get_site_icon_url() returns empty string even when fallback is defined, breaking wp-embed-site-icon in the_embed_site_title()

[pontocinza]

In wp-includes/embed.php, the function the_embed_site_title() calls
get_site_icon_url() twice, passing a fallback URL as the second argument:

    esc_url( get_site_icon_url( 32, includes_url( 'images/w-logo-blue.png' ) ) ),
    esc_url( get_site_icon_url( 64, includes_url( 'images/w-logo-blue.png' ) ) ),

Despite a Site Icon being properly defined in Appearance → Customize → Site
Identity (a 512×512px image), get_site_icon_url() returns an empty string,
ignoring the fallback entirely. This results in a broken icon in all oEmbed
cards rendered via the_embed_site_title().

The generated HTML is:

    <img src="" srcset=" 2x" width="32" height="32" alt="" class="wp-embed-site-icon">

Note that src is empty and srcset contains only 2x, which causes
browsers to interpret it as a relative URL request to /embed/2x, returning
a 403 error.

The WordPress logo fallback (w-logo-blue.png) is also never used, contrary
to the documented behavior of get_site_icon_url().

Steps to reproduce

1. Set a Site Icon in Appearance → Customize → Site Identity (512×512px image)
2. Create a post
3. On another page, add a Media & Text block or an Embed block pointing to that post's URL
4. Visit the page — the site icon in the oEmbed card footer will be broken
5. Inspect the element: src="" and srcset=" 2x"

Expected behavior

The site icon should display correctly, or — if unavailable — the WordPress
logo fallback (w-logo-blue.png) should be used instead.

Actual behavior

get_site_icon_url() returns an empty string regardless of the defined icon
or fallback, producing a malformed <img> tag with empty src and srcset.

Workaround

The following filter removes the broken icon from the embed footer:

    add_filter('embed_site_title_html', function($site_title) {
        return preg_replace('/<img[^>]+class="wp-embed-site-icon"[^>]*>/i', '', $site_title);
    });

Environment

• WordPress 6.9.4
• PHP (production server)
• Site Icon defined, 512×512px, uploaded via Customizer
• APCu object cache active
• Cloudflare in front of the site

[sabernhardt]

Hi and welcome to WordPress Core Trac!

I think you might have a plugin or theme that uses the get_site_icon_url filter. I can break the site icon image in embeds by adding this to a custom plugin:

add_filter( 'get_site_icon_url', '__return_empty_string' );

The filter runs at the end of the get_site_icon_url() function, so the fallback WordPress logo would not override that.

The atom_site_icon() and wp_site_icon() functions check the value before trying to print it, and a similar condition probably could fit the_embed_site_title().

function atom_site_icon() {
	$url = get_site_icon_url( 32 );
	if ( $url ) {
		echo '<icon>' . convert_chars( $url ) . "</icon>\n";
	}
}

function wp_site_icon() {
	if ( ! has_site_icon() && ! is_customize_preview() ) {
		return;
	}

	$meta_tags = array();
	$icon_32   = get_site_icon_url( 32 );
	if ( empty( $icon_32 ) && is_customize_preview() ) {
		$icon_32 = '/favicon.ico'; // Serve default favicon URL in customizer so element can be updated for preview.
	}
	if ( $icon_32 ) {
		$meta_tags[] = sprintf( '<link rel="icon" href="%s" sizes="32x32" />', esc_url( $icon_32 ) );
	}

[sabernhardt]

Other functions:

• site_icon_url(), do_favicon() and the multisite function wp_admin_bar_my_sites_menu() also use output from get_site_icon_url() without checking the value first.
• WP_REST_Server::add_site_icon_to_index() assigns a URL from get_site_icon_url(), but I do not know if that is a (potential) problem.

[pontocinza]

Thank you for the diagnosis.

The active theme is Twenty Twenty (unmodified). I reviewed the plugin list, and none of them are SEO, favicon, or icon-related plugins that would typically use 'get_site_icon_url'. I also fully reviewed the source code of my own custom SEO plugin, which does not touch that filter. WPCode snippets were checked; nothing related to site icon or favicon. The custom CSS only covers layout, typography, and logo sizing. No interference with icons.

Additionally, I can pinpoint when the issue started: it appeared today, after I replaced a PNG for a WebP image (and it was not the site icon file). Before that change, the embed icon was displaying correctly. No plugins were added, removed, or modified around that time.

This suggests the problem may be triggered by WebP format support (or lack thereof) in one of the functions you listed rather than a filter returning an empty string.

Could this be investigated from the Core side? The defensive check you proposed for 'the_embed_site_title()' still seems like the right fix, but the root cause in my case appears to be format-related, not filter-related.

[mohamedahamed]

Yes, the defensive checks needs to be added in Core, namely:

1. In get_site_icon_url() (general-template.php): Only update $url if the attachment URL is not empty

2. In the_embed_site_title() (embed.php): Check if URL is empty before rendering the img tag (like wp_site_icon() already does).

… fails

Trac ticket: https://core.trac.wordpress.org/ticket/65098

## Use of AI Tools

[sabernhardt]

Additionally, I can pinpoint when the issue started: it appeared today, after I replaced a PNG for a WebP image (and it was not the site icon file).

In February, the site icon image was pontocinza300.png, which is no longer at the same URL. If that was deleted or renamed, the site_icon option would not be removed automatically. I noticed that you updated the site icon image to pontocinza512.webp since opening this ticket, and that icon displays for me now, at least in the browser tab (your site does not allow embedding posts in a different site).

the problem may be triggered by WebP format support (or lack thereof)

I did not have trouble in an embedded post or browser tab when I set a WebP image as the icon in my site (Windows 11 with Chrome, Firefox and Edge). However, browser support for WebP as a favicon might not be good enough yet. ​Edge and ​Google forums have reports from last year about WebP not displaying correctly.

[pontocinza]

Replying to sabernhardt:

Additionally, I can pinpoint when the issue started: it appeared today, after I replaced a PNG for a WebP image (and it was not the site icon file).

In February, the site icon image was pontocinza300.png, which is no longer at the same URL. If that was deleted or renamed, the site_icon option would not be removed automatically. I noticed that you updated the site icon image to pontocinza512.webp since opening this ticket, and that icon displays for me now, at least in the browser tab (your site does not allow embedding posts in a different site).

I don't remember when I started to use 'pontocinza512.webp' as the site icon; it was a long time ago. I've tried to solve the issue by removing the site icon and reinstating the very same file again, but of course it didn't work.

the problem may be triggered by WebP format support (or lack thereof)

I did not have trouble in an embedded post or browser tab when I set a WebP image as the icon in my site (Windows 11 with Chrome, Firefox and Edge). However, browser support for WebP as a favicon might not be good enough yet. ​Edge and ​Google forums have reports from last year about WebP not displaying correctly.

I'm a heavy user of PngOut and Tweakpng and love the PNG format, but I have very few remaining PNG files in my site.

[abcd95]

Test Report

Description

This report validates whether the indicated patch works as expected.
Patch tested: ​https://github.com/WordPress/wordpress-develop/pull/11601

Environment

• WordPress: 7.1-alpha-62161-src
• PHP: 8.3.30
• Server: nginx/1.29.8
• Database: mysqli (Server: 8.4.8 / Client: mysqlnd 8.3.30)
• Browser: Chrome 147.0.0.0
• OS: macOS
• Theme: Twenty Twenty-Five 1.4

Reproduction Steps

1. Created a test post ("Test Embed Post") and visited /?p={postID}&embed=true
2. Simulated broken get_site_icon_url() via add_filter( 'get_site_icon_url', 'return_empty_string' )
3. Confirmed bug: <img src="" srcset=" 2x"> in the embed footer
4. Applied patch from PR #11601
5. Re-tested the same embed URL

Actual Results

✅ The issue is resolved after applying the patch.

Supplemental Artifacts

Before patch

After patch

[pontocinza]

Where is the like button? =)

Can we add tests for get_site_icon_url() and the_embed_site_title() to cover the new code paths?

I see there are existing tests for get_site_icon_url() in tests/phpunit/tests/general/template.php but I don't see existing coverage for the_embed_site_title().

[manhar]

Tested the patch successfully. The site icon now displays correctly in oEmbed cards instead of showing a broken image. The fallback to wp-logo-blue.png also works as expected when the icon is unavailable. The malformed srcset issue is also resolved.

## Summary
When a site icon option is set but wp_get_attachment_image_url() cannot resolve a URL, the provided fallback URL should be preserved instead of being replaced with false.

## Testing Instructions

1. Set the site_icon option to an invalid attachment ID.
2. Call get_site_icon_url( 32, "https://example.org/fallback.png" ).
3. Confirm the fallback URL is returned.
4. Run npm run test:php -- --filter test_get_site_icon_url.