diff --git a/src/app/api/monitor/test-wechat/route.ts b/src/app/api/monitor/test-wechat/route.ts
index 8c403a3..4ed50b2 100644
--- a/src/app/api/monitor/test-wechat/route.ts
+++ b/src/app/api/monitor/test-wechat/route.ts
@@ -17,6 +17,19 @@ export async function POST(request: NextRequest) {
     webhookUrl = body?.webhook_url || null
   } catch { /* 无 body */ }
 
+  // 如果 URL 被 mask（含 ••••••••），从 DB 查真实 URL
+  if (webhookUrl && webhookUrl.includes('••••••••')) {
+    const config = getMonitorConfig()
+    const found = config.wechat.webhooks.find(wh => {
+      if (!wh.url) return false
+      // 对比非 key 部分是否匹配（前缀 + 后缀），找到对应的真实 webhook
+      const maskedPattern = wh.url.replace(/key=([0-9a-f-]+)/, 'key=••••••••')
+      return maskedPattern === webhookUrl
+    })
+    if (found) webhookUrl = found.url
+    else webhookUrl = null // 找不到匹配的，走 fallback
+  }
+
   // 如果指定了 URL，使用指定的；否则使用第一个启用的
   if (!webhookUrl) {
     const config = getMonitorConfig()
diff --git a/src/lib/monitor/settings-manager.ts b/src/lib/monitor/settings-manager.ts
index 0f9b02c..796f0ba 100644
--- a/src/lib/monitor/settings-manager.ts
+++ b/src/lib/monitor/settings-manager.ts
@@ -153,11 +153,16 @@ export function updateMonitorConfig(updates: Record<string, unknown>): void {
 export function getMaskedConfig(): MonitorConfig {
   const config = getMonitorConfig()
   if (config.mail.password) config.mail.password = '••••••••'
-  for (const wh of config.wechat.webhooks) {
+  // 深拷贝 webhooks 数组，避免 mask 操作污染 getMonitorConfig() 返回的原对象
+  // （前端拿到 masked URL 后若不重新输入就测试，会用 •••••••• 调企业微信导致 93000 invalid url）
+  config.wechat.webhooks = config.wechat.webhooks.map(wh => {
     if (wh.url) {
       const keyMatch = wh.url.match(/key=([0-9a-f-]+)/)
-      if (keyMatch) wh.url = wh.url.replace(keyMatch[1], '••••••••')
+      if (keyMatch) {
+        return { ...wh, url: wh.url.replace(keyMatch[1], '••••••••') }
+      }
     }
-  }
+    return wh
+  })
   return config
 }