Implementation Checklist

Implementation checklist

22 items. Tick what you have confirmed on a real device or server.

Android App Links

• Every web intent filter has the VIEW action, DEFAULT and BROWSABLE categories, and an http or https scheme with a hostExplained in the Android App Links guideNote for this item
• At least one web intent filter sets android:autoVerify="true"Explained in the Android App Links guideNote for this item
• Each host in the manifest serves its own /.well-known/assetlinks.json over HTTPS, as application/json, with no redirectExplained in the assetlinks.json guideNote for this item
• The file lists the release signing fingerprint, in upper case, and the Play App Signing key fingerprint if Play signs releasesExplained in the assetlinks.json guideNote for this item
• pm get-app-links shows verified for every host on a test device after a fresh verification runExplained in the Deep link test plan guideNote for this item

iOS Universal Links

• The Associated Domains capability lists applinks: entries for each domain and subdomain, with no path, port or trailing slashExplained in the iOS Universal Links guideNote for this item
• Each listed domain serves /.well-known/apple-app-site-association over HTTPS with a valid certificate and no redirectExplained in the AASA file guideNote for this item
• The file uses one format only (appIDs and components), and the app identifiers use the Team ID prefix and bundle identifierExplained in the AASA file guideNote for this item
• Excluded paths (for example help or responsible gambling pages that should stay on the web) are listed before broader patternsExplained in the AASA file guideNote for this item
• The app handles incoming universal links and validates the host, path and parameters before showing account dataExplained in the Deep link security guideNote for this item

Fallbacks and banners

• Every app route has a working web page at the same URL for people without the appExplained in the Fallbacks guideNote for this item
• No route depends on a JavaScript timer to open an app without a user gestureExplained in the Fallbacks guideNote for this item
• App promotion uses a small banner, not a full-screen interstitial; any age gate is a mandatory gate, not a promotionExplained in the Install banners guideNote for this item

Mobile search

• Mobile pages carry the same primary content, titles, descriptions, structured data and robots meta tags as desktop pagesExplained in the Mobile-first indexing guideNote for this item
• Primary content does not load only after a tap, swipe or typed inputExplained in the Mobile-first indexing guideNote for this item
• Licensing, help and safer gambling pages are crawlable web pages, not app-only screensExplained in the Canonical web pages noteNote for this item

Store policy and markets

• The app is distributed only where the operator holds a license for that product and locationExplained in the Store gambling rules guideNote for this item
• The app blocks under-age users and restricts use to licensed locationsExplained in the Store gambling rules guideNote for this item
• The store listing and the app show responsible gambling information with local support contactsExplained in the Store listings by market noteNote for this item

Measurement and security

• Click-tracking redirects do not sit in front of verified App Links or universal linksExplained in the Routing vs attribution noteNote for this item
• Tracking prompts and attribution follow the platform frameworks and the site's consent choicesExplained in the Web-to-app measurement guideNote for this item
• No route forwards people to a destination taken from an unvalidated URL parameterExplained in the Deep link security guideNote for this item

Download checklist as CSV Print the checklist Clear all ticks and notes

Ticks and notes stay in this browser only. The checklist records what you confirmed; it does not test anything and is not a certification.

How to use it

Work through the groups in order for a new app, or jump to the group you changed for an update. The Android and iOS groups depend on server work, so involve whoever controls the web servers and the content delivery network early: the association files must be served without redirects. The store policy group draws on each store's gambling app rules, and the security items on the deep link security guide.

If an item fails, the taxonomy of broken app links maps the symptom to a cause.

Questions

Is a fully ticked checklist proof that our links work?

No. It is a record of what your team confirmed. Keep the device evidence from the iOS and Android deep link test plan alongside it.

Where are my ticks stored?

In your browser's local storage on this device, if it is available. Nothing is sent to us. Clearing site data or using a private window removes them.