Even

Do I need to escape get_theme_mod('url') / ('mail') with esc_url?

Do I need to escape get_theme_mod('url') / ('mail') with esc_url?

Yes, you do. Even if you have sanitised the value when saving it, you should always escape on output.

Is it good practice to use REST API in wp-admin plugin page? [closed]
Should I disable REST API? Should I disable WordPress REST API? Should I disable WP JSON? What is WordPress REST API used for? How do I block REST API...
Custom column on CPT not showing correct value when meta data not set
How do I display custom field values in WordPress? How do I enable custom fields in WordPress? How do I add a custom meta field to a custom post type?...
Wordpress get recent posts, delete the current category
You can remove recent posts,archives,categories on home-page with the theme customizer. go to Appearance -> Customize -> Widgets -> Sidebar –...