You need to filter the URLs that are accepted to avoid security problems - had you a contact address on your profile here, or on the site I'd have disclosed this more privately.

But consider this case:

https://webtest.app/?url=file:///etc/passwd

In short you should restrict URLs to protocols of `http`, `https`, and even then you should filter based on IP. You don't want people to view http://localhost/server-status, etc.

Finally you need to make sure you avoid recursion:

https://webtest.app/?url=https://webtest.app/?url=https://st...