PHPackages                             jeffersongoncalves/laravel-favicon-proxy - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Utility & Helpers](/categories/utility)
4. /
5. jeffersongoncalves/laravel-favicon-proxy

ActiveLibrary[Utility & Helpers](/categories/utility)

jeffersongoncalves/laravel-favicon-proxy
========================================

A Laravel package that proxies and server-side caches website favicons (Google S2 by default) behind a same-origin route, so visitors' browsers never hit the third-party favicon service. Validates the upstream content-type, sends nosniff, negative-caches failures and falls back to a transparent pixel.

v1.0.0(1mo ago)228MITPHP ^8.2

Since Jun 22Compare

[ Source](https://github.com/jeffersongoncalves/laravel-favicon-proxy)[ Packagist](https://packagist.org/packages/jeffersongoncalves/laravel-favicon-proxy)[ Docs](https://github.com/jeffersongoncalves/laravel-favicon-proxy)[ GitHub Sponsors](https://github.com/jeffersongoncalves)[ RSS](/packages/jeffersongoncalves-laravel-favicon-proxy/feed)WikiDiscussions Synced 2w ago

READMEChangelog (1)Dependencies (11)Versions (2)Used By (0)

[![Laravel Favicon Proxy](https://raw.githubusercontent.com/jeffersongoncalves/laravel-favicon-proxy/master/art/jeffersongoncalves-laravel-favicon-proxy.png)](https://raw.githubusercontent.com/jeffersongoncalves/laravel-favicon-proxy/master/art/jeffersongoncalves-laravel-favicon-proxy.png)

Laravel Favicon Proxy
=====================

[](#laravel-favicon-proxy)

[![Latest Version on Packagist](https://camo.githubusercontent.com/cea4d72c352bd37ffd6d76e778cb140003a1238d26b86f2849839e888655ccd6/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f762f6a6566666572736f6e676f6e63616c7665732f6c61726176656c2d66617669636f6e2d70726f78792e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/jeffersongoncalves/laravel-favicon-proxy)[![GitHub Tests Action Status](https://camo.githubusercontent.com/8988157fbe88f3c87536ecb377ee0d565d26d09a011f6264691f6d5eb09ca313/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6a6566666572736f6e676f6e63616c7665732f6c61726176656c2d66617669636f6e2d70726f78792f72756e2d74657374732e796d6c3f6272616e63683d6d6173746572266c6162656c3d7465737473267374796c653d666c61742d737175617265)](https://github.com/jeffersongoncalves/laravel-favicon-proxy/actions?query=workflow%3Arun-tests+branch%3Amaster)[![GitHub Code Style Action Status](https://camo.githubusercontent.com/fad5596a8faf4cd432e692caf01ee4d295c88a786f7c5063bcb7326951d522d8/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f616374696f6e732f776f726b666c6f772f7374617475732f6a6566666572736f6e676f6e63616c7665732f6c61726176656c2d66617669636f6e2d70726f78792f6669782d7068702d636f64652d7374796c652d6973737565732e796d6c3f6272616e63683d6d6173746572266c6162656c3d636f64652532307374796c65267374796c653d666c61742d737175617265)](https://github.com/jeffersongoncalves/laravel-favicon-proxy/actions?query=workflow%3A%22Fix+PHP+code+styling%22+branch%3Amaster)[![Total Downloads](https://camo.githubusercontent.com/2b6b28186a0bb97cfb54d66057ca703b00d8ef05f6968e2a31b13bd348b64bb6/68747470733a2f2f696d672e736869656c64732e696f2f7061636b61676973742f64742f6a6566666572736f6e676f6e63616c7665732f6c61726176656c2d66617669636f6e2d70726f78792e7376673f7374796c653d666c61742d737175617265)](https://packagist.org/packages/jeffersongoncalves/laravel-favicon-proxy)

Proxy website favicons through your own host. Instead of pointing an external-link `` straight at a third-party favicon service (a cross-origin connection on every page, leaking which links a visitor sees), this fetches the icon server-side once, caches the bytes, and serves them same-origin — the browser never talks to the upstream.

- Default upstream is Google's S2 favicon service; configurable.
- Allowlists raster image content-types (`image/png`, `image/jpeg`, `image/gif`, `image/webp`, `image/x-icon`, `image/vnd.microsoft.icon`) and sends `X-Content-Type-Options: nosniff`. `image/svg+xml` and any non-image response are rejected — an SVG served same-origin can carry ``, so it would otherwise be a stored-XSS vector.
- Caps the upstream response size (`max_bytes`, default 100 KB) to guard against an oversized body.
- Serialises concurrent misses for the same domain with an atomic cache lock (cache-stampede guard).
- Negative-caches failures, falls back to a transparent 1×1 pixel.

Installation
------------

[](#installation)

```
composer require jeffersongoncalves/laravel-favicon-proxy
```

The `/favicon-proxy` route is registered automatically. Point your icons at it:

```

```

Optionally publish the config:

```
php artisan vendor:publish --tag="favicon-proxy-config"
```

Configuration
-------------

[](#configuration)

KeyDefaultDescription`enabled``true`Register the proxy route.`path``favicon-proxy`Route path.`middleware``['throttle:120,1']`Middleware on the route.`endpoint``https://www.google.com/s2/favicons`Upstream favicon service.`query``domain`Query parameter carrying the domain.`size``64`Requested icon size (px).`timeout``6`Upstream request timeout (s).`max_bytes``102400`Maximum upstream response size (bytes); larger responses are rejected.`cache_prefix``favicon`Cache key prefix.`cache_days``30`How long a fetched icon is cached.`negative_cache_hours``6`How long a failure is negative-cached.Security
--------

[](#security)

The proxy only fetches from the fixed `endpoint` host (the visitor controls only the `domain` query string, which the upstream service itself resolves), so it is **not** an open SSRF gateway. This guarantee depends entirely on `favicon-proxy.endpoint` being a **trusted constant** — never derive it from request input, a database value an end user can edit, or any other untrusted source, or you reintroduce SSRF. Keep the route behind the default `throttle` middleware (or your own) as well.

Testing
-------

[](#testing)

```
composer test
```

License
-------

[](#license)

The MIT License (MIT). Please see [License File](LICENSE.md) for more information.

###  Health Score

41

—

FairBetter than 87% of packages

Maintenance90

Actively maintained with recent releases

Popularity13

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity46

Maturing project, gaining track record

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

45d ago

### Community

Maintainers

![](https://avatars.githubusercontent.com/u/411493?v=4)[Jefferson Gonçalves](/maintainers/jeffersongoncalves)[@jeffersongoncalves](https://github.com/jeffersongoncalves)

---

Tags

laraveljeffersongoncalveslaravel-favicon-proxy

###  Code Quality

TestsPest

Static AnalysisPHPStan

Code StyleLaravel Pint

### Embed Badge

![Health badge](/badges/jeffersongoncalves-laravel-favicon-proxy/health.svg)

```
[![Health](https://phpackages.com/badges/jeffersongoncalves-laravel-favicon-proxy/health.svg)](https://phpackages.com/packages/jeffersongoncalves-laravel-favicon-proxy)
```

###  Alternatives

[psalm/plugin-laravel

Psalm plugin for Laravel

3355.4M352](/packages/psalm-plugin-laravel)[laravel/mcp

Rapidly build MCP servers for your Laravel applications.

78727.1M206](/packages/laravel-mcp)[laravel/socialite

Laravel wrapper around OAuth 1 & OAuth 2 libraries.

5.7k113.1M964](/packages/laravel-socialite)[laravel/boost

Laravel Boost accelerates AI-assisted development by providing the essential context and structure that AI needs to generate high-quality, Laravel-specific code.

3.5k26.0M739](/packages/laravel-boost)[fleetbase/core-api

Core Framework and Resources for Fleetbase API

1239.7k25](/packages/fleetbase-core-api)[nativephp/mobile

NativePHP for Mobile

1.1k102.1k123](/packages/nativephp-mobile)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)