How to set the favicon, social image, root files and iframe security

Three sections of the editor's Settings panel shape how the site looks and behaves outside its own pages. Site icons sets the little pictures in browser tabs, on phone home screens and in link previews. Root files serves small files like ads.txt at the top of the domain. Security decides whether other websites may show the site inside a frame.

How to set the site icons

1. In the editor, click Settings, then Site icons.
2. Next to Favicon, click Upload or choose and pick an image from the library or upload one.
3. Do the same for Home screen icon and Default social share image if you want them.
4. Each change saves on its own. You'll see "Saved. Publish the site to put it live."
5. Publish or republish the site.

Each box shows the picture the published site actually uses. When you haven't set your own image, it shows the fallback with a small label under the name: Using your Business Info logo (favicon and home screen icon) or Using the favicon (home screen icon, when you've set your own favicon). None means there's truly nothing.

• Upload or choose: pick a new image any time.
• Use the logo: use the Business Info logo for this icon. It only shows when the logo isn't already what's used.
• Remove custom: clear your own image and go back to the fallback (or None).

The Site Audit's Favicon and Open Graph checks read the same settings, so they always match this panel and the live site.

Site icons settings

• Favicon: the icon in browser tabs, bookmarks and search results. Square, at least 48 × 48 px (PNG or ICO). 512 × 512 px looks sharp everywhere. If you leave it empty, the logo in CMS → Business Info is used. A site made with Zeus starts with the client's logo here.
• Home screen icon: used when someone adds the site to their phone's home screen. Square PNG, 180 × 180 px, no transparency. Empty = the favicon (which is the Business Info logo when you haven't set a favicon).
• Default social share image: used on Facebook, LinkedIn, texts and other shares when a page has no social image of its own. 1200 × 630 px (JPG or PNG). A page's own social image always wins. There's no automatic fallback: if this is empty and a page has no social image, links to it show no picture. Click Use the logo to use the Business Info logo. See Page SEO settings.

How to add a root file

1. In the editor, click Settings, then Root files.
2. Click Add file.
3. Type the file name after the /, for example ads.txt or google1a2b3c4d.html.
4. Paste the file's content into the box under it.
5. Click Save files. You'll see "Saved. Live on your domain within 5 minutes (browsers and search engines keep a copy for up to 5 minutes)." No publish is needed.

Once the site has its own domain, each file shows its live link (for example https://yourdomain.com/ads.txt) so you can check it. To remove a file, click the bin icon next to its name and click Save files. Discard changes puts back what was saved.

Root files settings

• File name: either a top-level file or one of the allowed .well-known files.
  • Top-level files end in .txt, .html, .xml or .json. They start with a letter or number and use only letters, numbers, dots, dashes and underscores (up to 100 characters before the ending). Examples: ads.txt, app-ads.txt, google1a2b3c4d.html, BingSiteAuth.xml, pinterest-1a2b3.html.
  • .well-known files must be one of: .well-known/security.txt, .well-known/apple-app-site-association, .well-known/apple-developer-merchantid-domain-association, .well-known/assetlinks.json or .well-known/microsoft-identity-association.json.
  • Some names are taken by files the site makes for you and can't be used: robots.txt, sitemap.xml, llms.txt, llms-full.txt and favicon.ico.
• File content: the text of the file, up to 64 KB.
• How files are served: .json files (and apple-app-site-association) as JSON, .xml as XML, everything else as plain text. HTML verification files are served as plain text, so they can't run code. That's fine for verification: Google, Bing, Facebook, Pinterest and Apple only read the code in them.

If the site has its own domain, a note may say IndexNow is on. Bing and Yandex are then told about changed pages each time you publish. Its key file (a 32-character name ending in .txt) is made for you, and you can't use that name for your own file.

Security settings

• Allow site in an iframe: Off (the default, and recommended) means other websites can't show your site inside a frame. Only the site itself can. This protects visitors from click-jacking, where another site hides your buttons under its own. Turn it On only if you need to embed the site somewhere else, like another website or a kiosk app.

The switch saves as soon as you click it ("Saved. Live within a minute."). No publish is needed.

Examples

• A bakery's new favicon: upload the cupcake logo at 512 × 512 px as the Favicon, leave Home screen icon empty so it uses the same image, and republish.
• Nicer Facebook previews: add a 1200 × 630 px photo of the team as the Default social share image. Every page without its own social image now shows it when shared.
• Google AdSense asks for ads.txt: add a root file named ads.txt with the line Google gives you, and save.
• Verifying a domain with Pinterest by file: download Pinterest's HTML file, open it in a text editor, add a root file with the same name and paste its content in.
• A tourism board shows the site on a kiosk inside another app: turn on Allow site in an iframe.

Limits and what it can't do

• Up to 20 root files, 64 KB each.
• Root files can't be in folders, except the five .well-known files listed above.
• .html and .xml root files can only hold a verification code. Scripts, frames, forms, styles and event handlers are refused.
• There's no way to edit robots.txt, sitemap.xml or llms.txt here. They're made for you. See Sitemap, robots.txt and llms.txt.
• Images must be https:// links. Pick them from the library or upload them; you can't paste an http:// link.
• Allow site in an iframe is one switch for the whole site. You can't allow only certain websites.
• Backups: restoring a backup brings back the favicon, but not the home screen icon, the default social share image, root files or the iframe setting. Those stay as they are now. See Site backups.

Who can use it

Agency people with the Mount Olympus tool. Client people need the Editor permission to see Site icons, Root files and Security. See Client permissions.

Troubleshooting

• The browser tab still shows the old icon: republish the site, then reload the page. Browsers keep favicons for a long time, so try a private window.
• The favicon is blank on the live site: if Favicon is empty and Business Info has no logo, there's no icon at all. Upload one.
• A share preview shows the wrong image: the page probably has its own social image, which wins over the default. Check the page's SEO settings. Facebook and LinkedIn also keep old previews for a while; use their sharing debuggers to refresh them.
• "Images must be https:// links (upload the image or pick it from the library)" or "The favicon must be an https:// image link": choose the image with Upload or choose instead of a link from elsewhere.
• "“…” can’t be used as a root file name. Use names like ads.txt, google123.html or .well-known/security.txt": the name has a folder, a space, a wrong ending or is one of the reserved names. Fix it to match the rules above.
• "There’s already a file called …": two files have the same name (capitals don't count as different). Delete one.
• "… is used by IndexNow": that name belongs to the IndexNow key file. Use another name.
• "… is too large (64 KB max)": the content is too long. Root files are for short text files only.
• "… can only hold a verification code — no scripts, frames or event handlers": an .html or .xml file contains code. Keep only the verification line the service gave you.
• "Up to 20 root files": delete a file you no longer need.
• The file's link shows the 404 page or "Not found": click Save files and wait a minute. Check the name matches exactly, including capitals. A file you edited can take up to five minutes to update everywhere.
• My site shows "refused to connect" inside another website's frame: turn on Allow site in an iframe, wait a minute and reload.