# Onebox, favicon's and Cloudflare's "Hotlink Protection"
**URL:** https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219
**Category:** Support
**Created:** [6월 13, 2019, 8:54오전 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219 "2019-06-13T08:54:36Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [6월 13, 2019, 8:54오전 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219/1 "2019-06-13T08:54:36Z")
The following WordPress site is behind Cloudflare, currently with " Scrape Shield", “Hotlink Protection” off:
> **[Co-operators reports soaring demand for community support](https://www.thenews.coop/139235/sector/worker-coops/worker-co-op-weekend-2019-restorative-sociable-inspiring-get-together/)**
>
> As Canadian communities face tougher pressures, the demand for support from charities and non profits continues to soar, warns Co-operators
When “Hotlink Protection” is on the article image is downloaded by Discourse to display in the onebox but the favicon is not (in Firefox this is clear as there is an empty box):
This is the HTML source:
```html
```
With “Hotlink Protection” on the favicon is not displayed due to the Cloudflare serving a “Error 1011, Access denied”.
I was also wondering, has the downloading and serving locally, of favicons been considered for cases where Cloudflare’s “Hotlink Protection” is on?
---
### Author:  [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [6월 13, 2019, 9:26오전 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219/2 "2019-06-13T09:26:35Z")
How would you do that? And if someone had gone to lengths to see that you can’t download those images my response is either “serves them right” or “I will respect their wishes.”
---
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [6월 13, 2019, 9:50오전 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219/3 "2019-06-13T09:50:17Z")
> [@pfaffman](#):
>
> How would you do that?
In the same way as is done for other images?
See this onebox:
> **[Co-operatives UK Workers Co-op Weekend May 10th-12th 2019](https://community.coops.tech/t/co-operatives-uk-workers-co-op-weekend-may-10th-12th-2019/1227/16)**
>
> @leedscath has written an article about the weekend: This hits the nail on the head for me, I really enjoyed doing the pots with @coopsmark 😃: The vibe at the Worker Co-op Weekend is relaxed, practical and DIY, with a sense that going for a...
The URL of the image of the bonfire is:
```plaintext
```
It was download by Discourse from the original site at this URL:
```plaintext
https://www.thenews.coop/wp-content/uploads/D6eFNECXkAM9BmG-1280x600.jpg
```
All I’m asking is, would it make sense to treat favicons in the same way that other images are — download copies and serve them locally?
> [@pfaffman](#):
>
> And if someone had gone to lengths to see that you can’t download those images my response is either “serves them right” or “I will respect their wishes.”
Test the current behaviour yourself, enable “Hotlink Protection” on a site behind Cloudflare and you will find that Discourse still downloads the main images for oneboxes…
---
### Author:  [@Falco](https://meta.discourse.org/u/Falco)
#### Post date: [6월 13, 2019, 7:51오후 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219/4 "2019-06-13T19:51:31Z")
> [@chrisc](#):
>
> All I’m asking is, would it make sense to treat favicons in the same way that other images are — download copies and serve them locally?
They will as long as they are in a format your Discourse accepts. The example in OP is using `.ico`, which is an old format not allowed in Discourse by default. You can add it to the list in your site.
---
### Author:  [@chrisc](https://meta.discourse.org/u/chrisc)
#### Post date: [6월 14, 2019, 7:49오전 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219/5 "2019-06-14T07:49:24Z")
I added `.ico` to `authorized extensions` and rebuilt the HTML of a post and while the favicon wasn’t downloaded and served locally straight away it was when I checked it a couple of days later.
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [7월 14, 2019, 7:49오전 UTC](https://meta.discourse.org/t/onebox-favicons-and-cloudflares-hotlink-protection/120219/6 "2019-07-14T07:49:24Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.