Start playback testing with the direct URL of a known active mountpoint. A directory page, a status page and a playlist are useful navigation aids, but none is the media stream itself. Establish that distinction before debugging a web player.
Pick the correct address
https://stream.example.org:8443/live.ogg names the stream. Adding .m3u asks Icecast for a playlist pointing to that stream. An M3U file is not limited to MP3 content. A mount path in an encoder’s configuration must not accidentally include the generated playlist suffix.
Test the direct URL in a compatible standalone player, then in each browser you intend to support. Container and codec matter together, and operating-system decoders may differ. Icecast can distribute media that a particular browser cannot decode. Re-encoding belongs to a source or separate processing workflow, not to the mount’s filename.
Use a user-initiated player
The following HTML is an example for your own website. It is displayed as code here and does not contact a stream:
<audio controls preload="none">
<source src="https://stream.example.org:8443/live.ogg" type="audio/ogg">
Your browser cannot play this stream. Open the stream URL in a compatible player.
</audio>Replace the domain and the fallback text as needed. preload="none" asks the browser to avoid advance media loading; verify actual network behaviour. Do not depend on autoplay, which browsers may block. An HTTPS page should use an HTTPS stream to avoid mixed-content restrictions.
Check access and cross-origin behaviour
An audio element’s playback and JavaScript fetching a JSON status endpoint are different cross-origin operations. Add only the response headers required for the actual client operation. CORS is not authentication and does not turn a public stream into a private one.
If a playlist works locally but not for remote listeners, inspect the URL inside it. A generated localhost URL reaches the listener’s own machine. If the server responds but decoding fails, compare the actual media bytes and Content-Type with the declared type. If credentials are required, test the exact browser/player authentication workflow rather than placing secrets into a shareable URL.