The Head Contract of app.onepassapps.com: 56 Pages, One Indexing Tag and the Two Names We Ship

I work on OnePassApps, the team behind app.onepassapps.com, so this is our own site, and every number below was measured on today's build over plain HTTPS from outside the browser - no session, no cookies, no JavaScript.

Our sitemap lists 56 URLs. Every one of them answers HTTP 200, and every one of them carries the same head: the same 27 meta names, the same link tags, the same icon files. This is what that head actually says, and the three places where it is not quite what you would expect.

One meta name of our own

Twenty of the 27 meta names on our pages carry a value that never changes from page to page. One of those twenty is ours alone:

<meta name="onepassapps-indexing" content="allowed">

All 56 pages ship it. It is the only tag in the head whose name is the product's own name, and its value is allowed everywhere it appears.

It is also the one tag whose value does not always agree with the rest of the head. The 404 page and /support both answer noindex, nofollow in their robots meta - and they still ship onepassapps-indexing: allowed. A crawler reading only our own tag would treat the 404 page as indexable.

The same robots string, declared twice

Each of the 56 pages declares both robots and googlebot, and the two values are byte-identical on every page:

index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1

That is two meta tags carrying the same string on 56 pages. If you are counting the meta names on our pages, googlebot is the one that doubles the count without adding a rule.

Two names for the same app

We ship one product under two names, and the split is deliberate:

• application-name is OnePassApps
• og:site_name is OnePassApps
• apple-mobile-web-app-title is OnePass
• the web app manifest's short_name is OnePass, while its name is OnePassApps — Useful apps, one membership

So the label under the home-screen icon says OnePass, and everything a search engine or a social card reads says OnePassApps. The manifest's own name carries the tagline that the og:image:alt on all 56 pages repeats: OnePassApps — Useful apps, one membership.

One og:image for 56 pages

Every page points og:image, og:image:secure_url and twitter:image at the same file:

https://app.onepassapps.com/og-image.png

It is a 42,818-byte PNG, declared at 1200 by 630 in the og:image:width and og:image:height tags, and it carries the same alt text on every page. The card a reader sees when our tools are shared on social media is the same picture every time.

The links in the head

Each page carries the same set of link tags:

• canonical, pointing at itself - 56 distinct canonical URLs, and not one of them points anywhere but its own page
• icon twice: /favicon.svg (531 bytes of SVG) and /favicon.ico (3,556 bytes)
• apple-touch-icon: /apple-touch-icon.png (3,492 bytes)
• manifest: /site.webmanifest

Every page also declares two stylesheets and a lang="en-GB".

The manifest itself is 875 bytes of JSON. Its id, start_url and scope are all /, its display is standalone with a display_override of standalone and minimal-ui, its background_color and theme_color are both #0B0D0F, and its categories are productivity, utilities and lifestyle. It names three icons - /icon-192.png (6,478 bytes), /icon-512.png (18,385 bytes) and /icon-maskable-512.png (8,750 bytes, the only one marked maskable).

The icon story splits there too. The manifest's three PNGs are for installed apps; the head's favicon.svg, favicon.ico and apple-touch-icon.png are for browser tabs and iOS bookmarks. Only one of the manifest's PNGs is named anywhere on the pages themselves - /icon-512.png, and it is the organisation logo in the JSON-LD block, on all 56 pages. The 192-pixel icon and the maskable one are named by the manifest alone.

What is not there

• No hreflang link on any of the 56 pages, even though og:locale is en_GB on every one of them.
• No page-level og:image that differs from the site's single card image.
• No canonical that points at a different page.
• The robots and googlebot strings never disagree, on any page.

What I did not do

I did not sign in, create an account, or change anything. This is one read of the sitemap plus one read of each of the 56 pages, the manifest and the seven icon files, from outside the browser, on one build on 8 November 2026. Head tags can change between builds, so read them live before you rely on them.

Everything above is the head of the OnePassApps home page, and the app guides list what each app does.

I work on OnePassApps, so this is our own markup, measured today rather than described from memory.