CYBER//HOST
Turn your Android phone into a full-featured web server.
Host on your local network or share your site with the world.
Everything you need to
host from your phone
CYBER//HOST packs a full server stack into a single Android app — no root required, no cloud, no subscriptions.
HTTP & HTTPS Web Server
Serve any static website, HTML app, or file collection to devices on your local Wi-Fi network, or share it with the world using port forwarding. Enable HTTPS with a self-signed or custom TLS certificate for encrypted connections.
- Configurable HTTP port (default 8080)
- HTTPS with self-signed or custom certificate
- Redirect HTTP → HTTPS automatically
- HTTP Basic Authentication
- Directory listing toggle
- Gzip & Brotli compression
- Precompressed (.br / .gz) sidecar assets
- Static-asset caching (Cache-Control / ETag)
- Range requests — stream & seek video/audio
- SPA fallback routing for single-page apps
- Custom MIME types & response headers
- Markdown rendering (.md → styled HTML)
- Custom 404 / 403 error pages
- Live reload (auto-refresh connected browsers)
FTP & FTPS Server
Upload, download, and manage your website files from any FTP client — FileZilla, WinSCP, CyberDuck, and more. Enable FTPS for encrypted transfers.
- Configurable FTP port (default 2121)
- Custom FTP username & password
- FTPS (TLS-encrypted FTP)
- IP-based access control
- Passive mode with dedicated port range
- Sandboxed to website directory — your device files stay safe
In-App File Manager
Browse, rename, delete, and preview your hosted files directly inside the app. No FTP client required for quick edits.
- Full folder tree navigation
- File size & modification date
- One-tap delete
- Breadcrumb navigation
SQLite Data API & Token Auth
Your phone isn't just serving files — it's a backend. Turn on the REST Data API and any SQLite table becomes CRUD endpoints under /data/<table>. Add the Auth API for user registration, login and bearer-token sessions, then require a valid token to read or write your data. Build a real full-stack app with the phone as the server.
- REST CRUD over SQLite (
/data/…) - Configurable URL prefix per database
- User accounts: register / login / logout / me
Authorization: Bearertoken sessions- Optional "require login" to protect data
- Runs behind every security layer & CORS
WebDAV Network Drive
Mount your website root as a network drive straight from Windows Explorer, macOS Finder or Linux — drag & drop files with no FTP client at all.
- Full read/write WebDAV (RFC 4918)
- Mount in Explorer / Finder / GVFS
- Authenticated with your FTP credentials
- Confined to the website root
- Large files stream straight to disk
Server-Side HTML Templating
An opt-in template engine renders shared headers, variables and simple logic into your HTML at request time — no build step, no framework.
- Includes / partials:
{{include header.html}} - Variables from query & server values
- Conditionals:
{{#if}} … {{else}} - Loops:
{{#each}} … {{/each}} - Auto HTML-escaping (raw opt-in)
Expiring Share Links
Generate a public link to any file with its own expiry, optional password and download cap — perfect for sending someone a single file safely.
- Time-based expiry
- Optional password protection
- Maximum-download limit
- Revoke any link instantly
Dynamic DNS
Keep a hostname pointed at your phone even when your public IP changes. CYBER//HOST pings your provider's update URL on a timer.
- Works with DuckDNS, No-IP, Dynu & more
- Configurable update interval
- Set-and-forget background updates
Dynamic Scripting Engine
For advanced users, CYBER//HOST includes a complete CGI/FastCGI execution pipeline for PHP, Node.js and Python — every request passes through all the same security layers first.
- PHP via per-request CGI or persistent FastCGI
- Node.js & Python CGI runtimes
- Source is never leaked as plain text
Advanced / optional: these runtimes require a compatible native interpreter binary for your device — they are not bundled. Everything else on this page works out of the box.
Network Status
All your server addresses, local and public. One-tap copy and QR codes make it easy for devices on your Wi-Fi to connect, while the public IP display is your key to global access via port forwarding.
- Local IP, HTTP, HTTPS & FTP addresses
- Public IP display
- QR code for LAN address
- One-tap copy to clipboard
- mDNS / Zeroconf local discovery
Live Traffic Monitor
Watch every HTTP request scroll in real-time with method, path, status code, latency, and the requesting IP — just like a real server console.
- Request method colour-coding (GET/POST/PUT/DELETE)
- HTTP status badges
- Client IP display
- Response latency in ms
- Bytes served per request
- Persistent access log
Bandwidth & Analytics
Deep insights into your server's performance — live throughput, historical speed chart, per-IP stats, and a traffic heatmap.
- Real-time speed gauge (KB/s)
- Peak & average speed
- Total requests & bytes served
- Per-IP requests & bytes table
- Server uptime counter
- Bandwidth alert notifications
- Top files report
USB OTG Drive Support
Plug in a USB OTG drive and import a complete website in seconds, or back up your hosted files straight to the drive. No cables to a PC needed.
- Import website from USB drive
- Export/back up to USB drive
- Drive label, file count & used space cards
- Animated storage capacity bar
- Format drive option
Server Scheduler
Set automatic start and stop times so your server only runs when you need it — perfect for overnight demos or timed local sites.
- Daily start & stop time
- Runs silently in the background
- Works with the foreground service to survive screen-off
Network Source Mode
Point CYBER//HOST at any HTTP URL on your local network and serve that content — great for proxying another device's dev server to the rest of your LAN.
- Fetch & serve from a local URL
- Toggle on/off without restarting
Home Screen Widget
A glanceable widget on your home screen shows server status at a glance and lets you start or stop the server without opening the app.
- Displays server online/offline status
- One-tap start / stop
- Updates in real time
Up and running in
under 60 seconds
No configuration files, no SSH — just install, tap start, and your website is live on your local network or ready to be shared online.
Install & Launch
Download CYBER//HOST from the Google Play Store and open it. The app starts with your HTTP server ready to go on port 8080 and FTP on port 2121.
Upload Your Website via FTP
Open any FTP client (FileZilla, WinSCP, CyberDuck — even your file manager) and connect to the FTP address shown in the Status tab. Upload your HTML, CSS, JS, and image files to the website folder.
Username: cyber
Password: host
230 User logged in, proceed.
Share the Address or QR Code
The Status tab shows your local address (e.g., http://192.168.1.42:8080). Tap it to copy or scan the built-in QR code with any device on the same Wi-Fi network to open your site instantly.
Secure & Customise
Head to Settings to enable HTTPS, set a website password, configure the IP blocklist, turn on DDoS protection, enable the Data API, or tweak any of the 50+ options to make the server exactly how you want it.
Military-grade security
built right in
CYBER//HOST isn't just a server — it's a hardened server. Every layer of protection is toggleable with a single switch.
TLS / HTTPS Encryption
Serve your website over HTTPS using a self-signed certificate generated on-device, or import your own custom certificate. Also supports FTPS for encrypted FTP transfers.
HTTP Basic Authentication
Password-protect your website entirely. Only users with the correct credentials can browse your hosted content. Fully themeable auth dialogs.
IP Block & Allow Lists
Block or exempt individual IPs — or whole CIDR ranges (e.g. 192.168.1.0/24). Exempt your LAN in one tap so trusted devices are never throttled or banned.
Escalating Auto-Bans
Repeat offenders get exponentially longer bans and become permanent after a set number of strikes. Optionally POST a JSON alert to a webhook (Discord-compatible) whenever an IP is banned.
Secure Response Headers
On by default: X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and HSTS over HTTPS — sane, hardened defaults on every response.
DDoS Rate Limiting
Sliding-window rate limiter throttles any IP that sends too many requests in a given time window — fully configurable max requests and window duration.
Honeypot Trap
Automatically bans bots and scanners that probe known attack paths like wp-login.php, .env, phpinfo.php, and dozens more. Add your own custom bait paths.
Geo-IP Filtering
Restrict access by network origin. Choose to block all WAN (internet) traffic and allow only local network clients, or vice versa — great for purely internal tools.
User-Agent Blocklist
Automatically block known malicious scanners and bots by User-Agent string — including sqlmap, nikto, nmap, masscan, and more. Add your own custom block rules.
Brute-Force Protection
Tracks failed authentication attempts per IP. After a configurable number of failures within a time window the IP is automatically banned from further login attempts.
Biometric Settings Lock
Lock the Settings panel behind your device's fingerprint or face unlock so no one else can change your server configuration.
CORS Control
Enable and configure Cross-Origin Resource Sharing headers — set specific allowed origins or use a wildcard for open access.
Path Traversal Blocking
All served files are strictly sandboxed to the app's private website directory. Path traversal attempts (../) are detected and rejected — your device files are always safe.
Zero Telemetry
No analytics, no ad SDKs, no crash reporters, no tracking of any kind. CYBER//HOST contains zero third-party tracking code. All data stays on your device.
Four stunning themes.
Pick your aesthetic.
Every theme is applied globally — dashboard, dialogs, sub-pages, and the server's own web UI all update instantly.
50+ settings.
All auto-saved.
Every option saves the moment you change it — no restart button, no fuss.
🌐 Web Server
📁 FTP Server
🔒 Security
🗄 Backend & APIs
⚙ System
Always improving.
Latest updates.
Documentation & Consistency
- In-app release notes and dashboard now document the full current feature set
- Privacy policy updated for accuracy (on-device access log; optional Dynamic DNS / webhook requests)
- Version alignment across the app and website
Backend-as-a-Service
- SQLite Data API — REST CRUD endpoints under a configurable
/dataprefix - Auth API — user register / login / logout / me with bearer-token sessions
- Optional "require login" gate to protect the Data API
- APIs run behind every security layer, with CORS support
WebDAV, Share Links & Dynamic DNS
- WebDAV (RFC 4918) — mount the website root as a network drive in Explorer/Finder
- Expiring share links with optional password and max-download limits
- Dynamic DNS updater for DuckDNS, No-IP, Dynu and more
Templating & Dynamic Scripting
- Server-side HTML templating — includes, variables,
ifandeach - PHP execution engine via per-request CGI or persistent FastCGI
- Node.js & Python CGI runtimes (require a compatible native binary)
- Script source is never served as plain text
Serving & Security Upgrades
- Brotli compression, precompressed (.br/.gz) sidecar assets and static-asset caching
- SPA fallback routing, custom MIME types and HTTP→HTTPS redirect
- Secure response headers on by default (nosniff, X-Frame-Options, Referrer-Policy, HSTS)
- Escalating & permanent auto-bans, LAN auto-exempt and CIDR-range block/allow lists
- Ban webhooks — POST a JSON alert (Discord-compatible) when an IP is banned
Google Play In-App Updates
- Google Play In-App Updates API — update banner with one-tap install button
- Auto-update toggle in Settings → Updates
USB Drive UI Redesign
- USB stat cards with label, file count, and used space
- Animated storage capacity bar with shimmer effect
- Colour-shifting warning at high utilisation (orange >60%, red >85%)
- 2×2 action button grid layout
USB Detection Overhaul
- Four independent USB OTG detection methods including StorageManager API and /proc/mounts parsing
- Scoped storage fallback for Android 11+
- Expanded mount path candidates
Quality of Life
- Theme-aware native dialogs (confirm, prompt, alert)
- All settings auto-save — no restart button
- Themed sub-pages (Privacy Policy, Release Notes)
- Public IP copy now includes full URL format
Google Play Ready
- FTP credentials hidden from dashboard — directed to Settings panel
- QR code generation fix — resolves scanning failures
- Material You monochrome icon for Android 13+
Ready to host from your pocket?
No subscriptions. No servers. Just your phone.
GET IT ON GOOGLE PLAY