1) The checks for well-known urls should always run against the root domain and therefore the option to remove the webroot.
2) For trusted domains, the available protocol is unknown, and thus some guesswork would be needed to make that work. I've decided for now to not consider them anymore to reduce false-positives.
Signed-off-by: Daniel Kesselberg <mail@danielkesselberg.de>
Daniel Kesselberg
Andy Scherzinger
Côme Chilliet
Ferdinand Thiessen