How to Detect Google Font API on Any Website (API Guide)

Google Fonts is the most widely embedded third-party asset on the web that nobody thinks of as a third party. A single stylesheet link to fonts.googleapis.com pulls a typeface onto the page, and that link has been pasted into WordPress themes, page-builder templates, and hand-written sites for over a decade. The result is that a large share of all websites make a request to Google before the first paragraph renders, and since 2022 that request has carried GDPR consequences in parts of Europe.

This guide covers how to detect Google Font API on a single site by hand in under a minute, why the manual checks fall apart the moment you have a list of domains, exactly what the DetectZeStack fingerprint matches (and what it does not), and how to go from one /demo call to a batch scan. Every API response below comes from the live API against a real site.

What Is the Google Font API (and Why It Shows Up on Half the Web)

The Google Font API, marketed simply as Google Fonts, is a free hosted font service. A page requests a CSS file from fonts.googleapis.com naming the families and weights it wants, Google returns @font-face rules tuned to the requesting browser, and the browser then downloads the actual font binaries from fonts.gstatic.com. There is no account, no key, and no cost.

Three integration styles exist, and all three are still in the wild:

• The stylesheet link. A <link rel="stylesheet"> in the head pointing at fonts.googleapis.com/css or the newer /css2 endpoint. This is what the Google Fonts site generates today and what most themes ship.
• The CSS import. An @import url(https://fonts.googleapis.com/css2?...) at the top of a stylesheet. Same request, but hidden inside CSS rather than HTML.
• The Web Font Loader. A JavaScript library, webfont.js, co-developed by Google and Typekit and served from ajax.googleapis.com/ajax/libs/webfont/. Sites call WebFont.load() with a list of Google families and the loader injects the stylesheet and fires events as fonts arrive. Common on older sites and on platforms that let users pick fonts at runtime.

Detection means finding any of those three. The first two are references in HTML or CSS; the third is a script tag with a distinctive host and path.

Manual Ways to Detect Google Font API on a Website

For one site you already have open in a browser, four checks settle the question.

Check the HTML for fonts.googleapis.com and fonts.gstatic.com Link Tags

View the page source (Ctrl+U in most browsers) and search for fonts.g. That prefix catches both hosts. A modern embed looks like this:

<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;700&display=swap" rel="stylesheet">

The preconnect hints are boilerplate; the third line is the request that does the work. Older sites use the /css?family=Roboto:400,700 form instead of /css2. Either one is conclusive. From a terminal, the same check is one line:

$ curl -sL https://www.tutorialspoint.com | grep -o 'fonts\.g[a-z]*\.com[^"]*' | head -3
fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap

Look for the Web Font Loader Script (googleapis.com webfont.js)

If the source has no fonts.googleapis.com link, search for webfont. The loader-based integration looks like this:

<script src="https://ajax.googleapis.com/ajax/libs/webfont/1.6.26/webfont.js"></script>
<script>
  WebFont.load({
    google: { families: ['Roboto:400,500', 'Roboto Slab:300,400,700'] }
  });
</script>

The loader stamps state classes on the html element as fonts arrive, the same wf-loading, wf-active, and wf-inactive classes that the Typekit embed uses, because it is the same library. Open the browser console on a suspected site and check:

typeof WebFont
// "object" on a site using the Web Font Loader
document.documentElement.className
// "wf-roboto-n4-active wf-active ..." after fonts load

Blogger's public site is a live example of this pattern. Its homepage loads webfont/1.5.10/webfont.js from ajax.googleapis.com and also carries a plain fonts.googleapis.com/css link, so it exhibits two of the three integration styles at once.

Inspect DevTools Network and Font Tabs

The third check is the network waterfall. Open developer tools, reload the page, and filter requests by fonts.g. A live integration shows the CSS request to fonts.googleapis.com followed by one or more .woff2 downloads from fonts.gstatic.com. Switching the type filter to Font narrows the list to just the binaries. You can pull the same list from the console without watching the waterfall:

performance.getEntriesByType('resource')
  .map(function(r) { return r.name; })
  .filter(function(u) { return u.indexOf('fonts.g') !== -1; });

This is the only manual check that also catches the @import case described next.

Read the CSS for @import url(https://fonts.googleapis.com/css2)

Some themes and page builders keep the Google Fonts request out of the HTML entirely and put it at the top of a stylesheet:

@import url('https://fonts.googleapis.com/css2?family=Playfair+Display:wght@400;700&display=swap');

A source-view search of the HTML finds nothing on such a site. You have to open each linked stylesheet, or rely on the network tab, which sees the request regardless of where it originated. The @import pattern is the reason a negative result from grepping the HTML alone is never fully conclusive.

Why Manual Detection Breaks at Scale (GDPR Audits, Lead Lists, Migrations)

The four checks above take a minute for one site. They stop being viable when the question changes from "does this site use Google Fonts?" to "which of these 500 domains do?" Three workloads hit that wall regularly:

• GDPR compliance audits. In January 2022 the Regional Court of Munich ruled that a website's remote Google Fonts embed transmitted the visitor's IP address to Google without a legal basis and awarded the visitor damages. A wave of near-identical claim letters followed across Germany and Austria. Agencies and hosting providers now audit every client property for remote font embeds, and the embed can hide in a link tag, an @import, or a loader script.
• Lead lists. Google Fonts on a site tells you the team ships a stock theme or a builder-generated page rather than a design system with self-hosted type. For agencies selling redesigns or privacy remediation, that is a qualifying signal to evaluate per domain across a CRM export.
• Migrations. Moving a portfolio of sites to self-hosted fonts, or to a privacy-first mirror, starts with an inventory of which sites still call Google.

Manual checking fails the same way for all three: it does not batch, it is inconsistent between checkers, it records nothing about the rest of the stack, and nobody repeats it monthly by hand.

Detect Google Font API With the DetectZeStack API

DetectZeStack fetches a site's HTML server-side and runs it through a fingerprint database of several thousand technologies, alongside DNS and TLS layers. Google Font API is reported under the Font scripts category at confidence 100 with source: "http", meaning the evidence came from the page body. Fonts load from Google's hosts rather than the customer's, so there is no DNS or TLS artifact to key on.

What the fingerprint matches, and what it does not

Precision matters here, so this is the exact scope. The Google Font API entry in the fingerprint database carries three patterns:

In practice that means the API reports Google Font API when a site uses the Web Font Loader. A site whose only Google Fonts reference is a plain stylesheet link or an @import is not reported by the current scan, and the tutorialspoint.com example above is a live case: the page carries a fonts.googleapis.com/css2 link, the scan completes at full depth, and the Font scripts category comes back with Font Awesome only. For link-only sites, the one-line curl check remains the right tool, and the batch section below shows how to run both side by side. The detection layers and their limits are covered in more depth in the guide to DNS and TLS detection versus browser extensions.

Try it free with the /demo endpoint

The public demo endpoint needs no API key. It is IP-rate-limited, so use it for spot checks rather than list building. Blogger is a convenient live example because its homepage uses the loader:

$ curl -s "https://detectzestack.com/demo?url=www.blogger.com" \
  | jq '.technologies[] | select(.name == "Google Font API")'
{
  "name": "Google Font API",
  "categories": ["Font scripts"],
  "confidence": 100,
  "description": "Google Font API is a web service that supports open-source font files that can be used on your web designs.",
  "website": "https://google.com/fonts",
  "icon": "Google Font API.svg",
  "source": "http",
  "version": "",
  "cpe": ""
}

Note the exact name: Google Font API, singular, with a space before API. Filters that look for Google Fonts return nothing. The version field is empty because the service itself is not versioned; the 1.5.10 in Blogger's script path is the loader library version, not a Google Fonts version.

Full /analyze call with your RapidAPI key

With a free key from RapidAPI, /analyze returns the full stack. This is the complete response for the same domain:

$ curl -s "https://detectzestack.p.rapidapi.com/analyze?url=www.blogger.com" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com"
{
  "url": "https://www.blogger.com/about/?bpli=1",
  "domain": "www.blogger.com",
  "technologies": [
    {
      "name": "Google Cloud",
      "categories": ["Cloud hosting"],
      "confidence": 70,
      "description": "",
      "website": "",
      "icon": "",
      "source": "tls",
      "version": "",
      "cpe": ""
    },
    {
      "name": "Google Font API",
      "categories": ["Font scripts"],
      "confidence": 100,
      "description": "Google Font API is a web service that supports open-source font files that can be used on your web designs.",
      "website": "https://google.com/fonts",
      "icon": "Google Font API.svg",
      "source": "http",
      "version": "",
      "cpe": ""
    },
    {
      "name": "Google Hosted Libraries",
      "categories": ["CDN"],
      "confidence": 100,
      "description": "Google Hosted Libraries is a stable, reliable, high-speed, globally available content distribution network for the most popular, open-source JavaScript libraries.",
      "website": "https://developers.google.com/speed/libraries",
      "icon": "Google Developers.svg",
      "source": "http",
      "version": "",
      "cpe": ""
    },
    {
      "name": "HTTP/3",
      "categories": ["Miscellaneous"],
      "confidence": 100,
      "description": "HTTP/3 is the third major version of the Hypertext Transfer Protocol used to exchange information on the World Wide Web.",
      "website": "https://httpwg.org/",
      "icon": "HTTP3.svg",
      "source": "http",
      "version": "",
      "cpe": ""
    }
  ],
  "categories": {
    "CDN": ["Google Hosted Libraries"],
    "Cloud hosting": ["Google Cloud"],
    "Font scripts": ["Google Font API"],
    "Miscellaneous": ["HTTP/3"]
  },
  "meta": { "status_code": 200, "tech_count": 4, "scan_depth": "full" },
  "cached": false,
  "response_ms": 797
}

Reading the response: Google Font API under Font scripts with confidence and source

Four entries from one page tell four stories, and two of them come from the same script tag. Google Font API is the loader-based font integration. Google Hosted Libraries is reported because the loader is served from ajax.googleapis.com/ajax/libs/, which is the Google Hosted Libraries CDN path. One script, two detections, and both are correct: the page uses Google Fonts, and it fetches the loader from Google's library CDN. The Google Hosted Libraries guide covers that CDN on its own.

The remaining two are infrastructure. Google Cloud arrives from the TLS layer at confidence 70, and HTTP/3 from the response headers. The top-level categories map groups the same detections by category, so .categories["Font scripts"] gives you every hosted font service on the page without walking the array. That is the filter to use when the question is "any hosted fonts at all" rather than "Google specifically", since Adobe Fonts, Typekit, and Font Awesome land in the same category.

The meta object holds exactly three fields: the HTTP status_code, the tech_count, and the scan_depth. Timing lives at the top level in response_ms, and cached reports whether the result came from a recent identical scan.

Yes/no check with /check

When you only need a boolean for one technology, /check is cheaper to parse. The technology name is matched case-insensitively, but it contains spaces, so URL-encode it:

$ curl -s "https://detectzestack.p.rapidapi.com/check?url=www.blogger.com&tech=Google%20Font%20API" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com"
{
  "domain": "www.blogger.com",
  "technology": "Google Font API",
  "detected": true,
  "confidence": 100,
  "version": "",
  "categories": ["Font scripts"],
  "response_ms": 812,
  "cached": false
}

Scan a list of domains with POST /analyze/batch

POST /analyze/batch accepts up to 10 URLs per request and scans them concurrently. Each item in the response carries either a full result object in the single-domain shape or an error string for a domain that could not be fetched:

$ curl -s -X POST "https://detectzestack.p.rapidapi.com/analyze/batch" \
  -H "X-RapidAPI-Key: YOUR_KEY" \
  -H "X-RapidAPI-Host: detectzestack.p.rapidapi.com" \
  -H "Content-Type: application/json" \
  -d '{"urls": ["www.blogger.com", "www.tutorialspoint.com", "example.com"]}'
{
  "results": [
    { "url": "www.blogger.com",        "result": { "...full analysis...": "" } },
    { "url": "www.tutorialspoint.com", "result": { "...full analysis...": "" } },
    { "url": "example.com",            "result": { "...full analysis...": "" } }
  ],
  "total_ms": 2341,
  "successful": 3,
  "failed": 0
}

The script below is built for the GDPR-audit case, where a false negative is the expensive mistake. It reads domains.txt, one domain per line, sends batches of 10 to the API, and records three things per domain: whether the API reported Google Font API, whether a direct fetch of the homepage contains a fonts.googleapis.com or fonts.gstatic.com reference, and the scan depth. A domain is flagged if either signal fires. Partial scans go to a retry file rather than being silently dropped:

#!/usr/bin/env bash
# audit-google-fonts.sh - flag domains with any Google Fonts embed
KEY="YOUR_KEY"
HOST="detectzestack.p.rapidapi.com"

echo "domain,api_detected,link_in_html,font_scripts,tech_count" > google_fonts_audit.csv
: > google_fonts_retry.txt

# Process domains.txt in batches of 10 (the /analyze/batch maximum)
xargs -n 10 < domains.txt | while read -r batch; do
  urls=$(printf '%s\n' $batch | jq -R . | jq -s '{urls: .}')
  resp=$(curl -s -X POST "https://$HOST/analyze/batch" \
    -H "X-RapidAPI-Key: $KEY" \
    -H "X-RapidAPI-Host: $HOST" \
    -H "Content-Type: application/json" \
    -d "$urls")

  # One row per successfully scanned domain
  echo "$resp" | jq -r '.results[]
    | select(.result != null)
    | .result as $r
    | [
        $r.domain,
        (([$r.technologies[].name] | index("Google Font API")) != null),
        ([$r.technologies[] | select(.categories | index("Font scripts")) | .name] | join(";")),
        ($r.meta.tech_count | tostring)
      ]
    | @tsv' | while IFS=$'\t' read -r domain api_hit fonts count; do
      # Second signal: does the served HTML reference Google's font hosts?
      link_hit=$(curl -sL --max-time 15 "https://$domain" \
        | grep -c -m1 'fonts\.g\(oogleapis\|static\)\.com')
      echo "$domain,$api_hit,$link_hit,$fonts,$count" >> google_fonts_audit.csv
  done

  # Unknown: body fetch failed, so absence of Google Font API proves nothing
  echo "$resp" | jq -r '.results[]
    | select(.result != null)
    | select(.result.meta.scan_depth == "partial")
    | .result.domain' >> google_fonts_retry.txt
done

echo "audited: $(($(wc -l < google_fonts_audit.csv) - 1))"
echo "flagged: $(awk -F, 'NR>1 && ($2=="true" || $3=="1")' google_fonts_audit.csv | wc -l)"
echo "retries: $(wc -l < google_fonts_retry.txt)"

A 1,000-domain list becomes 100 batch calls plus one lightweight fetch per domain for the link check. The API row gives you the loader-based detection plus every other hosted font service on the page and the rest of the stack; the grep gives you the link-tag and preconnect cases the API scan does not evaluate. Together they cover all three integration styles except a bare @import inside an external stylesheet, which no HTML-level check catches. For throughput, retry strategy, and a production Python scanner, see how to batch scan 1,000 websites.

Google Font API vs Adobe Fonts vs Font Awesome vs Self-Hosted: Telling Them Apart

Every hosted typography service lands in the same Font scripts category, so a category filter catches all of them and a name filter isolates one. The hosts tell them apart:

A site that has migrated off Google Fonts for privacy reasons usually serves the same typeface from its own domain, so only the request path changes. And a company can use more than one service at once: Adobe Fonts for the brand face, Google Fonts for a secondary UI face inherited from a plugin, and Font Awesome for icons. Companion guides cover detecting Typekit and Adobe Fonts, building a list of companies using Adobe Fonts, and detecting Font Awesome with its version fingerprints.

Get Your API Key and Start Detecting

The free tier includes 100 requests per month with no credit card, which is enough to validate the pipeline on a sample before scaling up:

1. Get your free API key at rapidapi.com/mlugoapx/api/detectzestack.
2. Spot-check a domain you know: curl -s "https://detectzestack.com/demo?url=yourdomain.com" | jq '.categories["Font scripts"]'
3. Run the audit script above against your first 100 domains and read the retry file before you read the audit file.

Conclusion

Detecting Google Font API reduces to three signals: a fonts.googleapis.com or fonts.gstatic.com reference in the HTML, an @import of the same host inside CSS, or the Web Font Loader script on ajax.googleapis.com. By hand, view-source plus the network tab covers all three for one site. At scale, DetectZeStack reports the loader-based integration as Google Font API under Font scripts at confidence 100, returns the rest of the stack in the same call, and /analyze/batch turns a domain list into an audit table ten domains per request. Pair it with the one-line curl for the link-tag case, watch meta.scan_depth so partial scans are retried rather than trusted, and the audit that used to take an afternoon becomes a script you can rerun next month.