Fix “Google hasn't verified this app” on Replit
On Replit the usual culprit is which URL Google checks. The development URL sleeps and is ephemeral; the published Deployment is what you submit — on a domain you own.
Replit gives you two addresses: a *.replit.dev development URL that sleeps when you're not editing, and a *.replit.app Deployment. Submit the dev URL and Google may reach a sleeping or empty page. Even the Deployment is a shared subdomain you can't prove you own until you attach a custom domain.
Each fix below traces to a requirement Google publishes.
Nothing here is our opinion. Every requirement links to Google’s own page — open it and verify the fix yourself before you resubmit.
“Your homepage must be publicly accessible without login — a bare sign-in screen is rejected.”
“Your homepage must return meaningful, server-rendered HTML to an automated fetch — a JS-only shell, a bot challenge, a robots block, or an invalid TLS certificate all read as 'unresponsive'.”
“Your app must run on a domain you own and have verified — the top private domain, like yourdomain.com. Google's review treats a shared platform subdomain like *.lovable.app or *.vercel.app as not yours.”
“Verify the domain in Search Console with the same Google account that owns the Cloud project; verifying under a personal account that isn't on the project fails silently.”
“Your homepage must describe what the app does and link to your privacy policy.”
Do these in order, on Replit.
- 01
Publish a real Deployment
Use a Replit Deployment (not the dev URL). A Node Deployment can server-render your homepage HTML, which is exactly what Google's crawler needs to read.
- 02
Never submit the *.replit.dev dev URL
The dev URL sleeps and can return nothing when Google checks it. Use only the stable Deployment address anywhere Google will look.
- 03
Attach a domain you own
Link a custom domain to the Deployment, then verify it in Search Console with the Google account that owns your Cloud project.
- 04
Confirm the homepage is public and descriptive
It must load without login and describe the app plus link the privacy policy. Test with curl -A "Googlebot" https://yourdomain.com and read the raw HTML.
See exactly what Google’s crawler sees — free.
Paste your URL and scopes. The pre-check fetches your homepage the way Google does, finds your privacy-policy link, and flags the blockers this rejection is about — in seconds, no signup.
Straight answers.
Which Replit URL do I give Google?
The published Deployment on your own custom domain. Never the *.replit.dev development URL — it sleeps and can appear unresponsive to Google's checker.
My Deployment works but Google still rejected the homepage — why?
Either it's still on the shared *.replit.app subdomain (not verifiable as yours) or the page renders only after JavaScript. Attach a custom domain and serve server-rendered HTML.