Self-host your images and fonts

The symptom

Lighthouse listed third-party cookies under Best Practices. The page set no cookies of its own. The photos, though, loaded straight from a stock image service, and each request came back with a cookie.

Why it matters beyond a score

• Every visitor's browser contacts a company you never chose to share them with.
• Every extra host costs a DNS lookup and a TLS handshake before the first image paints.
• If the image service changes a URL, your page shows a broken picture and you find out last.

The fix

1. Download each photo once and convert it to WebP at two widths, 700 and 1400 pixels, served with srcset so a phone gets the small one.
2. Name each file after a hash of its source URL, so the same photo used by two templates is stored once.
3. Serve fonts the same way: variable WOFF2 files from your own domain, one preload for the font in the first heading, and font-display: swap.

After the change the template passed Best Practices, along with the other 104. No Google Fonts request means no visitor IP sent to Google either.

How to check your own site

Open the network panel, filter by domain and look for any host that is not yours. Each one should have a reason to be there. A payment provider on a checkout page does. A font file or a stock photo does not.