Check webhook addresses before sending

Accept only public HTTPS addresses as webhook targets, and never let a webhook reach your internal network.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Resolve the host on every send, and refuse private, loopback, link-local and cloud metadata addresses, in IPv4 and IPv6. Connect to the address you checked, so a DNS change can't swap it, and don't follow redirects. This is server-side request forgery protection.

How to check

Register https://169.254.169.254/ and https://localhost/ as webhook targets. Both are refused. Register a test host that resolves to a public address, then point its DNS at 127.0.0.1. The next send is refused and no request reaches the loopback address.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/webhooks-and-events/webhook-targets.