Favicon MIME Types for ICO, SVG, PNG and Manifests

Use types that describe the bytes

Serve SVG as image/svg+xml, PNG as image/png, ICO as image/vnd.microsoft.icon or a compatible image/x-icon response, and the web app manifest as application/manifest+json. The filename alone does not establish the media type.

Keep link type attributes consistent with the response. Incorrect declarations can confuse candidate selection and make diagnostics harder even when a tolerant browser still renders the image.

Connected next stepSafari Pinned Tab Icons, SVG Masks and Touch Icons for the closest prerequisite or comparison.

Detect the 200 HTML failure

Single-page application rewrites and custom error handlers often return the HTML shell for a missing icon with status 200. Check the response Content-Type and inspect the first bytes rather than treating status alone as success.

Exclude root icon and manifest paths from catch-all rewrites. Static files should be served before application fallback routing.

Connected next stepFavicon Security: SVG Uploads, SSRF and Tracking for the next connected implementation decision.

Account for nosniff and proxies

X-Content-Type-Options: nosniff reduces reliance on type guessing, which makes accurate response metadata more important. CDNs and object storage can override or infer types during upload.

Verify the final custom hostname after every proxy, CDN and rewrite layer. A correct local development response does not prove the edge response.

Connected next stepOpen the most relevant production tool and verify the decision with a working output.

Create a release check

Request the rendered head, resolve each icon URL, follow redirects and compare declared type, response Content-Type, decoded format and dimensions. Validate manifest icon URLs relative to the manifest URL.

Fail deployment when an icon returns HTML, an unsupported redirect, mismatched bytes, a non-square image or an unexpected MIME type.