Favicon

A favicon (; short for favorite icon), also known as a shortcut icon, website icon, tab icon, URL icon, or bookmark icon, is a file containing one or more small icons, associated with a particular website or web page. A web designer can create such an icon and upload it to a website (or web page) by several means, and graphical web browsers will then make use of it. Browsers that provide favicon support typically display a page's favicon in the browser's address bar (sometimes in the history as well) and next to the page's name in a list of bookmarks. Browsers that support a tabbed document interface typically show a page's favicon next to the page's title on the tab, and site-specific browsers use the favicon as a desktop icon.
History.
In March 1999, Microsoft released Internet Explorer 5, which supported favicons for the first time. Originally, the favicon was a file called codice_1 placed in the root directory of a website. It was used in Internet Explorer's "favorites" (bookmarks) and next to the URL in the address bar if the page was bookmarked. A side effect was that the number of visitors who had bookmarked the page could be estimated by the requests of the favicon. This side effect no longer works, as all modern browsers load the favicon file to display in their web address bar, regardless of whether the site is bookmarked.
Standardization.
The favicon was standardized by the World Wide Web Consortium (W3C) in the HTML 4.01 recommendation, released in December 1999, and later in the XHTML 1.0 recommendation, released in January 2000. The standard implementation uses a link element with a codice_2 attribute in the codice_3 section of the document to specify the file format and file name and location. Unlike in the prior scheme, the file can be in any Web site directory and have any image file format.
In 2003, the codice_4 format was registered by a third party with the Internet Assigned Numbers Authority (IANA) under the MIME type codice_5. However, when using the codice_4 format to display as images (e.g. not as favicon), Internet Explorer cannot display files served with this standardized MIME type. A workaround for Internet Explorer is to associate codice_4 with the non-standard codice_8 MIME type in Web servers.
RFC 5988 established an IANA link relation registry,
and codice_9 was registered in 2010 based on the HTML5 specification. The popular codice_10 theoretically identifies two relations, "codice_11" and "codice_12", but "codice_11" is not registered and is redundant. In 2011 the HTML living standard specified that for historical reasons "codice_11" is allowed immediately before "codice_12"; however, "codice_11" does not have a meaning in this context.
Legacy.
Internet Explorer 5–10 supports only the ICO file format. Netscape 7 and Internet Explorer versions 5 and 6 display the favicon only when the page is bookmarked, and not simply when the pages are visited as in later browsers.
Browser implementation.
The following tables illustrate support of various features with major web browsers. Unless noted, the version numbers indicate the starting version number of a supported feature.
File format support.
The following table illustrates the image file format support for the favicon.
Additionally, such icon files can be 16×16, 32×32, 48×48, or 64×64 pixels in size, and 8-bit, 24-bit, or 32-bit in color depth. The ICO file format article explains the details for icons with more than 256 colors on various Microsoft Windows platforms.
Use of favicon.
This table illustrates the different areas of the browser where favicons can be displayed.
Opera Software added the ability to change the favicon in the Speed Dial in Opera 10.
How to use.
This table illustrates the different ways the favicon can be recognized by the web browser. The standard implementation uses a link element with a codice_2 attribute in the codice_3 section of the document to specify the files format, name and location.
If links for both PNG and ICO favicons are present, PNG-favicon-compatible browsers select which format and size to use as follows. Firefox and Safari will use the favicon that comes last. Chrome for Mac will use whichever favicon is ICO formatted, otherwise the 32×32 favicon. Chrome for Windows will use the favicon that comes first if it is 16×16, otherwise the ICO. If none of the aforementioned options are available, both Chromes will use whichever favicon comes first, exactly the opposite of Firefox and Safari. Indeed, Chrome for Mac will ignore the 16×16 favicon and use the 32×32 version, only to scale it back down to 16×16 on non-retina devices. Opera will choose from any of the available icons completely at random.
Only SeaMonkey does not fetch codice_1 files in the website's root by default.
Device support.
For Apple devices with the iOS operating system version 1.1.3 or later, as well as some Android devices, it is possible to provide a custom icon that users can display on their home screens by using the "Add to Home Screen" button within the share sheet in Safari. This feature is enabled by supplying a codice_20 in the codice_3 section of documents served by the website. If the custom icon is not provided, a thumbnail of the web page will be put on the home screen instead.
The recommended basic size for this icon is 152×152 pixels.
For the iPad, the basic size is 180x180 pixels. Android tablets [via Chrome] prefer a 192x192 PNG icon.
The icon file referenced by codice_22 is modified to add rounded corners. On the iOS versions prior to iOS 7, a drop shadow, and reflective shine would be added, and codice_23 icon may be provided to instruct devices not to apply reflective shine on the image.
 <link rel="apple-touch-icon" href="https://example.com/image.png">
No HTML is required by browsers or mobile devices to retrieve these icons, either. The website's root is the default location for the file codice_24 (in order of priority).
HTML5 recommendation for icons in multiple sizes.
The current HTML5 specification recommends specifying multiple sizes for the icons, using the attributes codice_25 within a codice_26 tag. Multiple icon formats, including container formats such as Microsoft .ico and Macintosh .icns files, as well as Scalable Vector Graphics may be provided by including the icon's content type in the format codice_27 within the codice_26 tag.
As of iOS 5, Apple mobile devices ignore the HTML5 recommendation and instead use the proprietary codice_22 method detailed above. The Google Chrome web browser however, will select the closest matching size from those provided in the HTML headers to create 128×128 pixel application icons, when the user chooses the "Create application shortcuts..." from the "Tools" menu.
Animated favicons.
Various browsers such as Chrome, Firefox and Opera support animation of favicons. A bug report has been open for Firefox since 2001 requesting a way to disable the feature.
Limitations and criticism.
Due to the need to always check for it in a fixed location, the favicon can lead to artificially slow page-load time and unnecessary 404 entries in the server log if it is nonexistent.
The W3C did not standardize the rel-attribute, so there are other keywords such as "shortcut icon" that are also accepted by the user agent.
Favicons are often manipulated as part of phishing or eavesdropping attacks against HTTPS webpages. Many web browsers display favicons near areas of the web browser's UI, such as the address bar, that are used to convey whether the connection to a website is using a secure protocol like TLS. By changing the favicon to a familiar padlock image an attacker can attempt to trick the user into thinking they are securely connected to the proper website. Automated man-in-the-middle attack tools such as SSLStrip utilize this trick. In order to eliminate this, some web browsers, such as Firefox or Google Chrome, display the favicon within the tab whilst displaying the security status of the protocol used to access the website beside the URL.
Since favicons are usually located at the root of the site directory on the server, they can be employed with some reliability to disclose whether a web client is logged into a given service. This works by making use of the redirect-after-login feature of many websites, by querying for the favicon in a redirect-after-login URL and testing the server response to discern whether the user is given the requested resource (which means they are logged in), or instead redirected to the login page (which means that they are not logged into the service).
In 2021, a method for browser tracking using favicons was demonstrated by researchers at the University of Illinois.