I think this is too strict, I am not 100% sure that we are only talking about web URLs when this config setting is used. ftp:// and mailto: and new fancy (maybe even nonstandard) things like magnet: bitcoin: should be allowed.

It might make sense to create a more strict checker for HTTP-only URLs and give that a different name?