---
title: "Check webhook addresses before sending · Agent Wranglers"
url: https://agentwranglers.se/playbook/api-design/webhooks-and-events/webhook-targets
updated: 2026-10-20
licence: "All rights reserved"
---

# Check webhook addresses before sending

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Webhooks and events](https://agentwranglers.se/playbook/api-design/webhooks-and-events)
- Rule: Accept only public HTTPS addresses as webhook targets, and never let a webhook reach your internal network.
- How: Resolve the host on every send, and refuse private, loopback, link-local and cloud metadata addresses, in IPv4 and IPv6. Connect to the address you checked, so a DNS change can't swap it, and don't follow redirects. This is [server-side request forgery](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files/block-server-side-request-forgery) protection.
- Check: Register `https://169.254.169.254/` and `https://localhost/` as webhook targets. Both are refused. Register a test host that resolves to a public address, then point its DNS at `127.0.0.1`. The next send is refused and no request reaches the loopback address.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/webhooks-and-events/webhook-targets`.

- Previous: [Version event payloads](https://agentwranglers.se/playbook/api-design/webhooks-and-events/event-versions)
- [Webhooks and events](https://agentwranglers.se/playbook/api-design/webhooks-and-events)