Hosting protocol
How favicon.website serves containers. Other hosts are free to differ, but following these conventions lets tooling and loaders interoperate.
URL layout
| Path | Serves | Cache-Control |
|---|---|---|
| /s/{slug} | Host page (text/html) | no-store |
| /s/{slug}/favicon.png | The FWC-1 PNG (image/png) | public, max-age=300, s-maxage=86400, stale-while-revalidate=604800 |
| {slug}.favicon.website/ | Rewritten to /s/{slug} | — |
| {slug}.favicon.website/favicon.png | Rewritten to /s/{slug}/favicon.png | — |
The host page references the icon with a ?v={updatedAt} query string. Because the host page itself is never cached, publishing a new icon changes the query string and every browser and CDN treats the PNG as a new resource immediately. The bare PNG URL keeps a generous CDN TTL so repeat visits and Showcase cards are cheap.
Response headers
Access-Control-Allow-Origin: *on the PNG. Required by the loader'scrossOrigin = "anonymous"(§8) and by third-party unpackers.X-Content-Type-Options: nosniffon both responses, so a PNG can never be reinterpreted as a script.- The host page is served with
Content-Security-Policyunset. The unpacked payload runs arbitrary author script by design; a CSP here would either block the loader or be trivially bypassed afterdocument.write.
Slug rules
A slug is 3–32 characters matching ^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$ — lowercase alphanumerics and internal hyphens — so that it is also a valid DNS label for subdomain hosting. A reserved list (www, api, docs, showcase, s, admin, …) is refused at sign-up.
Limits
| Limit | Value | Rationale |
|---|---|---|
| PNG size | 400 KB | A 256×256 noise icon is ~197 KB; anything larger is not a favicon |
| Icon dimensions | 16–256 px, square | Browser favicon support |
| Sites per account | 1 | One username, one address |
Bot rendering (planned)
Crawlers do not execute the loader. A host MAY detect known crawler user agents and respond with the server-decoded payload plus Open Graph tags instead of the host page. Because FWC-1 is fully specified, a server can implement §7 with any DEFLATE library — the reference host will use Node's zlib.inflateRawSync — and this path requires no change to the container.