Can we allow cleartext for every domain?

Android shows how, with cleartextTrafficPermitted set to true in the base-config, and adds that this insecure configuration should be avoided whenever possible. Allow only the domains you need, or move them to HTTPS.

Can you fix it for me?

If one bug is the whole problem, the App Fix Ticket covers it: a written diagnosis first, then the fix. If the app has more going on, the Launch Check is a written check of the whole app. Each issue found is rated critical, high, medium or low, with where it is and how it was confirmed. No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.

Android App Can’t Reach an HTTP URL? Cleartext Fix

Short answer

Serve the API over HTTPS and update the URL in the app; that needs no Android setting. If you must reach an http:// address, such as a local server during development, allow cleartext for that one domain in a Network Security Configuration file. Avoid allowing it for every domain.

Why Android blocks the request, and the fix

01
The app targets Android 9 or later and calls http://
“Starting with Android 9 (API level 28), cleartext support is disabled by default.” Android Developers, Network security configuration
From Android 9, apps can’t use unencrypted HTTP unless they opt in. A backend or image URL that starts with http:// fails. The lasting fix is serving the API over HTTPS and updating the URL in the app.
02
You need http:// for one address, such as a dev server
“Specify a Network Security Configuration to control cleartext traffic for API levels 24 and above.” Android Developers, application element
For apps that target Android 9 or later, allow cleartext only for that domain in a Network Security Configuration file, and point the manifest at it with android:networkSecurityConfig. This file works on Android 7.0 (API level 24) and later. In our experience, keep this out of release builds where you can.
```
<?xml version="1.0" encoding="utf-8"?>
<network-security-config>
    <domain-config cleartextTrafficPermitted="true">
        <domain includeSubdomains="true">insecure.example.com</domain>
    </domain-config>
</network-security-config>
```
03
The app relies on android:usesCleartextTraffic
“This attribute is getting deprecated and will be ignored for apps targeting API levels 38 and above.” Android Developers, application element
Many guides set usesCleartextTraffic to true in the manifest. Android is deprecating that attribute and will ignore it for apps targeting API level 38 and above, so move the setting to a Network Security Configuration.

Checked against the vendor’s docs on November 2, 2026: Android Developers: Network security configuration; Android Developers: application element.

Rather hand it over?

Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.

Android network errorAndroid app can’t reach an http:// address: cleartext is blocked

Why Android blocks the request, and the fix

The app targets Android 9 or later and calls http://

You need http:// for one address, such as a dev server

The app relies on android:usesCleartextTraffic

Rather hand it over?

More on this error

Describe it and get a written quote