Hacker News Reader

Comment by nailer | Hacker News Reader

Since you seem to specialise in this, FYI:

> Mixed Content: The page at 'https://haloads.com/' was loaded over HTTPS, but requested an insecure stylesheet 'http://fonts.googleapis.com/css?family=Lato:400,300,700,900'. This request has been blocked; the content must be served over HTTPS. https://haloads.com/assets/img/favicon.png Failed to load resource: the server responded with a status of 404 ()

View on HN

For Google Fonts, it's best practice to leave out the protocol and link to '//fonts.googleapis.com/...'. It's unhelpful that their link generator still suggests 'http://fonts...'.

Or just download them and serve them from your own domain. If you enable HTTP/2 there is little to no advantage of using a third party for hosting fonts.

Wont they be cached from other peoples websites saving the download?

No. Well, maybe, if you're using one of the most popular fonts, but each combination of weights is a seperate CSS file, that's probably a unique combination and only cached for 24 hours. A reason not to use Google fonts is that it's just another tracking tool in their arsenal. For each request, cookies are sent to Google's servers, so they have enough reason to avoid cache hits.

nowadays I just use 'https://...' instead of '//...' because

* security * I will immediately know if a server doesn't support https, because the image won't load

Thanks for the spot. The issue has been resolved.

Reply on news.ycombinator.com