This came out of building IsSiteSafe, where some tools fetch URLs that visitors submit. I used AI assistance while building the project, and extracted the fetching code into a small Python module.

It uses the standard library, checks resolved addresses before each request, and checks redirect destinations too.

An important limitation: it doesn’t pin the connection to the address it checked, so DNS rebinding is still possible. It also strips query strings, which makes it unsuitable for some URLs. I wouldn’t describe it as complete SSRF protection.

I’d appreciate feedback on those boundaries and on cases the current checks miss.