URL Validation Regex (Strict with Protocol)

A strict regex pattern for validating URLs that requires protocol (http/https) and validates domain, TLD, and path components.

Pattern Breakdown

https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)

Components

Character Classes

• https? - http or https (s is optional, but protocol required)
• [-a-zA-Z0-9@:%._\+~#=] - Domain characters: letters, digits, hyphens, and various special chars
• [a-zA-Z0-9()] - TLD characters: letters, digits, parentheses
• [-a-zA-Z0-9()@:%_\+.~#?&//=] - Path/query characters: various URL-safe characters
• ? - Quantifier: zero or one occurrence
• {1,256} - Quantifier: between 1 and 256 occurrences
• {1,6} - Quantifier: between 1 and 6 occurrences
• * - Quantifier: zero or more occurrences
• \b - Word boundary anchor

Examples

Valid:

• https://example.com
• http://www.example.com
• https://subdomain.example.org
• https://example.com/path/to/page
• https://example.com?key=value
• https://example.com#section
• https://user@example.com
• https://example.co.uk

Invalid:

• example.com (missing protocol)
• ftp://example.com (only http/https allowed)
• https://example (missing TLD)
• https://.com (missing domain)
• http://example..com (double dot)

Implementation

JavaScript

const urlRegex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)/;
urlRegex.test('https://example.com'); // true
urlRegex.test('http://www.example.com/path'); // true
urlRegex.test('example.com'); // false (missing protocol)
urlRegex.test('ftp://example.com'); // false (wrong protocol)

Python

import re
url_regex = r'https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)'
bool(re.match(url_regex, 'https://example.com'))  # True
bool(re.match(url_regex, 'http://www.example.com/path'))  # True
bool(re.match(url_regex, 'example.com'))  # False (missing protocol)

Go

urlRegex := regexp.MustCompile(`https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*)`)
urlRegex.MatchString("https://example.com") // true
urlRegex.MatchString("http://www.example.com/path") // true
urlRegex.MatchString("example.com") // false (missing protocol)

Limitations

1. Protocol required: Must include http:// or https://
2. No port numbers: Doesn't support :8080 port specification
3. No IPv4/IPv6: Doesn't validate IP addresses as hosts
4. TLD validation: Basic TLD check, doesn't validate against known TLD list
5. Path validation: Allows various characters but doesn't validate path structure
6. No fragment validation: Fragment part (#section) not explicitly validated

When to Use

• Strict URL validation requiring protocol
• When you need to ensure URLs have http/https
• API endpoints that require full URLs
• Web scraping input validation
• When protocol is mandatory

For production, consider:

• Using URL parsing libraries for comprehensive validation
• Adding port number support
• Validating against known TLD lists
• Supporting additional protocols if needed
• Combining with URL parsing for full validation