Favicon, canonical, HTTPS: the small signals that say you are real
A favicon, a canonical tag, and HTTPS are small, boring, and easy to skip, which is exactly why their absence signals an unfinished site. Here is what each one actually does, the current favicon rules (the 48px myth included), and why they are worth ten minutes.
Last updated June 17, 2026Three small signals quietly mark your site as a finished, real product: a favicon Google can display, a canonical URL that names your preferred address, and HTTPS. A favicon must be square and at least 8x8px (Google recommends larger than 48x48); the popular ‘must be a multiple of 48’ rule is outdated. A self-referencing canonical tag prevents duplicate-URL confusion. HTTPS is non-negotiable: browsers flag HTTP as ‘Not secure,’ and some features and social scrapers require it. None is glamorous; all three are tells, present or absent.
- Favicon: square, at least 8x8px, recommended larger than 48x48, any valid format, declared with
<link rel="icon">at a stable, crawlable URL. The ‘multiple of 48’ rule is a myth per Google’s current docs. - Canonical: a
<link rel="canonical">tag naming your preferred URL, so duplicates (www vs non-www, trailing slashes, parameters) do not split your signals. Self-referencing is good practice. - HTTPS: required, not optional. Browsers mark HTTP ‘Not secure,’ it is a ranking signal, and X requires HTTPS to fetch your OG image.
- All three are cheap and their absence is a visible tell. A missing favicon or an http:// URL reads as unfinished to humans and machines.
A favicon, a canonical tag, and HTTPS are three small signals that quietly mark your site as a finished, trustworthy product, and they are easy to skip precisely because they are boring. That is the trap: their absence is a visible tell. A generic globe where your favicon should be, an http:// “Not secure” warning, duplicate URLs splitting your signals, each one whispers “unfinished” to both visitors and machines. Here is what each does, the current rules, and why the ten minutes is worth it.
01 · Be recognisableFavicon: the icon Google and browsers show
Your favicon is the little square icon next to your site in browser tabs and, since search results turned more visual, next to your listing in Google. Without one, you get a generic globe, which reads as anonymous and unfinished.
The current rules, from Google’s own documentation, are simpler than the folklore:
- It must be square (1:1 ratio) and at least 8x8 pixels. Google recommends larger than 48x48 (such as 96x96 or 144x144) so it stays sharp.
- Any valid format works: ICO, PNG, or SVG.
- Declare it with a
<link rel="icon">tag, keep the URL stable, and make sure it is crawlable (not blocked in robots.txt).
<link rel="icon" href="/favicon.svg" type="image/svg+xml" />
<link rel="icon" href="/favicon-96.png" sizes="96x96" type="image/png" />You will often read that a Google favicon must be exactly a multiple of 48px (48, 96, 144). That was an older guideline, and Google’s current documentation does not require it: the real rules are square and at least 8x8, with larger-than-48 recommended for sharpness. So do not throw away a perfectly good 64x64 or 192x192 icon because of the multiple-of-48 myth. Square and big enough is the actual bar.
02 · Don't split yourselfCanonical: name your preferred URL
The same page can be reachable at several URLs: www and non-www, http and https, with or without a trailing slash, with tracking parameters tacked on. To a search engine those can look like separate, duplicate pages, which splits your signals across versions of the same thing.
A canonical tag fixes this by naming the one URL you want treated as authoritative:
<link rel="canonical" href="https://pagewatch.dev/pricing" />For most pages, a self-referencing canonical, where each page points to itself as the canonical, is the correct and simplest setup. It removes the ambiguity without you having to reason about edge cases. Many frameworks can generate these automatically.
03 · The baselineHTTPS: not optional
HTTPS is the floor, not a feature. On plain HTTP, browsers display a “Not secure” warning, which is the first impression a visitor gets. Beyond that, HTTPS is a Google ranking signal, and platforms like X require an HTTPS URL to fetch your Open Graph image, so an http:// site can break its own link previews.
There is no cost reason to skip it: HTTPS is free and automatic through Let’s Encrypt or a CDN like Cloudflare. Shipping on HTTP in 2026 reads as broken or abandoned, so this is a non-negotiable part of looking real.
04 · Present or absentWhy these are tells
None of these three will win you users on their own. Their power is as signals. Present, they say “this is a finished, real product.” Absent, they say “someone deployed a template and stopped.” A new product is fighting for trust it has not earned yet, and a generic-globe favicon, an “http://” warning, or messy duplicate URLs all undercut that trust for no good reason. They are Findable signals you fully control, and clearing all three is one short pass through your <head> and your host settings. While you are there, check for the default-template metadata that ships from the same neglect.
Common questions
<link rel="icon"> tag, keep the URL stable, and make sure Googlebot can crawl it. The widely-repeated rule that it must be a multiple of 48 is outdated; square and large enough is what matters.<link rel="canonical"> tag tells search engines which URL is the preferred version of a page when several URLs show the same content, like www and non-www, http and https, or versions with tracking parameters. Without it, those variants can split your ranking signals or be treated as duplicates. The simplest correct setup for most pages is a self-referencing canonical: each page names itself as the canonical, which removes ambiguity.Get your free launch-readiness score
See what else is between your product and its first real users — Nilkick scores your readiness and hands you the map. Free, no login.
https:// optional · no account · we don't email you
Why your link looks broken when pasted, and the Open Graph tags that fix it
When your link shows up as a bare URL in Slack or X, you are missing Open Graph tags. The four that matter, the X card tag, and why they must be in your server-rendered HTML.
The default-deploy metadata that screams "unfinished"
A 'Vite App' title, a missing description, a globe favicon, a bare-URL link card: the default metadata that ships with a template and tells everyone you never finished. The tells, and the 15-minute fix.
Title tag and meta description for a product no one is searching for yet
When nobody searches your name yet, your title tag should lead with what you do, and your meta description should read like ad copy. Lengths, what Google rewrites, and what to write.