In the case of the font foundry my client was licensing from, ‣ You were not allowed to self-host the font files, and had to load them directly from the hostin

In the case of the font foundry my client was licensing from, ‣ You were not allowed to self-host the font files, and had to load them directly from the hosting URL provided by the font foundry ‣ There was no explicit reporting involved. Every time the font resource was downloaded from their server, the foundry counted that as a licensed pageview. ‣ The foundry used cache control headers[1] on the response, so that every page load required contacting their origin server and could be logged for billing purposes. ‣ The foundry sent an invoice, telling you what your usage was. If your resource download/pageview count was within your contractual limit, you're invoiced your base rate. If your pageview count was above your contractual rate, you pay your base rate + whatever your overage cost was. The WAF did a bunch of stuff, but the primary headache was that they enabled challenge pages[2] for every single visitor as a knee-jerk reaction, with a ridiculously low validity timeframe. So every user got hit with an interstitial Javascript challenge page on first pageload, and if they stuck around for just a bit they'd get hit with another one out of nowhere. And that "other one" could easily be on a background resource load rather than the primary page itself, which would just hang. And the way the interstitial page loaded the final content for traffic that "passed the test" obliterated referral information and made it impossible to make heads or tails of your traffic data. The intent being that automated traffic wouldn't get past the WAF and would never load the actual destination page, and by extension the precious font files. But the way it operated had a lot of nasty side effects that caused a never-ending stream of technical problems, in addition to just being a terrible user experience. [1] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control#requiring_revalidation https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Ca... [2] https://www.imperva.com/blog/how-incapsula-client-classification-challenges-bots/ https://www.imperva.com/blog/how-incapsula-client-classifica...