diff --git a/.github/workflows/check-hardcoded-urls.yml b/.github/workflows/check-hardcoded-urls.yml
new file mode 100644
index 0000000..ed621fb
--- /dev/null
+++ b/.github/workflows/check-hardcoded-urls.yml
@@ -0,0 +1,12 @@
+name: Check for hardcoded URLs
+
+on:
+  pull_request:
+
+jobs:
+  hardcoded-urls:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: List hardcoded URLs
+        run: ./scripts/list-hardcoded-urls.sh
diff --git a/README.md b/README.md
index db8970b..88bfbf0 100644
--- a/README.md
+++ b/README.md
@@ -129,6 +129,17 @@ We welcome contributions from the community! 🚀
 2. Create a feature branch
 3. Submit a pull request
 
+### Checking for hardcoded URLs
+
+Run the following script to detect any hardcoded `localhost` references before committing code:
+
+```bash
+./scripts/list-hardcoded-urls.sh
+```
+
+The script lists offending lines and exits with a nonzero status if any are found.
+Existing references known to be safe are tracked in `scripts/hardcoded-url-allowlist.txt`.
+
 ## License
 MIT License – Feel free to modify and share. 📜
 
diff --git a/scripts/hardcoded-url-allowlist.txt b/scripts/hardcoded-url-allowlist.txt
new file mode 100644
index 0000000..f7be69e
--- /dev/null
+++ b/scripts/hardcoded-url-allowlist.txt
@@ -0,0 +1,5 @@
+FEDERATION_GUIDE.md
+backend/federation/federationSyncJob.js
+frontend/user_login.js
+frontend/federationStatusCLI.js
+README.md
diff --git a/scripts/list-hardcoded-urls.sh b/scripts/list-hardcoded-urls.sh
new file mode 100755
index 0000000..a323572
--- /dev/null
+++ b/scripts/list-hardcoded-urls.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ALLOWLIST_FILE="$(dirname "$0")/hardcoded-url-allowlist.txt"
+
+matches=$(grep -R --line-number --exclude-dir=node_modules --exclude-dir=.git -E "http://localhost|localhost:5000" || true)
+matches=$(echo "$matches" | grep -v 'scripts/list-hardcoded-urls.sh' || true)
+
+if [[ -f "$ALLOWLIST_FILE" ]]; then
+  matches=$(echo "$matches" | grep -F -v -f "$ALLOWLIST_FILE" || true)
+fi
+
+if [[ -n "$matches" ]]; then
+  echo "$matches"
+  echo "Hardcoded localhost URLs detected."
+  exit 1
+else
+  echo "No hardcoded localhost URLs found."
+  exit 0
+fi