Google Play Protect scans apps installed from outside Google Play. A new APK it has never seen, from an unknown developer, can trigger "App scan recommended", "Unsafe app blocked" or a similar warning even if it is harmless. Users can choose to scan or install anyway; developers reduce warnings by signing with a consistent key, requesting only needed permissions and, for wider distribution, publishing on Google Play.
Key takeaways
- A warning on a brand-new APK usually means "unknown", not "malicious".
- Choosing to scan sends the app to Google; harmless apps then install normally.
- Fewer permissions and a consistent signing key reduce warnings.
- Never ask users to turn Play Protect off.
What Play Protect is
Play Protect is Google's malware scanning built into Android devices with Google Play. It checks apps from any source when they are installed, and periodically afterwards. For sideloaded apps it uses what it already knows about the app and, if you allow it, uploads unknown apps for analysis.
The messages, decoded
| Message (wording varies by version) | Meaning | User's options |
|---|---|---|
| App scan recommended / Send app for a security scan? | Play Protect has not seen this app before | Scan (recommended) — harmless apps install after the check |
| Unsafe app blocked / Blocked by Play Protect | The app matches a risk signal, or is from an unknown developer | More details → Install anyway, where offered |
| Harmful app blocked | Known malware signature | Do not install |
| App was built for an older version of Android | Low target SDK | Developer must rebuild with a newer target |
Why a harmless HTML app gets flagged
- It is new. No install history, no reputation.
- Its signing key is new or unknown to Google.
- Permissions. Requests for SMS, accessibility, contacts or overlay permissions raise risk scores sharply. A typical HTML app needs only internet access.
- It loads remote content that could change after review — common to all WebView apps.
What you can do as the developer
- Only switch on permissions your pages actually use (camera, location, microphone).
- Build every version with the same package name and signing key; a stable identity builds reputation.
- Keep the target SDK current — builders that track Android's requirements (HTML2APK targets the current Android release) avoid the "older version" warning.
- For a public app, publish on Google Play. Apps installed from Play are already reviewed and do not get sideload warnings.
- If you believe your app is wrongly flagged, Google provides an appeal form for developers.
What to tell your users
Explain on your download page that a new app from outside the Play Store may show a scan prompt, and that choosing Scan is safe and recommended. Do not tell anyone to disable Play Protect — that removes protection from every app on their phone.
Frequently asked questions
Does a Play Protect warning mean my APK has a virus?
Not necessarily. New apps from unknown developers often trigger a scan prompt. A 'Harmful app' verdict is different and means Google matched known malware.
How do I stop Play Protect blocking my app?
Ask for fewer permissions, keep a consistent signing key and current target SDK, and for public distribution publish through Google Play. Users should not disable Play Protect.