---
title: "Check webhook addresses before sending · Agent Wranglers"
url: https://agentwranglers.se/playbook/events/webhooks/webhook-targets
id: EVT-26
level: Required
applies: public-api
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 590
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Check webhook addresses before sending

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Webhooks](https://agentwranglers.se/playbook/events/webhooks.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: EVT-26
- Level: Required
- Chapter: [Webhooks](https://agentwranglers.se/playbook/events/webhooks.md)
- Rule: Accept only public HTTPS addresses as webhook targets, and never let a webhook reach your internal network.
- Check: Register `https://169.254.169.254/` and `https://localhost/` as webhook targets. Both are refused. Register a test host that resolves to a public address, then point its DNS at `127.0.0.1`. The next send is refused and no request reaches the loopback address.
- Risk: An account or system taken over
- Applies when: The project offers an API to others.
- How: Resolve the host on every send, and refuse private, loopback, link-local and cloud metadata addresses, in IPv4 and IPv6. Connect to the address you checked, so a DNS change can't swap it, and don't follow redirects. This is [server-side request forgery](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-server-side-request-forgery.md) protection.

## Sources

- [OWASP Server-Side Request Forgery Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html)

## Related rules

- APS-41 [Fetch only allowed addresses](https://agentwranglers.se/playbook/application-security/requests-files-and-caches/block-server-side-request-forgery.md) in Application security

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/events/webhooks/webhook-targets">Agent Wranglers integration and events playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Sign every webhook](https://agentwranglers.se/playbook/events/webhooks/signed-webhooks.md)
- Next: [Retry until the receiver accepts](https://agentwranglers.se/playbook/events/webhooks/webhook-retries.md)
- [Webhooks](https://agentwranglers.se/playbook/events/webhooks.md)