A network-safety block means WebCheck refused to complete a request because the destination or redirect did not satisfy its outbound safety rules. This protects the monitoring worker and is not a normal availability failure.
Destinations WebCheck rejects
WebCheck rejects credentials in URLs, fragments, unsafe ports, internal hostnames, localhost, private and link-local ranges, cloud-metadata addresses, documentation ranges and other reserved or non-public destinations.
DNS is checked before connecting
A public hostname is resolved immediately before the request and each returned address is validated. Redirect destinations are validated again. This prevents a public-looking URL from being used to reach a restricted address.
What to do
- Confirm the URL is the intended public HTTP or HTTPS endpoint.
- Review the complete redirect chain and any DNS changes.
- Remove credentials, fragments or unsupported ports from the target.
- Use a public health endpoint when the application has private internal dependencies.
- Do not weaken network controls or ask WebCheck to bypass them.
Important limitation
A blocked result says that WebCheck could not safely perform the request. It does not prove that the application itself is down. Review the target configuration and network evidence before treating it as an outage.