A hard-coded URL is a fixed web address written directly into software, scripts, or documentation instead of being read from a configuration file, environment variable, or service discovery system. Because the address is embedded in code, it can survive long after the service changes, moves, or is retired.
In cybersecurity, hard-coded URLs matter because they create brittle dependencies and hidden trust assumptions. If an old domain expires and is later re-registered, anything still pointing to it may contact a different operator. Attackers can exploit this by taking over abandoned endpoints, serving malicious content, or capturing requests from outdated clients. Defenders look for hard-coded URLs during code review, asset inventory, and dependency cleanup, replacing them with configurable values and removing dead references before they become a security or operational risk.