diff --git a/app/api/parse-url/route.ts b/app/api/parse-url/route.ts
index bf3f8f4..4dd6612 100644
--- a/app/api/parse-url/route.ts
+++ b/app/api/parse-url/route.ts
@@ -1,7 +1,7 @@
 import { extract } from "@extractus/article-extractor"
 import { NextResponse } from "next/server"
 import TurndownService from "turndown"
-import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"
+import { isPrivateUrl } from "@/lib/ssrf-protection"
 
 const MAX_CONTENT_LENGTH = 150000 // Match PDF limit
 const EXTRACT_TIMEOUT_MS = 15000
@@ -28,8 +28,10 @@ export async function POST(req: Request) {
             )
         }
 
-        // SSRF protection
-        if (!allowPrivateUrls && isPrivateUrl(url)) {
+        // SSRF protection: parse-url has no use case for fetching internal
+        // hosts, so private URLs are always rejected. ALLOW_PRIVATE_URLS only
+        // governs LLM provider baseUrl overrides (validate-model, chat).
+        if (isPrivateUrl(url)) {
             return NextResponse.json(
                 { error: "Cannot access private/internal URLs" },
                 { status: 400 },
diff --git a/lib/ssrf-protection.ts b/lib/ssrf-protection.ts
index 3c599f2..8dbf2ca 100644
--- a/lib/ssrf-protection.ts
+++ b/lib/ssrf-protection.ts
@@ -9,7 +9,9 @@
 export function isPrivateUrl(urlString: string): boolean {
     try {
         const url = new URL(urlString)
-        const hostname = url.hostname.toLowerCase()
+        // Strip a trailing dot so FQDN forms like "localhost." (which still
+        // resolve to 127.0.0.1) cannot bypass the equality checks below.
+        const hostname = url.hostname.toLowerCase().replace(/\.$/, "")
 
         // Block localhost
         if (