Free tool · runs in your browser

URL regex tester

Test website URLs against a strict http(s) regex, a lenient pattern where the scheme is optional, and the browser's own new URL() check, one value per line. Then copy the JavaScript, the HTML pattern attribute or PHP filter_var code.

Why type=url accepts javascript: and mailto:

An input type=url is valid when the value parses as an absolute URL, which is close to asking whether new URL(value) throws. Any scheme counts, so javascript:alert(1), mailto:hi@example.com and ftp://x.y all pass. In the tester, javascript:alert(1) fails the strict pattern but passes new URL().

That matters when you show the value as a link: a javascript: URL in an href runs code when clicked. So allow only http and https on the server, where the check can't be skipped:

function isHttpUrl(value) {
  try {
    const u = new URL(value.trim());
    return u.protocol === "http:" || u.protocol === "https:";
  } catch {
    return false; // new URL() throws on anything that isn't an absolute URL
  }
}

$url = trim($_POST['website'] ?? '');
$scheme = strtolower((string) parse_url($url, PHP_URL_SCHEME));
$ok = filter_var($url, FILTER_VALIDATE_URL) !== false
    && in_array($scheme, ['http', 'https'], true);

The HTML website input

<label for="website">Website</label>
<input type="url" id="website" name="website" pattern="https?://.+" placeholder="https://">

type="url" gives phones a URL keyboard, and the pattern attribute adds the http(s) rule. Browsers anchor the pattern to the whole value, so it has no ^ or $, and it matches case exactly.

Prefill https:// or normalise on the server

Most people type example.com, which type=url rejects. There are two fixes. Prefill the field with https:// so the user types after it, or use a text input with the lenient pattern and add the scheme on the server before you store the value:

function normaliseWebsite(value) {
  const v = value.trim();
  if (v === "") return "";
  return /^[a-z][a-z\d+.-]*:/i.test(v) ? v : `https://${v}`; // "example.com" → "https://example.com"
}

Run the http(s) check after you normalise, not before. A URL that passes every check can still point to a site that doesn't exist; a regex checks format only.

URL regex FAQ