SSRF URL Risk Checker
Inspect URLs for private IPs, loopback addresses, metadata endpoints, and internal hostnames that are dangerous to fetch server-side. Instant and in-browser.
Loading tool...
What is SSRF URL Risk Checker?
The SSRF URL Risk Checker inspects URLs for hostnames and IP addresses that should never be fetched server-side: loopback addresses, private IP ranges, cloud metadata endpoints, and internal hostnames. It provides instant risk assessment without any network calls.
Key Benefits
- Instant risk assessment with no network calls
- Covers RFC 1918, loopback, link-local, and metadata ranges
- Flags internal TLDs (.internal, .local, .corp)
- Free and completely client-side
Common Use Cases
- •Validating webhook URLs before server-side fetch
- •Auditing redirect and callback URLs in application code
- •Security review of user-submitted URLs
- •Testing SSRF validation logic during development
- •Training developers on SSRF attack patterns
Check a URL for SSRF Risk
- Paste the URL: Enter the full URL you plan to fetch server-side, including the protocol.
- Read the risk assessment: The tool checks the hostname against private ranges, loopback, metadata endpoints, and internal TLDs.
- Block dangerous URLs: If the result is Dangerous, do not fetch this URL server-side - it could access internal services or cloud metadata.
- Add to your allowlist: URLs that pass the check can be added to your server-side fetch allowlist for defense in depth.
Key Features
- Detects loopback (127.0.0.0/8, ::1, localhost) addresses
- Flags private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
- Catches cloud metadata endpoints (169.254.169.254)
- Identifies internal hostnames (.internal, .local, .corp, .lan)
- IPv6 unique-local and unspecified address detection
- Instant risk assessment with severity badges