About I ♥ RSS

What this is

iheartrss.com is a directory of people who love RSS. Someone puts an “I ♥ RSS” link on their homepage and submits their URL. We check that the link really is there and that the site publishes a discoverable RSS 2.0 feed, and then we add it to a public list and to an OPML subscription list that any OPML-aware feed reader can subscribe to.

If you found this URL in your server logs, it is almost certainly because someone submitted your site — possibly you.

What we fetch, and how often

We fetch two things, and only two things:

• Your page, to look for the link back to us and for your feed’s <link rel="alternate"> tag.
• Your feed, to check it is RSS 2.0 and to read its title and description.

That is a handful of requests when a site is first submitted, and then the same handful again about once every six days when we re-check that listings are still good. We send conditional requests where we can, we obey a response size cap, and we never crawl beyond those two URLs. We do not follow links, we do not index your content, and we are not a search engine.

If you would rather allowlist us in Cloudflare or a WAF than block us, our requests are identifiable by their User-Agent, which names this page:

iheartrss.com validator (+https://iheartrss.com/about)

If we are being blocked, we mark the listing as blocked rather than dropping it — being behind a bot filter should not cost anyone their place on the list.

How to be removed

Two ways, and the slow one needs nothing from you:

• Remove the link. Take the I ♥ RSS link off your page and you will be gone within a week. We deliberately require two separate confirmations that the link is gone, several days apart, so that one bad afternoon — a deploy, an outage, a CDN error page — can never remove someone by accident. That is why it is not instant.
• Email andrew@iheartrss.com and we will remove the listing straight away, no questions and no account required.

You can also ask us to never list a domain again, in which case future submissions of it are refused.

Why did my site vanish?

The status page answers it. Give it your URL — either the one you submitted or the one your feed names as its own — and it shows the state we have, when we last checked, and the last error we saw. There are no accounts here and we have no way to email you, so that page is how you ask.

If the answer is that your feed isn’t RSS 2.0, or that your page and your feed disagree about each other, the guide has the fix per platform.

Privacy

Short and true. We store the URLs people submit. For each submission, we also store a truncated, keyed, daily-rotating hash of the submitter’s IP address — the address is first truncated to a /24 for IPv4 or a /64 for IPv6, then hashed with HMAC-SHA256 under a key we hold and mixed with the current date. We never store raw IP addresses.

That hash exists for exactly two purposes: rate limiting, so one person cannot flood the submission queue, and abuse triage, so that when something is being attacked we can tell whether it is one source or many. Because the key is ours and the date is mixed in, the hashes cannot be matched back to an address by anyone else, and yesterday’s hashes do not line up with today’s.

Submission records are deleted after 90 days.

Two pages load other people’s code, and it is worth being plain about that. The homepage runs Dave Winer’s blogroll software in place of our own reader, and the river runs FeedLand’s river display. Your browser fetches both — along with jQuery, Bootstrap and Font Awesome — from scripting.com’s files on Amazon S3, and then asks claude.feedland.org for the member feeds and their latest items. Those two hosts see your IP address and which of our two pages you loaded.

The river also loads images from the sites it is showing you. Each feed is listed with its site’s favicon, which comes from DuckDuckGo’s icon service — so icons.duckduckgo.com is told which member domains have items in the river you are reading. And where a post contains a picture, your browser fetches it from wherever that author keeps it, which means a member’s server can see your IP address when their post appears in the river. That is how the pictures get there, and it is the one place on this site where we cannot tell you in advance who is being contacted — it is whoever published the post you are reading.

If you would rather that did not happen, blocking images on this page costs you nothing else: the river is text first, and every headline links to the post at the source. Nothing else on either page is fetched from anywhere else, and the fonts, the stylesheet and our own icons are all served from here.

Those two pages are the only ones it happens on. Every other page here makes no third-party requests at all. Nobody in that list is asked to track you, we run no analytics, and browsing this site sets no cookies.

Reporting a listed site

If a listed site is spam, malware, or otherwise should not be here, report it and we will look at it. Anything listed can be hidden, and any domain can be banned. Use the report form, or email andrew@iheartrss.com — both reach a person.