, so that no longer happens. Each visitor downloads the font again for your site regardless.
What remains is a connection to another host: a DNS lookup, a TLS handshake, a request, before your page can finish rendering. Serving the file yourself removes all three, on a connection that is already open.
For fonts specifically, self-hosting is now the faster option in most cases. How to Speed Up a Website in the Right Order deals with where it ranks against the larger wins.
The privacy argument is the stronger one
A third-party request sends the visitor's IP address, their user agent, and the page they are on, to a company they have no relationship with, before they have consented to anything.
In several jurisdictions that is a transfer of personal data requiring a basis, and font hosting specifically has been the subject of enforcement. It also happens before any cookie banner, because the request is made as the page loads.
Self-hosting removes the transfer entirely rather than disclosing it. What a Website Needs for Privacy and Cookie Compliance walks through the obligations.
Self-hosting fonts
Download the files, put them in your theme, and reference them with an @font-face rule.
Three things worth getting right.
WOFF2 only for anything modern. Older formats add weight for browsers nobody uses now.
Only the weights you actually use. A family loaded with nine weights when the design uses two is seven unnecessary downloads.
font-display: swap, so text renders in a fallback immediately instead of being invisible while the font loads.
Then check the licence. Open licences generally permit self-hosting; a commercial font may have terms that do not, and that is a question to answer before shipping rather than after.
Preload the one that matters
A font referenced in CSS is only discovered after the CSS is parsed, which delays it.
<link rel="preload" href="/fonts/main.woff2" as="font" type="font/woff2" crossorigin>
Preload the one or two fonts used above the fold, and no more. Preloading everything competes with the resources actually needed to render, which makes the page slower rather than faster.
Icons: use what you need
An icon font or a full icon library loaded for six icons is a large file for a small purpose.
Inline SVG for the icons you use is smaller, needs no extra request, and can be styled with CSS. For a handful of icons it is strictly better.
A full library is reasonable when a site genuinely uses dozens and they change often.
What you cannot self-host
Some things must stay remote, and the answer there is deferral rather than local copies.
Analytics, payment scripts, chat widgets and embedded video all need to talk to their service. What you can control is when they load: after consent, and after the page has rendered.
For embedded video, a click-to-load placeholder removes the third-party request entirely for visitors who never press play, which is most of them, and it is usually the heaviest embed on the page.
The dependency you are removing
A third-party asset is a service that can be slow, blocked, or gone.
A font host that is unreachable from a visitor's network leaves your text unstyled or invisible depending on your CSS. A script host that is slow delays your page by however long it takes to time out.
Self-hosted assets fail only when your own server does, at which point the font is not your problem.
Check what your site actually loads
Open the browser's network tab and sort by domain. Every host that is not yours is a third-party request.
Most sites find something unexpected: a font loaded by a plugin nobody uses, an icon library pulled in by a theme, an analytics script from a service that was replaced a year ago.
Each of those is a request to remove rather than optimise, and removing it is the only change on this page that is unambiguously free.
List what the page loads from elsewhere
The decision starts with an inventory, and most sites load from more external hosts than anybody remembers adding.
curl -s https://example.com/ | grep -oE '(src|href)="https?://[^"]+"' \ | sed 's|.*//||; s|/.*||' | sort | uniq -c | sort -rn
Run it on more than one page. A checkout or an account page typically loads from several more hosts than the home page, and those are the pages where a failure costs money.
Each entry is a company that can see your visitors, and a system whose failure affects your site. Both are reasons to know the list rather than to discover it during an incident.
Serve the file yourself and check it still works
Copying a file locally is straightforward and there are two details that break it.
curl -s -o /var/www/assets/font.woff2 https://cdn.example/font.woff2 curl -sI https://example.com/assets/font.woff2 | grep -iE 'content-type|cache-control'
The type has to be correct or the browser refuses it, and a font served as plain text fails silently with the page falling back to a different typeface.
Cache headers matter too. A locally served asset with no caching instruction is fetched on every visit, which removes the benefit that motivated the change.
Know which dependencies you cannot remove
Some external systems cannot be brought in house, and those deserve a deliberate decision rather than a default.
Payment processing, mapping, video hosting and anything that must run on the provider's own infrastructure fall into this category. So does any script whose licence requires it be loaded from their servers.
curl -s https://example.com/checkout/ | grep -oE 'src="https?://[^"]+"' | sed 's|.*//||; s|/.*||' | sort -u
For each one, decide what the page does when it fails to load. A checkout that renders without the payment script and shows nothing is worse than one that shows a message, and that behaviour is chosen rather than inherited.