Missing favicon
The icon the pages declare, fetched to check it exists. When it does not, tabs and bookmarks fall back to a blank symbol.
The favicon is the small icon browsers show on tabs, in bookmarks, in history and in some search results next to your site's name. Pages declare it in the head with a link such as <link rel="icon" href="/favicon.svg">. If that address does not answer, the browser falls back to a generic blank symbol, which makes the site harder to spot among open tabs and looks unfinished. Browsers also keep requesting the missing file, adding failed requests to your server logs.
How SiteScan checks it
The scanner takes the first icon the crawled pages declare on the site’s own domain and requests it. If the file answers, the row is green. If it answers with a 4xx or 5xx status, the row turns amber and shows that status. If the pages declare no icon at all, this row does not appear; the missing declaration is reported as a separate page-level issue.
How to fix
Make sure the declared path points at a file that actually exists, and that the deploy includes it. A practical set: an SVG or 32×32 PNG icon declared with rel="icon", a 180×180 PNG declared with rel="apple-touch-icon" for iOS home screens, and a favicon.ico in the root for older software that asks for it without reading the markup. Use root-relative paths so the same declaration works on every page. Check the other internal links too.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Internal links”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data