Internet Explorer is the only browser that supports EOT, a font format that has digital rights management. That way you can make sure that your $200 font isn’t downloaded and used by everybody on the internet.

But like I said: IE is the only browser that can understand that file type. So Mozilla apparently implemented some sort of protection against font hijackers: It will only accept fonts from domains that specifically allow fonts to be downloaded. In case of Apache you have to add the following code below to the .htaccess file. I found it on Open Font Library.

<FilesMatch "\.(ttf|otf|eot)$">
<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>
</FilesMatch>

This does not help you prevent people from stealing your font, but it will protect you from web developers who want to add the URL to the font on your domain in their font-face declaration. It’s not really a solution if you ask me. It seems more like a gesture to the creators of fonts.

It appears you could replace the asteriks with the domain of your website, but in my case (http://electricspace.blogspot.com/) did not do the job.

Related posts:

1. The trouble with @font-face
2. No sign of @font-face in Chrome 4
3. My favorite for converting fonts to EOT
4. Webfont pitfalls
5. New web font service: Ascenderfonts.com