Technically, the favicon can go anywhere. Root is best.
And you want both of these lines:
<link rel="shortcut icon" href="https://example.com/favicon.ico" type="image/x-icon" />
<link rel="icon" href="https://example.com/favicon.ico" type="image/vnd.microsoft.icon" />
Reason: Some older IE browsers prefer it the first way and need it like that. If you don’t care about old IE browsers, this is the correct way:
<link rel="icon" href="https://example.com/favicon.ico" type="image/vnd.microsoft.icon" />
All modern browsers support this single line method.
Also, you don’t have to use an ICO file unless you’re maintaining old backward IE compatibility. If you want to use a GIF or PNG or JPG, then that’s perfectly acceptable, too. Just change the type to “image/jpeg” or “image/png” “image/gif” as appropriate. Again, all modern browsers support this. Animated GIFs even work. ??
Finally, limit the size of the icon to 16×16 or 32×32 for it to be effective.