The favicon check took three tries to be honest

Our SEO checks look at the page we already fetched, so most of them cost nothing extra. One of the newer legs is the favicon check — and it's a good example of how much work hides behind a single "✓" sign.

The naive version

First attempt: does the HTML declare <link rel="icon">? If yes, check passes. This is technically correct and nearly useless — it measures whether the tag exists, not whether a browser will actually show an icon. Sites that serve a perfectly good /favicon.ico without declaring it got flagged as missing, and sites whose declared link 404s passed.

The harder version

So we started probing /favicon.ico — the conventional path browsers hit on every site anyway, declared or not. One extra request inside the existing discovery batch.

Now the question flips: did the response contain an icon, or an error page dressed as a 200? Plenty of servers answer every unknown path with a friendly HTML page and a 200 status. So the first rule became: a < at the start means markup, markup means error page, no icon.

Two more rounds of "not quite"

• SVG icons are markup too. A valid SVG favicon starts with <svg — our rule called every real SVG icon a soft-404. Root element gets checked now: <svg (with an optional <?xml prolog) is icon material, <html/<?xml+anything-else is not.
• Text and JSON error pages don't start with < either. {"error":"no favicon"} and a plain not found were passing as icon bytes. So now: known image magic bytes (ICO, PNG, GIF, JPEG, WebP, BMP) pass, anything printable-text-shaped fails, leftover binary counts as icon.

Three states, not two

The leg doesn't pretend binary certainty. "Served" vs "absent" would be two states; we keep three:

• Declared or served → ✓
• Nothing answers → a small ℹ note
• Ambiguous — a redirect, a 403, a 5xx — falls back to the declaration-only observation, because "we couldn't tell" is not the same as "there isn't one"

That's the pattern across the whole scanner,throughout the whole Site is OK app, just in miniature: measure what's real, say when you couldn't, and never let a plausible-looking 200 talk you into a clean result that wasn't earned.

And at the end, give honest and precise recommendations to the viewer.