A link without scheme and without whitespace, quotes, <, >, backslashes or control characters passes although esc_url_raw() would prefix http://; every value with a scheme, and protocol-relative //host, must survive url() unchanged. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>