diff --git a/proxy-xml.php b/proxy-xml.php
index 8f2c9f67..71440e98 100644
--- a/proxy-xml.php
+++ b/proxy-xml.php
@@ -1,15 +1,36 @@
-<?php
-if (isset($_GET['url'])) {
-    $url = $_GET['url'];
+<?php
+    $whitelist = [
+        'blog.freecad.org'
+    ];
 
-    if (filter_var($url, FILTER_VALIDATE_URL)) {
-        $response = file_get_contents($url);
+    function is_url_safe($url, $whitelist) {
+        $parsed = parse_url($url);
+        if (!$parsed || !isset($parsed['host']) || !isset($parsed['scheme'])) {
+            return false;
+        }
+
+        if (!in_array($parsed['scheme'], ['http', 'https'])) {
+            return false;
+        }
+
+        $host = strtolower($parsed['host']);
+
+        if (!in_array($host, $whitelist)) {
+            return false;
+        }
 
+        return true;
+    }
+
+    $url = $_GET['url'] ?? '';
+
+    if (empty($url)) {
+        echo "No URL provided";
+    } elseif (is_url_safe($url, $whitelist)) {
+        $response = file_get_contents($url);
         header('Content-Type: application/xml');
         echo $response;
     } else {
-        header("HTTP/1.1 400 Bad Request");
+        echo "URL not allowed";
     }
-} else {
-    header("HTTP/1.1 400 Bad Request");
-}
+?>