If you have seen gstatic.com in your browser history, router logs, firewall alerts or your phone's data usage and wondered what it is: gstatic.com is Google's content delivery domain. It serves the static files behind Google products — fonts, images, JavaScript, reCAPTCHA scripts, Google Maps tiles, Chrome's connectivity check. It is owned and operated by Google, it is not a virus, it does not run ads, and almost every device with a Google service on it talks to it many times a day.
This page answers the questions people actually search for: what gstatic.com does, why your devices connect to it, whether it is safe, what connectivitycheck.gstatic.com and generate_204 mean, and what breaks if you block it. The developer section at the end covers fetching gstatic assets programmatically.
What is gstatic.com?
gstatic.com is a domain Google uses to host static content — files that don't change per user and can be cached aggressively. Google keeps them on a separate, cookie-free domain so that browsers can load them in parallel and CDN edge servers around the world can cache them close to you. The name is literally "Google static".
Things served from gstatic.com include:
- Google Fonts —
fonts.gstatic.com delivers the font files (.woff2) that millions of websites load through Google Fonts. If a site uses Roboto or Open Sans, your browser fetched it from gstatic.
- Images and icons — logos, UI icons, thumbnails for Google Search, YouTube, Gmail, Google Maps (
maps.gstatic.com), Google Play, and Google Photos.
- JavaScript and CSS — shared scripts for Google products, including the reCAPTCHA v2/v3 challenge code (
www.gstatic.com/recaptcha/).
- Chrome and Android connectivity checks —
connectivitycheck.gstatic.com and www.gstatic.com/generate_204 are how Android, Chrome OS and Chrome decide whether you are online or stuck behind a captive portal.
- Firebase, Google Ads and Analytics helper assets — many mobile apps built on Firebase pull configuration or SDK files from gstatic.
- Google Search and Assistant assets — Search results pages, Google Lens, Google Assistant and Google TV all load resources from gstatic.
Because it hosts shared files for all of these, gstatic.com is one of the most-requested domains on the internet — on many networks it is in the top five by request count, right next to google.com and googleapis.com.
Is gstatic.com safe? Is it a virus?
Yes, gstatic.com is safe, and no, it is not a virus. It is a legitimate Google domain with Google-issued TLS certificates. Seeing it in your logs is normal and expected.
Three situations make people worry, and none of them means your device is infected:
It appears in your browser history even though you never typed it. Browsers record the pages you visit, but some history and privacy tools also list every domain a page loaded resources from. A single Google Search page pulls dozens of files from gstatic.com, so it shows up as "visited".
Your antivirus or firewall flags it. Some firewalls, parental-control apps and privacy extensions list every outbound connection and mark Google domains as "trackers" because Google is an advertising company. gstatic.com itself does not set cookies and does not track you; the tracking, where it happens, is done by other Google domains. If a security product shows a warning rather than a block, it is informational.
Your phone connects to it constantly. Android checks internet connectivity by hitting connectivitycheck.gstatic.com/generate_204 every time you join a network, wake the screen or switch from Wi-Fi to mobile data. That is the OS confirming it has internet access, not an app exfiltrating data.
The one genuine risk is lookalike domains — gstatic-cdn.net, g-static.com, gstatlc.com and similar. Those are not Google. If a warning names a domain that only resembles gstatic.com, treat it as suspicious. The real domain is exactly gstatic.com and its subdomains (www.gstatic.com, fonts.gstatic.com, maps.gstatic.com, connectivitycheck.gstatic.com, ssl.gstatic.com, encrypted-tbn0.gstatic.com).
Why does my device keep connecting to gstatic.com?
The short answer: because Google services are everywhere, and gstatic is where their files live.
- Android phones hit
connectivitycheck.gstatic.com on every network change and periodically while connected. This is what puts the "Wi-Fi has no internet access" warning on your screen when a hotel portal is in the way.
- Chrome uses
www.gstatic.com/generate_204 for the same purpose and loads New Tab page assets from gstatic.
- Any website using Google Fonts makes your browser fetch font files from
fonts.gstatic.com.
- Any website with reCAPTCHA ("I'm not a robot") loads the challenge script from gstatic.
- Google Maps embeds on restaurant, hotel and business websites load map tiles and markers from
maps.gstatic.com.
- Smart TVs, Chromecast, Nest and Google Home devices fetch UI assets and updates from gstatic.
- Mobile apps built on Firebase (a large share of the Play Store) pull SDK files from gstatic.
If you monitor DNS on your home network (Pi-hole, AdGuard Home, your router's log), gstatic.com will typically show thousands of queries per day across a household. That volume is a sign of how many things depend on it, not of a problem.
What is connectivitycheck.gstatic.com and generate_204?
generate_204 is a URL that returns HTTP status 204 No Content — an empty, successful response. Android and Chrome request it to test whether the internet is reachable:
- If the response is a real 204, you are online.
- If the response is anything else (a login page, a 302 redirect, a timeout), the OS concludes there is a captive portal — a hotel, airport or café Wi-Fi that wants you to sign in — and shows the "Sign in to network" notification.
That is why you sometimes see this request when your phone shows "Connected, no internet": the check failed. It is not malware; it is the diagnostic. Blocking connectivitycheck.gstatic.com makes Android believe every network is offline, which in turn makes it prefer mobile data over Wi-Fi.
Can I block gstatic.com? What breaks?
You can, at the router, in Pi-hole, or with a hosts file — but you almost certainly should not. Blocking gstatic.com breaks:
- Google Search, Gmail, YouTube, Maps, Drive — pages load without styles, icons or scripts, or don't load at all.
- reCAPTCHA — every "I'm not a robot" checkbox on the web fails, so you cannot log in to sites that use it.
- Google Fonts — sites fall back to system fonts (cosmetic, but visible).
- Android connectivity detection — the phone reports "no internet" on every Wi-Fi network.
- Chromecast, Google TV, Nest — devices may fail to set up or update.
If your goal is privacy, block the domains that actually track — doubleclick.net, googlesyndication.com, google-analytics.com, googleadservices.com — and leave gstatic.com alone. gstatic serves files; it does not set cookies or build a profile of you.
If you want to know what your own connection exposes, check your public IP address and location — that is what every site, including Google, sees when your device connects.
gstatic.com subdomains you will see
| Subdomain | What it serves |
|---|
www.gstatic.com | General static assets, reCAPTCHA, generate_204 |
fonts.gstatic.com | Google Fonts font files |
maps.gstatic.com | Google Maps tiles, markers, icons |
ssl.gstatic.com | Assets for Google's HTTPS properties, Gmail icons |
connectivitycheck.gstatic.com | Android / Chrome OS internet check |
encrypted-tbn0.gstatic.com … tbn3 | Google Images thumbnails |
csi.gstatic.com | Client-side performance beacons for Google pages |
lh3.googleusercontent.com (not gstatic, often confused) | User-uploaded photos for Google Photos, Play, Drive |
gstatic.com vs googleapis.com vs googleusercontent.com
People search for these three together because they show up side by side in logs. The split is simple: gstatic.com hosts static files Google made (fonts, scripts, icons); googleapis.com hosts APIs and libraries you call (fonts.googleapis.com returns the CSS that then points at fonts.gstatic.com; maps.googleapis.com, storage.googleapis.com); googleusercontent.com hosts content users uploaded (Google Photos, profile pictures, Blogger images, Drive previews). All three are Google. None of them is malware.
For developers: fetching content from gstatic.com
gstatic.com is not a website with pages to crawl — it is a file host. If you need its assets programmatically, you are usually doing one of three things:
Self-hosting Google Fonts. Request https://fonts.googleapis.com/css2?family=Roboto:wght@400;700 with a browser-like User-Agent, parse the src: url(https://fonts.gstatic.com/...) lines from the CSS, and download those .woff2 files. The User-Agent matters: Google returns different formats (woff2, ttf) depending on what the client claims to support.
Saving Google Images thumbnails. Image results embed thumbnails as https://encrypted-tbn0.gstatic.com/images?q=tbn:.... Those URLs are stable and can be fetched directly; the full-size image lives on the source site, not on gstatic.
Loading Google Search or Maps pages in a scraper. Every Google SERP and Maps page pulls dozens of gstatic files. If you render Google pages with a headless browser you will see those requests; if you only need the results data, you don't need to load them at all — a SERP API returns ranked results as JSON without fetching the page's assets.
Two practical notes. gstatic sets long cache headers (max-age=31536000 on fonts), so download once and cache locally rather than hammering it. And gstatic responds differently to datacenter IPs than to residential ones for some assets tied to reCAPTCHA and Search; if you hit 429s or empty responses at volume, route through residential proxies or use the Scraper API, which handles the request headers and IP rotation for you.
FAQ
Is gstatic.com a virus or malware?
No. gstatic.com is a Google-owned domain that serves static files — fonts, images, scripts — for Google products and for websites that use Google Fonts, reCAPTCHA or Google Maps. Seeing it in logs or history is normal.
Why is gstatic.com in my browser history?
Some history and privacy tools list every domain a page loaded files from, not only the pages you visited. A single Google Search or a site using Google Fonts loads files from gstatic.com, so it appears as a visited domain.
What is connectivitycheck.gstatic.com?
The endpoint Android uses to check whether the internet is reachable. It requests /generate_204 and expects an empty 204 response. Any other response means a captive portal or no internet, which triggers the "Wi-Fi has no internet access" notice.
Can I block gstatic.com?
Technically yes, but it breaks Google Search, Gmail, YouTube, Maps, reCAPTCHA and Android's connectivity check. For privacy, block advertising and analytics domains instead; gstatic.com does not set tracking cookies.
Does gstatic.com track me?
gstatic.com itself is cookie-free and serves static files. Tracking by Google, where it happens, runs through other domains such as google-analytics.com and doubleclick.net. Your IP address is visible to gstatic like to any server you connect to — you can see what it shows.
What is fonts.gstatic.com?
The subdomain that delivers Google Fonts files. fonts.googleapis.com returns the CSS; the CSS points to the actual font files on fonts.gstatic.com.
