---
title: "Allow no cleartext traffic from the app · Agent Wranglers"
url: https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/no-cleartext-traffic
id: MOB-45
level: Required
risk: data
updated: 2026-10-22
build: a2a6bdfed830
tokens: 909
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Allow no cleartext traffic from the app

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: MOB-45
- Level: Required
- Chapter: [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md)
- Rule: Release builds send every request over TLS and trust only the system certificate authorities. They carry no global App Transport Security exception and no Android cleartext permission.
- Check: A script reads the release `Info.plist` and the merged Android manifest and fails on `NSAllowsArbitraryLoads`, `usesCleartextTraffic="true"`, `cleartextTrafficPermitted="true"` or `src="user"` outside `debug-overrides`. A proxy test of the release build sees no plain HTTP request.
- Risk: Data leaked or lost
- How: Both platforms block plain HTTP by default. App Transport Security has applied since the iOS 9 SDK, and Android 9 turned cleartext off. The defaults break when a build adds `NSAllowsArbitraryLoads`, sets `cleartextTrafficPermitted="true"` or trusts user-installed certificates in release. Apple notes that ATS does not cover lower-level network interfaces, so check sockets and third-party networking libraries too. Keep exceptions to named debug hosts in `debug-overrides`, which Android ignores in release builds. Servers follow [serve everything over HTTPS](https://agentwranglers.se/playbook/website/hosting-and-network/https-tls.md). Add certificate pinning only with a tested plan for rotating keys, because a stale pin cuts every user off.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### XML example

```xml
<network-security-config>
    <base-config cleartextTrafficPermitted="false">
        <trust-anchors><certificates src="system" /></trust-anchors>
    </base-config>
    <debug-overrides>
        <trust-anchors><certificates src="user" /></trust-anchors>
    </debug-overrides>
</network-security-config>
```

## Sources

- [OWASP MASVS-NETWORK-1](https://mas.owasp.org/MASVS/controls/MASVS-NETWORK-1/)
- [Apple, Preventing insecure network connections](https://developer.apple.com/documentation/security/preventing-insecure-network-connections)
- [Android, Network security configuration](https://developer.android.com/privacy-and-security/security-config)

## Related rules

- WEB-157 [Serve everything over HTTPS](https://agentwranglers.se/playbook/website/hosting-and-network/https-tls.md) in Website

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/no-cleartext-traffic">Agent Wranglers mobile apps playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Open deep links only from verified domains](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/verified-deep-links.md)
- Next: [Keep web views to your own pages](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views/locked-web-views.md)
- [Network, links and web views](https://agentwranglers.se/playbook/mobile-apps/network-links-and-web-views.md)