HTTP API & SSRF prevention

When to use this skill

Use this skill whenever code makes an outbound HTTP request:

• Fetching a user-supplied URL (webhook, import, avatar, feed, oEmbed-like lookup).
• Calling an external API from a setting, form, or scheduled job.
• Using wp_remote_get(), wp_remote_post(), or wp_remote_request().
• Building a URL from $_GET, $_POST, options, or remote configuration.

If any part of the URL is influenced by users or remote state, treat it as an SSRF sink. wp_safe_remote_*() runs wp_http_validate_url() on the URL and every redirect, blocking private/loopback ranges by default.

Related: see the rest-api-security skill for inbound REST endpoints and the input-sanitization-validation skill for general URL sanitization.

Core principles (and why they matter)