diff --git a/system/Validation/FormatRules.php b/system/Validation/FormatRules.php
index <HASH>..<HASH> 100644
--- a/system/Validation/FormatRules.php
+++ b/system/Validation/FormatRules.php
@@ -317,7 +317,8 @@ class FormatRules
             return false;
         }
 
-        $scheme       = strtolower(parse_url($str, PHP_URL_SCHEME) ?? ''); // absent scheme gives null
+        // parse_url() may return null and false
+        $scheme       = strtolower((string) parse_url($str, PHP_URL_SCHEME));
         $validSchemes = explode(
             ',',
             strtolower($validSchemes ?? 'http,https')
refactor: strtolower() should take only string