
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
@hint/hint-apple-touch-icons
Advanced tools
apple-touch-icons)apple-touch-icons requires that at least one Apple touch icon is present and
of a standard size.
Since iOS 1.1.3, Safari for iOS has supported a way for developers
to specify an image that will be used to represent the web site or app
on the home screen. The image is known as the touch icon.
<link rel="apple-touch-icon" href="apple-touch-icon.png">
Per Apple's current guidance, default touch icon sizes are as follows:
| Device or context | Icon size |
|---|---|
| iPhone | 180px × 180px (60pt × 60pt @3x) |
| iPhone (X/Plus) | 120px × 120px (60pt × 60pt @2x) |
| iPad Pro | 167px × 167px (83.5pt × 83.5pt @2x) |
| iPad, iPad mini | 152px × 152px (76pt × 76pt @2x) |
Other notes:
Not declaring the touch icon in the page and having it in the root of the site is not recommended, as Apple may change what is requested by default.
In older versions of Safari for iOS, the precomposed keyword could be used to prevent iOS from adding different visual
effects to the touch icon (i.e., rounded corners, drop shadow,
reflective shine). Starting with iOS 7, no special effects are applied
to touch icons, so there is no need to use the precomposed
keyword anymore.
When using one image, there is no need to use the sizes attribute.
As of iOS 11.1.0, Safari for iOS
supports the web app manifest file which provides a standard,
cross-browser way of defining, among other, the icons browsers can use in
various contexts (home screen, application menu, etc.). However, Safari
ignores the icons defined in the web app manifest and still uses the
non-standard apple-touch-icon.
The hint checks if one or more apple-touch-icon declarations exist in
the <head>, and:
rel="apple-touch-icon"404),PNG of one of the resolutions specified aboveNo apple-touch-icon was specified:
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>example</title>
...
</head>
<body>...</body>
</html>
The apple-touch-icon is not specified in <head>:
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>example</title>
...
</head>
<body>
<link rel="apple-touch-icon" href="apple-touch-icon.png">
...
</body>
</html>
The apple-touch-icon has a rel attribute different than
apple-touch-icon:
<link rel="apple-touch-icon-precomposed" sizes="180x180" href="apple-touch-icon-precomposed.png">
The apple-touch-icon is not accessible:
<link rel="apple-touch-icon" href="apple-touch-icon.png">
Response for apple-touch-icon.png:
HTTP/... 404 Not Found
...
HTTP/... 500 Internal Server Error
...
The apple-touch-icon is not a PNG file:
<link rel="apple-touch-icon" href="apple-touch-icon.png">
$ file apple-touch-icon.png
apple-touch-icon.png: JPEG image data, ...
One or more apple-touch-icon files is not a recommended size:
<link rel="apple-touch-icon" href="apple-touch-icon.png">
$ file apple-touch-icon.png
apple-touch-icon.png: PNG image data, 16 x 16, ...
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>example</title>
...
<link rel="apple-touch-icon" href="/apple-touch-icon.png">
...
</head>
<body>...</body>
</html>
This package is installed automatically by webhint:
npm install hint --save-dev
To use it, activate it via the .hintrc configuration file:
{
"connector": {...},
"formatters": [...],
"hints": {
"apple-touch-icons": "error",
...
},
"parsers": [...],
...
}
Note: The recommended way of running webhint is as a devDependency of
your project.
FAQs
hint for best practices related to the apple-touch-icons
The npm package @hint/hint-apple-touch-icons receives a total of 15,402 weekly downloads. As such, @hint/hint-apple-touch-icons popularity was classified as popular.
We found that @hint/hint-apple-touch-icons demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.