One day I searched for my own site on my phone and saw the thing you don't want to see. Next to the result was a generic globe instead of my site's favicon, even though the icon was set up in the page and rendered fine on the browser tab.
The knot: this site sits behind a password gate. Anyone who hasn't unlocked it can't reach the pages, they get bounced to a passphrase screen first. I never thought that would touch the favicon file. It did, and the one who felt it hardest was Googlebot.
Part 1Why Google shows a globe instead of your favicon
When Google renders a mobile search result it puts your favicon next to the title so people recognize the brand. But before it can show one, Google has to actually fetch that favicon file first, not just see that your page declares one.
If Googlebot goes to fetch the file and can't, whether because the file is behind login, blocked by robots, the declared path points to nothing, or the icon doesn't meet requirements, Google won't leave the slot empty. It fills it with a generic globe instead. The globe isn't a Google bug; it's a signal that says "I couldn't fetch your icon."
Seen that way the problem is clear. It's not that the favicon is declared wrong; it's a matter of access. Googlebot arrives like a stranger with no pass. Anything a person without a pass can't reach, it can't reach either.
Part 2Finding the root cause with curl
The most direct move is to look at the favicon file the way Googlebot does: fetch it with no login cookie. curl -I does exactly that, firing a bare request and asking only for the status and headers. A curl with no login is Googlebot's eyes.
At the time the favicon lived at /assets/favicon.svg, inside a folder the password gate blocked as a whole. Here's what curl returned:
The root cause surfaces immediately. /assets/favicon.svg returns 401 to anyone who hasn't unlocked, and the home page returns 302 to the gate. Googlebot, with no cookie, hits the same 401 as curl. With no file it can fetch, it has no favicon to show. The result is a globe.
The lesson here: don't trust what you see in your own browser. Your browser already holds the unlock cookie, so it sees the favicon fine. Googlebot doesn't. Only a clean curl shows the truth the bot sees.
Part 3The fix: favicon at root, open before the gate
Once you know the problem is access, the fix is straightforward: make the favicon file return 200 to someone who hasn't logged in. Two moves did it:
- Move the favicon to the domain root, out of the gated folder. Place it as
/favicon.ico,/favicon.svg,/favicon-96.png, and/apple-touch-icon.png. - Whitelist those paths at the front door. This site's password gate runs in a Cloudflare Worker, so I told it to serve that exact icon set with a 200 before the gate runs. People still unlock to read content, but the favicon is fetchable by anyone.
Run curl again to confirm it's closed out:
The other half you must not skip: declare the icon in the home page <head> for every size, pointing at the root paths.
<link rel="icon" href="/blog/favicon.svg" type="image/svg+xml">
<link rel="icon" href="/blog/favicon-96.png" type="image/png" sizes="96x96">
<link rel="icon" href="/blog/favicon.ico" sizes="48x48">
<link rel="apple-touch-icon" href="/blog/apple-touch-icon.png">
Add one more layer: an Organization JSON-LD with a logo field on the home page. It helps Google associate a brand logo with the site, a supporting signal alongside the favicon itself.
On sizing, Google's guideline says the favicon must be a square, at least 8x8px, but Google recommends larger than 48x48px so it stays crisp on every surface. It must be on the same host as the site, use a stable URL (don't change it often), and, the thing that mattered in this case, be fetchable by Googlebot with no blocking.
Part 4Using it on your own site
If you're seeing a globe instead of a favicon, work through this in order:
- A globe means Google can't fetch your favicon. It's not the image; it's that the file isn't reachable. Assume an access problem first.
- curl -I the real path. Fetch it with no login. A 401, 403, or 302 to a login page means the file is gated; a 404 means the path is wrong or the file is missing.
- Put the favicon at root, freely fetchable. Move it out of any gated folder, declare every size in
<head>, same host. If you have a front door (gate, auth, worker), whitelist the icon paths to 200 before it. - Add Organization logo JSON-LD as a supporting brand-logo signal.
- Verify, then request re-indexing. curl-confirm every path returns 200 to an un-authenticated request, then open Search Console and Request Indexing on the home page.
Then wait. Google recrawls favicons infrequently, anywhere from a few days to several weeks. Even with everything fixed, the icon won't snap back at once. Request Indexing nudges it, but the final timing is Google's. All you can do is make curl prove your side has opened the door for the bot; the rest is time.
- All curl results (401 / 302 / 200) fetched live from productize.life on Jul 8, 2026; this section is written from that work.
- Google's favicon rules (square, recommended larger than 48x48px, same host, stable URL, must be crawlable, recrawl days-to-weeks): Google Search Central: Define a favicon.
- The front door doing the path whitelisting is the same Cloudflare Worker described across this series.