WP_Http::block_request( string $uri ): bool

894	public function block_request( $uri ) {895		// We don't need to block requests, because nothing is blocked.896		if ( ! defined( 'WP_HTTP_BLOCK_EXTERNAL' ) || ! WP_HTTP_BLOCK_EXTERNAL ) {897			return false;898		}899 900		$check = parse_url( $uri );901		if ( ! $check ) {902			return true;903		}904 905		$home = parse_url( get_option( 'siteurl' ) );906 907		// Don't block requests back to ourselves by default.908		if ( 'localhost' === $check['host'] || ( isset( $home['host'] ) && $home['host'] === $check['host'] ) ) {909			/**910			 * Filters whether to block local HTTP API requests.911			 *912			 * A local request is one to `localhost` or to the same host as the site itself.913			 *914			 * @since 2.8.0915			 *916			 * @param bool $block Whether to block local requests. Default false.917			 */918			return apply_filters( 'block_local_requests', false );919		}920 921		if ( ! defined( 'WP_ACCESSIBLE_HOSTS' ) ) {922			return true;923		}924 925		static $accessible_hosts = null;926		static $wildcard_regex   = array();927		if ( null === $accessible_hosts ) {928			$accessible_hosts = preg_split( '|,\s*|', WP_ACCESSIBLE_HOSTS );929 930			if ( str_contains( WP_ACCESSIBLE_HOSTS, '*' ) ) {931				$wildcard_regex = array();932				foreach ( $accessible_hosts as $host ) {933					$wildcard_regex[] = str_replace( '\*', '.+', preg_quote( $host, '/' ) );934				}935				$wildcard_regex = '/^(' . implode( '|', $wildcard_regex ) . ')$/i';936			}937		}938 939		if ( ! empty( $wildcard_regex ) ) {940			return ! preg_match( $wildcard_regex, $check['host'] );941		} else {942			return ! in_array( $check['host'], $accessible_hosts, true ); // Inverse logic, if it's in the array, then don't block it.943		}944	}