What OMGF does on your site
OMGF (Optimize My Google Fonts) is developed by Daan van den Bergh under the Daan.dev brand. It swaps the Google Fonts stylesheets loaded by your theme and plugins for copies stored on your own server, in /wp-content/uploads/omgf/. In practice, the plugin reads each page’s HTML before it is sent, downloads the font files, rewrites the URLs and strips the preconnect, dns-prefetch and preload hints that still point to fonts.googleapis.com and fonts.gstatic.com.
You get two benefits. Your visitors’ browsers no longer connect to Google’s servers, which would otherwise receive their IP address: the developer points out that a German court ruled in January 2022 that this transfer breached the GDPR. And the page skips a connection to a third-party domain, which can make text show up faster. An “Optimize Local Fonts” screen then lets you preload the fonts visible at the top of the page and stop loading weights you don’t use.
OMGF is free on wordpress.org. OMGF Pro, sold on Daan.dev, picks up the fonts the free version can’t see (@import and @font-face in stylesheets or inline, fonts added by JavaScript or Web Font Loader, Material Icons, WordPress.com fonts and the WordPress Font Library) and adds Smart Optimize, Magic Fallbacks and support for multisite, WPML and TranslatePress.
Which sites OMGF is a good fit for
- European sites that care about the GDPR and whose theme or page builder loads Google Fonts from Google’s servers (see our article on the GDPR, IP addresses and WordPress security).
- Sites that want text to render faster:
font-display, preloading above-the-fold fonts and removing unused weights all affect Core Web Vitals. - Sites built with Elementor, Divi, Beaver Builder, Bricks or Oxygen, which the developer lists as compatible, alongside the major caching plugins.
OMGF adds nothing if your theme already hosts its fonts locally or only uses system fonts. If what you mainly want is to upload your own fonts and pick them in the editor, Custom Fonts is a better match. And on a multisite network or a WPML site, automatic support is reserved for OMGF Pro.
OMGF strengths and limitations
Strengths
- Works as soon as it is activated. Google Fonts loaded the standard way are detected and served locally with no setup.
- Resource hint cleanup. The
preconnectanddns-prefetchhints to Google that no longer serve a purpose are removed. - Fine-grained font control. Preloading, unloading by weight or style, and a choice of
font-displayvalue and character subsets. - Built-in monitoring. The Google Fonts checker flags in the admin bar any new fonts that a theme or plugin update has added.
- Test Mode. Optimizations can stay hidden from visitors while you check how pages look.
Limitations
- Partial detection in the free version. Fonts called through
@import,@font-faceor JavaScript are only handled by OMGF Pro. - No effect inside iframes. The plugin can’t process Google Fonts loaded by a Google Maps embed, a YouTube video or reCAPTCHA.
- Automation costs extra. Smart Optimize (preloading and unloading measured page by page) and Magic Fallbacks (fallback fonts that prevent layout shifts) are Pro only.
- Incomplete translations. In several languages, French included, labels such as the “Advanced” tab are still in English.
The OMGF settings we recommend
The settings live under Settings > OMGF, split across the “Local Fonts”, “Advanced” and “Help” tabs. On the “Local Fonts” tab, the “Save & Optimize” button scans the site and applies your choices.
| Setting | Recommended value | Why |
|---|---|---|
| Test Mode Settings > OMGF > Local Fonts | On during setup, then off | Only logged-in administrators (or a URL ending in ?omgf=1) see the local fonts. |
| Font-Display Option Settings > OMGF > Local Fonts | Swap (the default, recommended) | Text appears right away in a fallback font. |
| Load Early Local Fonts > Optimize Local Fonts | One or two fonts visible at the top of the page | Preloading too many files delays the rest of the page; the plugin even warns you when you overdo it. |
| Don’t Load Local Fonts > Optimize Local Fonts | Unused weights and italics | Fewer files to download; then check headings, menus and bold text. |
| Used Subset(s) Settings > OMGF > Advanced | latin and latin-ext (the default) for an English-language site | Every extra subset makes the fonts heavier; add Cyrillic or Greek only if your pages contain them. |
| Legacy Browser Compatibility Settings > OMGF > Advanced | Off (the default) | It hurts file compression and disables variable fonts. |
| Debug Mode Settings > OMGF > Advanced | Off, except while troubleshooting | The developer advises turning it on only when he asks you to; delete the log afterward. |
| Remove Settings/Files At Uninstall Settings > OMGF > Advanced | On only right before a permanent uninstall | Otherwise, the settings and the uploads/omgf folder stay behind after the plugin is deleted. |
- View a page’s source in a private window: no
fonts.googleapis.comorfonts.gstatic.comURL should remain. - Compare with the same page followed by
?nomgf=1, which turns OMGF off for that view. - If a map, a video or reCAPTCHA is still flagged on the OMGF dashboard, deal with it separately (prior consent or a different embed).
- After a theme update, watch the OMGF indicator in the admin bar and run “Save & Optimize” again if new fonts show up.
Fixed OMGF vulnerabilities and the version to run
- CVE-2021-25021, fixed in 4.5.12: the cache directory setting wasn’t validated, which let an administrator delete arbitrary folders when uninstalling the plugin.
- CVE-2023-6600, fixed in 5.7.10: a missing permission check let an unauthenticated visitor change the settings, inject script and delete folders.
- CVE-2026-89417, fixed in 6.3.11: unauthenticated stored XSS through the search parameter of the comments Atom feed.
- CVE-2026-91828, fixed in 6.3.11: an action reachable without an account or a nonce fired a slow server-side request, enough to exhaust PHP and take the site down.
Run at least 6.3.12, which adds several hardening fixes (validation of downloaded files, redirects restricted to your own site), and turn on automatic updates. WP Masquerade Pro removes the traces that name OMGF from your pages, including the /wp-content/uploads/omgf/ font folder, which makes it harder for bots targeting these flaws to spot it, without replacing the update.
What WP Masquerade hides for OMGF
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to OMGF: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
- generated-file folders
Still visible
No known trace
OMGF frequently asked questions
Is OMGF enough to make my site GDPR compliant?
No. The plugin stops IP addresses from being sent to Google for the fonts it processes, but other services (maps, videos, analytics) may still send them. Check the result page by page.
Should I keep my caching plugin?
Yes, OMGF is not a page cache. Since 6.3.14 it clears the page caches it supports, such as WP Rocket or LiteSpeed Cache, when it removes its files; otherwise, purge your cache after each optimization.
Why do some fonts still come from Google?
They are most likely called through @import, by JavaScript or inside an iframe. The first two cases are covered by OMGF Pro; the last one can’t be handled by the plugin.
Can I move the settings to another site?
Yes, since 6.4.0: the “Help” tab offers a settings export and import, also available through WP-CLI (wp omgf export and wp omgf import).