This should use escaping, `esc_url` specifically