Securealy
Check · Launch hygiene · info · passive

Favicon present

A favicon resolves.

Severity
info
Tier
Passive: runs on any URL
Category
Launch hygiene
Fix
Summary below; full runbook in the Fix Kit, Module 01: Ship it
Id
favicon

What this means

Passing means a favicon request on your domain resolves. Failing means /favicon.ico and the icon your HTML names both fail to load, so the browser tab shows a blank or default mark. It is a small thing, which is why its absence is noticed.

How we test it

We parse the home page for a <link rel="icon"> and send a HEAD request to that URL; if there is none, we request /favicon.ico. A 200 with an image content type passes. A 200 with a non-image content type, which usually means a soft 404 serving HTML, warns. A 404 fails.

Why it matters

A missing favicon is the first sign of an unfinished site. It is also a cause of build failures the kit records: a framework's image pipeline rejected a favicon with an alpha channel in a format it did not expect, the build failed, the old deploy kept serving, and the only clue was in the build log. The kit's rule is a flat PNG or ICO, and a read of the build log every time one is added.

The fix

Add a flat 32 x 32 or 48 x 48 PNG at /favicon.png (or an ICO at /favicon.ico) plus a 180 x 180 apple-touch-icon, reference them in every page's head with <link rel="icon" href="/favicon.png" type="image/png" sizes="32x32"> and <link rel="apple-touch-icon" href="/apple-touch-icon.png"> as in the kit's head-og-jsonld.html, and read the build log after the push. Confirm with curl -sI https://YOUR_DOMAIN/favicon.ico https://YOUR_DOMAIN/favicon.png 2>/dev/null | grep -c "^HTTP/2 200", expected at least 1. The full runbook is in the Fix Kit, Module 01.

Prompt for your AI

Paste this into the coding agent that built the app. It reproduces the finding and stops before changing anything; the fix steps are in the kit.

Do not change anything. This is a verification pass.
Run: curl -s https://YOUR_DOMAIN/ | grep -oE '<link[^>]+rel="[^"]*icon[^"]*"[^>]*>' and show me every icon link in the head, or tell me there is none.
For each href it names, run: curl -sI https://YOUR_DOMAIN/THAT_PATH | grep -iE '^(HTTP|content-type)' and show me the output.
Run: curl -sI https://YOUR_DOMAIN/favicon.ico | grep -iE '^(HTTP|content-type)' and show me the output.
Tell me whether an icon file exists in the repo, its path, its format and its pixel size.
List what it would take for a favicon to resolve, and stop there.
Run: curl -sI https://YOUR_DOMAIN/favicon.ico https://YOUR_DOMAIN/favicon.png 2>/dev/null | grep -c "^HTTP/2 200" and show me the output. Expected on a passing site: 1 or more.

Next

Grade your own URL

Every grade lists this check with its evidence for your site. Two free grades a day.