Install a fresh Moodle instance (the settings being tested are not included in upgrades). Log in as an admin. Navigate to Site administration > Security > HTTP security. CONFIRM there are 8 values set for "cURL blocked hosts list" and 2 set for "cURL allowed ports list" (and that they match the values listed as their defaults). Open your private files area. Press the "Add..." button. Using the URL downloader, try to download files from the following, and CONFIRM in all cases you receive an error of "The URL is blocked.": http://127.0.0.1 127.0.0.1 http://127.0.0.1:80 http://localhost http://localhost/ <siteurl> where siteurl is this Moodle site, eg http://localhost/stable_master/ (ie this site's homepage). http://192.168.1.1 http://169.254.169.254 https://moodle.org:90 Using the URL downloader, try to download files from the following, and CONFIRM in both cases you are able to successfully retrieve images without error: https://moodle.org https://cdn.pixabay.com/photo/2013/07/12/17/47/test-pattern-152459_960_720.png Navigate back to Site administration > Security > HTTP security. Remove all values from "cURL blocked hosts list" and replace them with "*.moodle.org" Reopen the URL downloader in the Private files area. Attempt to download url_blocked.png and CONFIRM you see "The URL is blocked.". Attempt to download images from http://localhost/ <siteurl> (your Moodle site's homepage) and CONFIRM you no longer receive the blocked error. Attempt to download images from 127.0.0.1:90 and CONFIRM you see "The URL is blocked". Navigate back to Site administration > Security > HTTP security. Remove all values from "cURL allowed ports list". Using the URL downloader, attempt to download images from 127.0.0.1:90 and CONFIRM you receive a "Failed to connect" error and not a blocked URL error.