Fonts occupy a uniquely annoying position in the waterfall: discovered late (behind CSS), render-blocking in effect (text waits on them), and heavier than they need to be by default. The modern toolkit solves each annoyance; estates mostly deploy half of it.
The payload layer
WOFF2 is the only format modern estates need to ship, Brotli-compressed internally, universally supported; format ladders below it are legacy weight. Subsetting is where the real bytes hide: full font files carry glyph ranges your content never uses, and unicode-range subsetting splits families so browsers fetch only the scripts a page displays. Variable fonts consolidate weight-and-style matrices into one file that often undercuts two static cuts, with design flexibility as the bonus. Together: families that shipped hundreds of kilobytes routinely land under a hundred.
The loading behavior layer
font-display decides what users see while fonts travel: swap shows fallback text immediately (content first, a reflow later), optional uses the font only if instantly available (zero disruption, brand sometimes absent), block preserves the old invisible-text behavior nobody should choose. Pair the choice with fallback-font metric tuning, size-adjust and companions letting the fallback occupy the same space, so the swap stops shifting layout, which is the CLS entry in your vitals report. Late discovery is solved by preload for the one or two truly critical faces, with the crossorigin attribute the misuse article warned about.
The system-font counterargument deserves honest airtime: the fastest font is the one never fetched, and modern system stacks are typographically respectable, some celebrated products ship no web fonts at all and bank the entire category of cost. The grown-up resolution is a type budget: brand-critical surfaces (headings, marketing pages) earn the custom faces, dense interfaces and text-heavy views ride the system stack, and the boundary is written down where designers and engineers both signed it. Typography is a real brand asset and a real performance line; pretending either half away is how estates end up with five families or with none, and both extremes are usually wrong.
The delivery layer
Fonts are immutable, version them, cache forever, immutable directive, our validators article’s happy path. Self-hosting through your own edge beats third-party font services on connection reuse (no extra origin handshake) and on the privacy and availability couplings the third-party article catalogued; cross-site cache sharing died with partitioned browser caches, removing the old argument for shared hosts. CORS is mandatory for font fetches, so the crossorigin and Access-Control headers must agree, the classic double-fetch when they do not.
In practice
Audit one template: fonts loaded versus glyphs used (subsetting gap), formats shipped (anything beyond WOFF2 is archaeology), display policy and CLS contribution, preload correctness, cache headers. The full modernization is typically a day of work per estate and pays in LCP, CLS and bytes simultaneously, performance work with typographic sign-off, which is the rarest kind of easy win.
Font audits ride along with performance engagements here: subsetting gaps, display policy, the type-budget conversation mediated.