diff --git a/src/main/java/com/vinurl/net/ClientEvent.java b/src/main/java/com/vinurl/net/ClientEvent.java
index 2c1d4c8..d34375d 100644
--- a/src/main/java/com/vinurl/net/ClientEvent.java
+++ b/src/main/java/com/vinurl/net/ClientEvent.java
@@ -24,10 +24,23 @@ public static void register() {
 			BlockPos pos = message.pos();
 			String url = message.url();
 			boolean loop = message.loop();
-			String fileName = SoundManager.getFileName(url);
 
 			if (client.player == null || url.isEmpty()) {return;}
 
+			URI uri;
+
+			try {
+				uri = new URI(url);
+			} catch (Exception ignored) {
+				return;
+			}
+
+			String scheme = uri.getScheme();
+			String host = uri.getHost();
+			if (scheme == null || host == null) {return;}
+
+			String fileName = SoundManager.getFileName(url);
+
 			SoundManager.addSound(fileName, pos, loop);
 
 			if (Executable.YT_DLP.isProcessRunning(fileName + "/download")) {
@@ -41,9 +54,9 @@ public static void register() {
 			}
 
 			if (CONFIG.downloadEnabled()) {
-				String baseURL = URI.create(url).getScheme() + "://" + URI.create(url).getHost();
+				String baseURL = scheme + "://" + host;
 
-				if (CONFIG.urlWhitelist().stream().anyMatch(url::startsWith)) {
+				if (CONFIG.urlWhitelist().contains(baseURL)) {
 					SoundManager.downloadSound(url, fileName);
 					SoundManager.queueSound(fileName, pos);
 					return;
diff --git a/src/main/java/com/vinurl/net/ServerEvent.java b/src/main/java/com/vinurl/net/ServerEvent.java
index 22cb7ef..64c8374 100644
--- a/src/main/java/com/vinurl/net/ServerEvent.java
+++ b/src/main/java/com/vinurl/net/ServerEvent.java
@@ -19,6 +19,8 @@
 
 public class ServerEvent {
 	public static final int MAX_URL_LENGTH = 400;
+	public static final int MIN_DURATION = 0;
+	public static final int MAX_DURATION = 3600;
 
 	public static void register() {
 		NETWORK_CHANNEL.registerClientboundDeferred(ClientEvent.GUIRecord.class);
@@ -39,10 +41,20 @@ public static void register() {
 				return;
 			}
 
+			CompoundTag existingTag = stack.getOrDefault(DataComponents.CUSTOM_DATA, CustomData.EMPTY).copyTag();
+			if (existingTag.get(LOCK_KEY)) {
+				player.displayClientMessage(Component.translatable("item.vinurl.custom_record.message.locked"), true);
+				return;
+			}
+
 			String url;
 
 			try {
-				url = new URI(message.url()).toURL().toString();
+				URI uri = new URI(message.url());
+				if (uri.getHost() == null) {
+					throw new IllegalArgumentException("Missing host");
+				}
+				url = uri.toURL().toString();
 			} catch (Exception e) {
 				player.displayClientMessage(Component.translatable("message.vinurl.custom_record.url.invalid"), true);
 				return;
@@ -55,7 +67,7 @@ public static void register() {
 
 			CompoundTag tag = new CompoundTag();
 			tag.put(URL_KEY, url);
-			tag.put(DURATION_KEY, message.duration());
+			tag.put(DURATION_KEY, Math.clamp(message.duration(), MIN_DURATION, MAX_DURATION));
 			tag.put(LOOP_KEY, message.loop());
 			tag.put(LOCK_KEY, message.lock());
 			stack.set(DataComponents.CUSTOM_DATA, CustomData.of(tag));