I Audited the Favicons of 101 Popular Websites. Most Got a C.

Every favicon guide on the internet, including the ones on this site, tells you roughly the same thing: ship a favicon.ico, a PNG or SVG icon, an Apple touch icon and a web manifest. I wanted to know whether the biggest sites on the web actually do that, so on 22 October 2026 I pointed the favicon.tools checker at 130 well-known websites and wrote down everything it found.

The short version: almost everyone gets the browser tab right, and almost nobody gets everything right. Of the 101 sites I could test, six earned an A. The most common grade was a C.

The full dataset is at the bottom of this post if you want to check my numbers.

How I ran the test

I picked 130 sites by hand across ten categories: search, social, video and music, shopping, news, developer tools, SaaS, reference, big tech, and travel. This is not a random sample or a top-100 traffic list. It's a set of sites most people would recognise, weighted towards the kind of products that have dedicated front-end teams.

For each site the checker:

1. Fetched the homepage once, using a desktop Chrome user-agent, and followed redirects.
2. Read the icon-related tags from the initial HTML (<link rel="icon">, apple-touch-icon, manifest, mask-icon, theme-color). It does not run JavaScript.
3. Downloaded the web manifest, if one was declared, and listed its icons.
4. Requested every icon URL, plus /favicon.ico and /apple-touch-icon.png at the root, and recorded the status code, content type and size.
5. Scored seven checks, each worth the same: a working tab icon, an SVG icon, an Apple touch icon, a web manifest, a high-resolution icon (180px or larger), a theme-color, and every declared icon actually loading.

29 sites couldn't be tested. 23 refused automated requests outright (17 of them with a 403), and another six (LinkedIn, Amazon, IMDb, Temu, Booking.com and Khan Academy) served a bot-check page instead of their real homepage. Scoring a CAPTCHA page would have been unfair, so I excluded them. That leaves 101 sites.

Two caveats worth stating up front. First, this is a snapshot: sites change their markup all the time, and a result here may already be out of date. Second, I ran it from a connection in Morocco, so a few sites (Microsoft, Bing) served a localised homepage.

The headline numbers

Check	Sites passing	Share
Tab icon that loads	101	100%
High-res icon (≥180px)	86	85%
Apple touch icon	78	77%
Every declared icon loads	91	90%
theme-color set	38	38%
Web app manifest	30	30%
SVG favicon	16	16%

And the grade distribution:

Grade	Sites
A	6
B	17
C	58
D	6
F	14

The median score was 57 out of 100. The A grades went to The Guardian, GitHub, Substack, Netlify, Figma and Linear.

A low grade here doesn't mean a site looks broken. Google scored an F, and google.com obviously shows its icon in your tab. What a C or an F means is that the site has made no effort for some surface: no icon for an iPhone home screen, nothing for an Android install, no sharp version for high-density screens. For a search homepage that may be a deliberate choice. For a product that wants people to pin it, it's a gap.

Finding 1: the tab icon is a solved problem

Every one of the 101 sites served a working icon for the browser tab. That's the one part of favicons the whole industry has nailed, and it's worth remembering when you read the rest of this: the basics are easy, and everyone does them.

What surprised me is how many large sites do it with no markup at all. Six sites declared no <link rel="icon"> of any kind: Apple, Reddit, Walmart, Wired, Atlassian and Goodreads. They rely entirely on the convention that browsers request /favicon.ico from the root automatically. It works. It's the strongest argument I've seen for why favicon.ico is still worth shipping in 2026: there are trillion-dollar companies whose tab icon depends on it.

Finding 2: 13 big sites return a 404 for /favicon.ico

The flip side: 13 sites return a 404 when you request /favicon.ico. They include Discord, Notion, Dropbox, Bluesky, Mastodon, Disney+, Hulu, Samsung and DigitalOcean, plus the websites of three front-end frameworks: Vue, Svelte and Astro.

All of them declare a different icon in their HTML, so browsers find a tab icon anyway. But browsers still request /favicon.ico in some situations, and so do RSS readers, bookmark tools, link-preview bots and older crawlers. Every one of those requests becomes a 404 in the server logs and a red line in the console. I wrote up why that 404 is worth fixing, and the fix is a single file.

Finding 3: one in six "favicon.ico" files isn't an ICO

This was the finding I didn't expect. I read the first few bytes of every /favicon.ico that returned a 200, because the file extension doesn't tell you what's inside. Of the 88 that loaded:

• 69 were real ICO files.
• 15 were PNG images with an .ico name, including X, Reddit, Pinterest, TikTok, Yahoo, MDN, Cloudflare and Wix.
• 4 were HTML pages. Instagram, Threads, Zalando and Duolingo answered /favicon.ico with a 200 status and a web page instead of an image.

The PNG-in-disguise files work fine in modern browsers, which decode an image from its contents rather than its extension. They're a sign that someone exported a PNG and renamed it, which is harmless but means the file holds a single size.

The HTML responses are a real problem, and a sneaky one. They're "soft 404s": the server says the file exists, but what comes back isn't an image. Zalando and Duolingo return HTML to every client I tried. Instagram and Threads are stranger: a plain curl request gets a real icon, but a request with a Chrome user-agent gets a 585 KB HTML page, even when it sends the same Accept headers a browser uses for images. So depending on how you test it, the same URL either works or doesn't. Any tool that trusts the status code gets this wrong. This one fooled our own checker until this audit. It counted Instagram's /favicon.ico as working until I added a content-type check, so if you ran the checker before today, that's why a result may have changed.

Finding 4: what's inside the real ICO files

ICO is a container that can hold several sizes in one file. Here's how many images the 69 real ICO files contained:

Images inside	Sites
1	25
2	9
3	31
4 or more	4

A three-image file (16, 32 and 48px) is the most common setup, and it's what I'd recommend. Seven sites, including YouTube, IKEA, AliExpress and TechCrunch, ship a single 16×16 image. That looks soft on any high-density screen, and on Windows when someone creates a desktop shortcut. Only four files included a 256px image.

One number kept repeating: 19 different sites served a favicon.ico of exactly 15,086 bytes. That isn't a coincidence or a shared file. It's the exact size of an ICO holding uncompressed 16, 32 and 48px images: a 54-byte header and directory, then 1,128 + 4,264 + 9,640 bytes for the three bitmaps. It's what many favicon generators and image tools produce.

You can do much better. ICO entries can be stored as compressed PNG data, which every browser from the last decade supports. When I saved our own logo as the same three sizes with PNG compression, the file came to 2,746 bytes, about a fifth of the size. The largest real ICO in the set was Squarespace's at 87,598 bytes, followed by Docker's at 76,693.

Finding 5: Apple touch icons are more common than they look

78 sites (77%) give iOS a home-screen icon. But only 59 of them declare it with a <link rel="apple-touch-icon"> tag. The other 19, including apple.com and GitHub, simply put a file at /apple-touch-icon.png and let iOS find it there. iOS checks that path by convention when no tag is present, the same way browsers check /favicon.ico.

I'll admit this one corrected me. Several guides on this site said iOS falls straight back to a page screenshot when the tag is missing, and I've since fixed them. The real order is: the tag, then /apple-touch-icon.png at the root, then a snapshot of the page. The iPhone favicon guide now covers this properly.

That still leaves 23 sites with no working Apple touch icon, including Google, YouTube, Spotify, Slack, Adobe, Dropbox and Best Buy. Save any of them to an iPhone home screen and iOS has to improvise.

Four sites (Naver, Vimeo, Dailymotion and Baidu) still use apple-touch-icon-precomposed, a variant that stopped meaning anything with iOS 7 in 2013.

Finding 6: SVG favicons are still rare

Only 16 sites (16%) ship an SVG favicon. They're mostly the places you'd expect: GitHub, MDN, Figma, Linear, Netlify, Stripe, Deno, Vue, Astro, DigitalOcean, OpenAI, Tumblr, Substack, MIT, The Guardian and The Washington Post. Developer-tool companies account for seven of the 16.

I didn't count mask-icon towards this. That's Safari's old single-colour pinned-tab icon, and it's still present on 17 sites even though Safari has used normal favicons in its tabs for years. It's first on my list of legacy tags you can delete.

SVG is the format I'd most like to see more of. It's one small file that stays sharp at every size, and it's the only format that can switch colours for dark mode with a media query. At 16%, it's still a nice-to-have even among companies with large front-end teams.

Finding 7: most sites aren't ready to be installed

A web manifest is what Android and desktop Chrome read when someone installs a site as an app. Only 30 sites (30%) declared one, and of those, 21 included a 512px icon, which Chrome expects (along with a 192px one) before it treats a site as installable. Three sites (Disney+, Hulu and Samsung) declared a manifest with no icons in it at all.

For news sites and online shops that's understandable. For SaaS products people use all day, it's a missed opportunity. Of the 19 SaaS and productivity sites I tested, only two had a manifest. Their average score, 52, was the second lowest of any category, ahead only of shopping (45, from just seven testable sites). Developer tools and news sites led at 71 and 70. If you want the details on what a manifest needs, I covered that in the web app manifest guide.

Finding 8: ten sites declare icons that don't load

On 10 of the 101 sites, at least one declared icon failed to load. A few examples:

• Asana declares nine Apple touch icons, and all nine returned a 401 to my request.
• Stripe's tab icon and Apple touch icon both returned a 400.
• Dailymotion's manifest lists six Android icons, and all six returned a 403.
• JetBrains links to a favicon.svg that returned a 404.
• TikTok declares an icon whose address is an empty data URI (data:;base64,=).

To be fair to these sites, some of those 401 and 403 responses are probably bot protection on their image CDNs, and a real browser with cookies may get the file. But a crawler won't have those cookies, and that includes the crawler Google uses to fetch the favicon shown next to your search results. If your icons sit behind that kind of protection, it's worth checking that Google can reach them. Our guide to favicons missing from Google Search covers what Google needs.

Finding 9: theme-color is mostly white

38 sites set a theme-color, which tints the browser's address bar on mobile. Twelve of those 38 set it to plain white, which is also what most browsers show anyway. It's not wrong, but it means a third of the sites that bothered with the tag picked the one value that makes no visible difference.

What I'd copy from the A-grade sites

The six A-grade sites don't do anything exotic. They do the boring things consistently. Put together, this is the set I'd ship on any new site:

<link rel="icon" href="/favicon.ico" sizes="32x32">
<link rel="icon" href="/icon.svg" type="image/svg+xml">
<link rel="apple-touch-icon" href="/apple-touch-icon.png">
<link rel="manifest" href="/site.webmanifest">
<meta name="theme-color" content="#your-brand-color">

Plus the files behind those tags:

• A favicon.ico containing 16, 32 and 48px images, stored as PNG data to keep it small.
• An SVG icon, ideally with a dark-mode media query inside it.
• A 180×180 PNG Apple touch icon with an opaque background, also copied to /apple-touch-icon.png at the root.
• A manifest with 192px and 512px icons.

That covers every check in this audit. If you have a logo, the favicon converter builds all of these files in one go. To see where your own site stands against these 101, run it through the checker.

The dataset

The full results are available as a CSV: favicon-audit-2026-10.csv. It has one row per site, with the grade, the score, a yes or no for each of the seven checks, and what /favicon.ico actually contained (status code, real format, size in bytes and the sizes inside). The 29 sites I couldn't test are listed as "blocked".

If you spot a mistake, or a site has fixed something since 22 October, let me know and I'll update the numbers. I plan to run the same audit again in six months to see what changes.