WordPress function to check if URL is SSRF safe.

is_url_ssrf_safe.php

<?php	
function is_url_ssrf_safe( $url ) {
	$allowed_protocols = [ 'http', 'https' ];
	$scheme = parse_url( $url, PHP_URL_SCHEME );
	if ( ! in_array( $scheme, $allowed_protocols, true ) ) {
		return new WP_Error( 'invalid_protocol', __( 'The URL provided uses an unsupported protocol.', 'textdomain' ) );
	}

	$ip = gethostbyname( parse_url( $url, PHP_URL_HOST ) );
	if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) === false ) {
		return new WP_Error( 'private_ip', __( 'The URL provided resolves to a private or reserved IP address.', 'textdomain' ) );
	}
	
	if ( ! filter_var( $url, FILTER_SANITIZE_URL ) || ! filter_var( $url, FILTER_VALIDATE_URL ) ) {
		return new WP_Error( 'invalid_url', __( 'The URL provided is not valid.', 'textdomain' ) );
	}

	return true;
}