diff --git a/src/AKSRT/Identity/Provider/AliyunProvider.php b/src/AKSRT/Identity/Provider/AliyunProvider.php
index ea82e677..5736a267 100644
--- a/src/AKSRT/Identity/Provider/AliyunProvider.php
+++ b/src/AKSRT/Identity/Provider/AliyunProvider.php
@@ -93,6 +93,18 @@ final class AliyunProvider implements ProviderInterface {
         return ProviderResult::failed($status, sanitize_text_field((string) ($response['ResultObject']['MaterialInfo'] ?? __('实人认证未通过', 'aksrt'))));
     }
 
+    private function is_public_https_url(string $url): bool {
+        if ($url === '') {
+            return false;
+        }
+        $parts = wp_parse_url($url);
+        if (!is_array($parts) || strtolower((string) ($parts['scheme'] ?? '')) !== 'https') {
+            return false;
+        }
+        $host = strtolower((string) ($parts['host'] ?? ''));
+        return $host !== '' && !in_array($host, ['localhost', '127.0.0.1', '::1'], true) && !str_ends_with($host, '.local');
+    }
+
     public function verify_callback(\WP_REST_Request $request): bool {
         $token = sanitize_text_field((string) ($request->get_param('CallbackToken') ?: $request->get_param('callbackToken')));
         $session = sanitize_text_field((string) ($request->get_param('certifyId') ?: $request->get_param('CertifyId')));
@@ -126,10 +138,16 @@ final class AliyunProvider implements ProviderInterface {
             'CertType' => 'IDENTITY_CARD',
             'CertName' => (string) ($request['person_name'] ?? ''),
             'CertNo' => preg_replace('/\s+/', '', (string) ($request['id_number'] ?? '')),
-            'ReturnUrl' => esc_url_raw((string) ($request['return_url'] ?? '')),
-            'CallbackUrl' => rest_url('aksrt/v1/identity/callback/aliyun'),
-            'CallbackToken' => $callback_token,
         ];
+        $return_url = esc_url_raw((string) ($request['return_url'] ?? ''));
+        if ($this->is_public_https_url($return_url)) {
+            $params['ReturnUrl'] = $return_url;
+        }
+        $callback_url = esc_url_raw(rest_url('aksrt/v1/identity/callback/aliyun'));
+        if ($this->is_public_https_url($callback_url)) {
+            $params['CallbackUrl'] = $callback_url;
+            $params['CallbackToken'] = $callback_token;
+        }
         $response = $this->rpc('cloudauth.aliyuncs.com', '2019-03-07', 'InitFaceVerify', $params);
         if (is_wp_error($response)) {
             return ProviderResult::failed($response->get_error_code(), $response->get_error_message());