urltoapp.dev
Learn

Security checklist for URL apps

A URL app is as secure as your website plus the shell around it. Most risks are on the website side — and they're the same ones you should fix anyway.

Updated Oct 20262 min readurltoapp.dev

Short answer

Serve the whole site over https (Android blocks cleartext http by default), remove mixed content, keep the app's in-app domains to sites you control so a stray link can't load a phishing page inside your branded frame, don't expose JavaScript bridges to untrusted pages, and keep file access off. Never put secrets in the start URL — anyone can read it from the APK.

On your website

  • HTTPS everywhere, with a valid certificate and HSTS. Android 9+ refuses http unless the app opts in to cleartext — don't.
  • No mixed content. WebViews block http images and scripts on https pages, which shows up as missing images or broken widgets.
  • Secure cookies (Secure; HttpOnly; SameSite) — same as for browsers.
  • Content Security Policy limits what scripts can run if something is injected.

In the app shell

  • Scope: only your domains load inside the app. Everything else opens in the browser, where users see the real address bar. Otherwise a malicious link could show a fake login page under your app's name.
  • JavaScript bridges (native functions exposed to the page) should be limited to your own domain and expose only what's needed.
  • File access from web pages should be off; URL apps don't need to read local files through file://.
  • SSL errors must never be ignored. An app that “proceeds anyway” on certificate errors is open to interception and is flagged by Google Play.

What people can see inside your APK

An APK can be unpacked by anyone. The start URL, in-app domains, push app ID and any keys baked into the shell are visible. That's fine for public values; it's not fine for API secrets, admin URLs with tokens, or passwords. Keep secrets on your server.

Accounts and sessions

Sessions in the app last as long as the cookies do. Offer a clear sign-out, and consider shorter sessions for sensitive data, since phones get shared and lost.

FAQ

Are URL apps safe?

As safe as the website they load, provided the shell uses https, restricts its domains and doesn't ignore certificate errors.

Can someone see my website code in the APK?

Your site's code isn't in the APK — it stays on your server. Only the shell's settings, like the start URL, are inside.

Read next

/learn/how-a-url-app-works/LearnHow a URL app works insideInside a URL to app conversion: the Android activity, the WebView and its settings, cookies and storage, the user agent, the back button and how the app is signed./tools/start-url-inspector/ToolsStart URL inspectorPaste the URL you want to turn into an app. Checks https, redirects-prone hosts, tracking parameters, ports and IPs, and suggests a clean start URL and package name./learn/external-links-in-url-apps/LearnLinks that open outside the appControl links in a URL app: your domain inside, social and maps in their own apps, and tel:, mailto:, WhatsApp and intent:// links handled correctly./learn/google-play-policy-for-url-apps/LearnGoogle Play policy for URL appsWhy Google Play rejects some website-to-app conversions (minimum functionality, webview spam, impersonation) and the checklist that gets a URL app approved./learn/what-is-url-to-app/LearnWhat is URL to App?URL to App explained: how a website link becomes an installable Android app (APK/AAB), what the app can do, what it can't, and when a URL app is the right choice./learn/convert-url-to-app-step-by-step/LearnConvert a URL to an app, step by stepConvert any website URL into an Android app in minutes: prepare the link, set name, icon and package, build a signed APK and AAB, then publish.