Could we use `esc_url` here?