.app domains and HTTPS: what to know.

Why do .app domains require HTTPS?

Google Registry states that the entire .app top-level domain is included on the HSTS preload list. HSTS stands for HTTP Strict Transport Security. In supporting browsers, preloading tells the browser to use HTTPS for websites under the extension rather than waiting for a site to announce its own HSTS policy.

For a website owner, the practical consequence is simple: configure a valid TLS certificate before people visit your .app website. An HTTP-only site is not a workable public launch plan. The extension does not automatically provide hosting or a certificate, and registering the name is not the same as configuring the website.

Use Google Registry’s explanation as the primary source for the extension’s requirement. Ask your hosting provider about the setup steps for your particular account, because certificate validation and DNS configuration depend on the platform.

Plan hosting and TLS certificate provisioning

Choose a host that supports HTTPS for your exact domain name and any subdomains you intend to use. Many providers offer certificate automation, but you should confirm what is included, what DNS records are required, and how renewals are handled. Do not assume that a certificate for one hostname covers every other hostname.

• Identify the intended public address and whether a www variant or other subdomains will be used.
• Follow the provider’s domain-validation and certificate instructions.
• Confirm that redirects and the destination pages work over HTTPS.
• Use HTTPS URLs for scripts, images, stylesheets, and other embedded resources.
• Verify certificate renewal responsibilities so a working launch remains working later.

If a domain already serves a website or email, coordinate DNS changes carefully. Moving registrars and moving hosts are different operations. The transfer checklist explains why service continuity should be planned separately from the acquisition itself.

What HTTPS does—and does not—mean

HTTPS helps protect the connection between a browser and a website, including data in transit. It does not verify the accuracy of the website’s content, certify the operator’s professional qualifications, or prove that stored data is handled appropriately.

A legal client portal or compliance application needs more than transport encryption. Depending on the service, review authentication, authorization, data retention, backups, encryption at rest, auditing, and third-party access. Requirements vary with the information involved and the applicable jurisdictions.

Do not advertise a service as legally compliant, confidential, or trustworthy simply because it uses .app. The domain extension provides a connection requirement, not an independent assessment of your product. Security claims should describe actual controls and qualified review.

A practical pre-launch check

After DNS and certificate provisioning, visit the public address in a normal browser. Check the homepage, contact page, and a representative internal page. Look for certificate warnings, broken redirects, and blocked mixed-content resources. Test any public forms without entering sensitive personal information.

Check mobile navigation and the address variants you expect clients to use. Make sure error pages and redirected URLs also lead to working HTTPS destinations. If you use a separate email service, verify its DNS records independently: browser HSTS requirements do not configure email delivery for you.

Document who owns the registrar account, who controls DNS, and who receives renewal or certificate notices. A clear responsibility map matters more than an assumption that someone else will handle these tasks after launch.

Put HTTPS in the right SEO context

A technically accessible website is a foundation for search visibility, but HTTPS and a particular domain extension do not guarantee rankings. Helpful information, understandable pages, meaningful internal links, and a reputation earned through real work remain important.

Google’s SEO Starter Guide is a useful starting point for site structure and discoverability. When acquiring a new address, make the decision around audience fit and a sustainable content plan. See the premium domain buying guide and legal-tech portfolio for the wider planning questions.