<?xml version="1.0" encoding="utf-8"?> 
<network-security-config> 
    <domain-config cleartextTrafficPermitted="True"> 
        <domain includeSubdomains="true">secure.example.com</domain> 
    </domain-config> 
</network-security-config> 


or 
<?xml version="1.0" encoding="utf-8"?> 
<network-security-config>
    <domain-config> 
       <domain includeSubdomains="true">secure.example.com</domain> 
    </domain-config> 
</network-security-config>

For example, an app may want to ensure that all connections to secure.example.com are always done over HTTPS to protect sensitive traffic from hostile networks. 
so you need to proceed as follow : 
1- Declare the configuration in your app's manifest: 
<manifest ... > 
    <application 
        android:networkSecurityConfig="@res/xml/network_security_config.xml:" 
        ... > 
        <!-- Place child elements of <application> element here. --> 
    </application> 
</manifest> 


2- In the res/xml/network_security_config.xml, set cleartextTrafficPermitted option to false: 

res/xml/network_security_config.xml: 

<?xml version="1.0" encoding="utf-8"?> 
<network-security-config> 
    <domain-config cleartextTrafficPermitted="false"> 
        <domain includeSubdomains="true">secure.example.com</domain> 
    </domain-config> 
</network-security-config>