How to fix cleartext (HTTP) traffic in an Android app
Cleartext traffic lets your app send data over unencrypted HTTP, exposing it to interception. Here's how to detect it and disable it with a Network Security Configuration.
Last updated 2026-09-05
http://, where anyone on the network path can read or tamper with it. Fix it by targeting Android 9+ (where cleartext is off by default), setting android:usesCleartextTraffic="false", and/or shipping a Network Security Configuration that forbids cleartext — then move every endpoint to HTTPS.Read in context. These instructions need to be adapted to your app and platform version. New scans provide static detections; they do not establish current backend access. Current methodology.
Why cleartext is a risk
Over HTTP, data travels unencrypted. Anyone sharing the network — public Wi-Fi, a malicious hotspot, an ISP, a compromised router — can read credentials and personal data or modify responses (a man-in-the-middle attack). It also fails common compliance requirements (PCI DSS, and the "encryption in transit" expectations under GDPR).
How to tell if your app allows it
- targetSdk < 28: cleartext is permitted by default.
- Manifest:
android:usesCleartextTraffic="true"on the<application>. - Network Security Config: a
res/xmlfile withcleartextTrafficPermitted="true". - Or just scan it — apk-scanner.com flags cleartext traffic from the manifest and network-security config.
The fix
First, target a modern API level and turn cleartext off explicitly:
<application android:usesCleartextTraffic="false" …>
For finer control, add a Network Security Configuration at res/xml/network_security_config.xml and reference it from the manifest (android:networkSecurityConfig="@xml/network_security_config"):
<network-security-config>
<base-config cleartextTrafficPermitted="false">
<trust-anchors><certificates src="system" /></trust-anchors>
</base-config>
</network-security-config>
If a single legacy endpoint genuinely still needs HTTP, scope it to that one domain with a <domain-config> rather than allowing cleartext app-wide — and treat it as tech debt to remove.
Don't forget these
Cleartext can sneak back in through WebViews loading http:// URLs and through third-party SDKs that call HTTP endpoints. Audit both. This control maps to MASVS-NETWORK-1 and CWE-319.
Frequently asked questions
Does targeting Android 9+ automatically fix cleartext?
It changes the default to off, but any explicit usesCleartextTraffic="true" or a permissive network-security config still overrides that. Set it off explicitly to be sure.
Is HTTP to localhost or a dev server a problem?
Traffic to localhost/127.0.0.1 stays on-device and is lower risk, but shipping cleartext to any real remote host — including staging — is a finding. Scope dev exceptions tightly and remove them before release.
How do I find which endpoint is using HTTP?
Search the app for http:// URLs in code and resources, and review the network-security config. A scan surfaces cleartext configuration and hardcoded HTTP endpoints for you.