How to validate a URL programmatically.

JavaScript: URL.canParse or try/catch

Modern JavaScript has URL.canParse(), which returns a boolean. Where it isn’t available, wrap new URL() in try/catch — if construction throws, the URL is invalid:

// Modern
URL.canParse('https://example.com/path');   // true
URL.canParse('not a url');                   // false

// Compatible fallback
function isValidUrl(s) {
  try { new URL(s); return true; }
  catch { return false; }
}

Require a specific scheme

Parsing accepts any valid URL, including javascript: and file:. If you only want web URLs, check the protocol after parsing:

function isHttpUrl(s) {
  let u;
  try { u = new URL(s); } catch { return false; }
  return u.protocol === 'http:' || u.protocol === 'https:';
}

Python

urlparse doesn’t throw on a bad URL, so validate by checking that the required components are present:

from urllib.parse import urlparse

def is_valid_http_url(s):
    try:
        u = urlparse(s)
    except ValueError:
        return False
    return u.scheme in ('http', 'https') and bool(u.netloc)

is_valid_http_url('https://example.com')   # True
is_valid_http_url('example.com')           # False (no scheme)
is_valid_http_url('javascript:alert(1)')   # False (scheme not http/https)

Java

Prefer java.net.URI for validation (it’s stricter and doesn’t trigger network resolution); a URISyntaxException means the string is malformed:

import java.net.URI;
import java.net.URISyntaxException;

static boolean isValidHttpUrl(String s) {
    try {
        URI u = new URI(s);
        String scheme = u.getScheme();
        return u.getHost() != null &&
               ("http".equals(scheme) || "https".equals(scheme));
    } catch (URISyntaxException e) {
        return false;
    }
}

Why not a regex?

URLs allow IPv6 hosts (http://[::1]/), internationalized domains, embedded credentials, unusual ports, and more. A single regex almost always gets some of these wrong — rejecting valid URLs or waving through broken ones. The URL parser in your language already implements the standard correctly, so use it.

Validation is not a security boundary

Two things a syntax check does not do:

• Open redirects — a URL can be perfectly valid and still point at a phishing site. If you redirect to it, check it against an allowlist of trusted hosts.
• SSRF — if your server fetches a user-supplied URL, a valid URL can still target internal addresses (127.0.0.1, cloud metadata endpoints). Block internal ranges explicitly.

Our decode-then-validate guide covers hardening user-supplied URLs. To check a single URL by hand, the URL validator gives a clear valid/invalid verdict with the reason.