NoScreenshot plugin for NativePHP Mobile#

A NativePHP Mobile plugin that prevents screenshots, blocks screen recording, and protects the App Switcher thumbnail — on both Android and iOS.

Mainly useful for apps that handle sensitive data such as financial, healthcare, or enterprise applications where protecting user privacy and data security is paramount.

Platform Support#

How It Works#

Android uses WindowManager.LayoutParams.FLAG_SECURE — an OS-level window flag that prevents the system from capturing the screen by any means: the screenshot button, the built-in screen recorder, ADB, and third-party capture apps all receive a blank frame. The flag also prevents the App Switcher / Recents thumbnail from showing real content.

A ContentProvider (NoScreenshotInitProvider) registers Application.ActivityLifecycleCallbacks before any Activity is created. On every Activity.onCreate() it reads the persisted protection state from SharedPreferences and re-applies FLAG_SECURE — so the flag is active from the very first frame, even before the WebView or any PHP controller has run.

iOS uses two complementary techniques:

1. UITextField isSecureTextEntry screenshot prevention — when protection is active, all main-window content is moved inside the first subview of a UITextField with isSecureTextEntry = true. iOS routes that subtree through its system DRM compositing path, which is excluded from the screenshot pipeline. The protected area appears blank/white in any screenshot taken while protection is active.

2. Overlay windows — a full-screen black UIWindow (above the status bar) is shown:

   • When UIScreen.main.isCaptured is true (screen recording / AirPlay mirroring active)
   • When UIApplication.willResignActiveNotification fires (user pressed Home — prevents the OS from capturing a real frame for the App Switcher thumbnail)

Protection state is persisted in UserDefaults. The plugin exports a NativePHPNoScreenshotInit function (registered as init_function in the manifest) that restores the saved state at app startup, re-arming all observers before the first bridge call.

Requirements#

FLAG_SECURE is available from Android API 1. API 21 is set to match NativePHP Mobile's own minimum. The iOS 13 minimum is required because the recording overlay uses UIWindowScene, introduced in iOS 13.

Installation#

composer require codingwithrk/no-screenshot
 
php artisan native:plugin:register codingwithrk/no-screenshot

The service provider and NoScreenshot facade are auto-discovered by Laravel — no manual registration needed.

Quick Start#

use Codingwithrk\NoScreenshot\Facades\NoScreenshot;
 
// Protect the entire app (persisted across restarts)
NoScreenshot::disableGlobally();
 
// Lift global protection
NoScreenshot::enableGlobally();

Call disableGlobally() once — from a service provider, middleware, or any controller. The choice is saved to SharedPreferences (Android) / UserDefaults (iOS) and automatically restored the next time the app launches.

PHP API#

All methods are available via the NoScreenshot facade or by resolving Codingwithrk\NoScreenshot\NoScreenshot from the container.

disableGlobally(): bool#

Activates protection for the entire app and persists the state so it survives app restarts.

• Android — adds FLAG_SECURE to the activity window; all capture attempts receive a blank frame. On the next launch, FLAG_SECURE is applied at Activity.onCreate() before the WebView loads.
• iOS — moves window content into the UITextField secure container (screenshot content appears blank), starts the UIScreen.capturedDidChangeNotification observer, and registers willResignActiveNotification to protect the App Switcher thumbnail.

Returns true on success, false if running outside NativePHP.

NoScreenshot::disableGlobally();

enableGlobally(): bool#

Removes global protection and clears the persisted state.

NoScreenshot::enableGlobally();

toggle(): bool#

Toggles global protection on/off. Returns the new isGloballyProtected state.

$isNowProtected = NoScreenshot::toggle();

getStatus(): ?ScreenProtectionStatus#

Returns the current protection state as a typed DTO, or null outside NativePHP.

$status = NoScreenshot::getStatus();
 
$status->isGloballyProtected;         // bool — true after disableGlobally()
$status->isScreenBeingRecorded;       // bool — iOS: live UIScreen.main.isCaptured; Android: always false
$status->isScreenshotDetectionActive; // bool — true when screenshot detection is running

startScreenshotDetection(): bool#

Registers a native observer that fires ScreenshotAttempted whenever the user takes a screenshot.

• Android — uses Activity.registerScreenCaptureCallback() (API 34+). On older devices the call succeeds but supported is false and no events fire.
• iOS — uses UIApplication.userDidTakeScreenshotNotification (all iOS versions).

NoScreenshot::startScreenshotDetection();

stopScreenshotDetection(): bool#

Unregisters the screenshot observer.

NoScreenshot::stopScreenshotDetection();

Events#

Three events cover the full lifecycle of capture activity. Listen to them in Livewire components with the native: prefix.

Android note: FLAG_SECURE prevents capture at the OS level rather than detecting it. ScreenshotAttempted requires API 34+ and startScreenshotDetection() to be called first. ScreenRecordingStarted / ScreenRecordingStopped are iOS-only.

Listening in a Livewire component#

use Livewire\Attributes\On;
use Livewire\Component;
use Codingwithrk\NoScreenshot\Facades\NoScreenshot;
 
class SecureScreen extends Component
{
    #[On('native:Codingwithrk\NoScreenshot\Events\ScreenshotAttempted')]
    public function onScreenshotAttempted(): void
    {
        logger()->warning('Screenshot attempted');
    }
 
    #[On('native:Codingwithrk\NoScreenshot\Events\ScreenRecordingStarted')]
    public function onRecordingStarted(): void
    {
        // Recording / mirroring is now active — overlay is already shown by the plugin.
        // Use this hook for your own app logic (e.g. pause playback).
    }
 
    #[On('native:Codingwithrk\NoScreenshot\Events\ScreenRecordingStopped')]
    public function onRecordingStopped(): void
    {
        // Recording stopped — overlay is hidden automatically.
    }
}

Manual dispatch (polling pattern)#

use Codingwithrk\NoScreenshot\Facades\NoScreenshot;
use Codingwithrk\NoScreenshot\Events\ScreenRecordingStarted;
use Codingwithrk\NoScreenshot\Events\ScreenRecordingStopped;
 
$status = NoScreenshot::getStatus();
 
match (true) {
    $status->isScreenBeingRecorded => ScreenRecordingStarted::dispatch(),
    default                        => ScreenRecordingStopped::dispatch(),
};

ScreenProtectionStatus Reference#

Platform Notes#

Android#

• Startup protection — NoScreenshotInitProvider (a ContentProvider) runs before MainActivity.onCreate(). It reads SharedPreferences and registers ActivityLifecycleCallbacks. On every Activity.onCreate() and onResume(), FLAG_SECURE is re-applied if protection is active. This means the App Switcher thumbnail is always black on cold launches — not just after the first bridge call.
• Scope — FLAG_SECURE covers the entire activity window. All capture methods (screenshot button, built-in recorder, ADB, third-party apps, Recents thumbnail) receive a blank frame.
• Screenshot detection — registerScreenCaptureCallback() requires API 34 (Android 14+). On earlier devices startScreenshotDetection() returns supported: false and ScreenshotAttempted never fires.

iOS#

• Screenshot content prevention — when protection is active, the main window's subviews are moved inside a UITextField with isSecureTextEntry = true. iOS's secure compositing path excludes this subtree from screenshot capture — the screenshot shows blank/white instead of real content. If Apple changes the internal UITextField structure in a future OS release, the plugin falls back gracefully to overlay-only protection.
• App Switcher protection — willResignActiveNotification fires before the OS captures the Recents thumbnail. The plugin shows the black overlay at that moment and hides it again on didBecomeActiveNotification.
• Screen recording overlay — UIScreen.main.isCaptured is true during screen recording and AirPlay mirroring. The black UIWindow overlay (level statusBar + 1) appears immediately when either starts and disappears when both stop.
• Startup restoration — NativePHPNoScreenshotInit (the init_function) reads UserDefaults at app launch and calls apply() if protection was previously enabled. The didBecomeActiveNotification observer retries applyScreenshotPrevention() if the window was not yet ready at init time.
• iOS 13 minimum — required for UIWindowScene used by the overlay window.

Testing#

Unit tests#

cd packages/codingwithrk/no-screenshot
./vendor/bin/pest

Device scenarios#

Changelog#

1.1.0#

• Android fix — FLAG_SECURE is now applied at Activity.onCreate() via NoScreenshotInitProvider (a ContentProvider), fixing the App Switcher thumbnail leak that occurred before the first bridge call (#1)
• Android — protection state persisted to SharedPreferences; restored automatically on cold launch
• iOS — added UITextField isSecureTextEntry screenshot prevention; screenshot content now appears blank instead of showing real app content
• iOS — added willResignActiveNotification observer to protect the App Switcher thumbnail
• iOS — added NativePHPNoScreenshotInit (init_function) to restore persisted protection state at app startup
• iOS — protection state persisted to UserDefaults

1.0.0#

• Initial release

Support#

For questions or issues, email [email protected]

License#

The MIT License (MIT). Please see License File for more information.