diff --git a/REUSE.toml b/REUSE.toml
index 81c214863f..6e8a272e79 100644
--- a/REUSE.toml
+++ b/REUSE.toml
@@ -40,6 +40,7 @@ path = [
   "tests/data/test**",
   "tests/valgrind.supp",
   # checksrc control files
+  "docs/examples/.checksrc",
   "lib/.checksrc",
   "lib/curlx/.checksrc",
   "lib/vauth/.checksrc",
diff --git a/docs/examples/.checksrc b/docs/examples/.checksrc
new file mode 100644
index 0000000000..0b626e6570
--- /dev/null
+++ b/docs/examples/.checksrc
@@ -0,0 +1,3 @@
+allowfunc gmtime
+allowfunc localtime
+allowfunc socket
diff --git a/docs/examples/Makefile.am b/docs/examples/Makefile.am
index 27d4ce741b..89ebcc9840 100644
--- a/docs/examples/Makefile.am
+++ b/docs/examples/Makefile.am
@@ -24,7 +24,7 @@
 
 AUTOMAKE_OPTIONS = foreign nostdinc
 
-EXTRA_DIST = CMakeLists.txt README.md Makefile.example $(COMPLICATED_EXAMPLES)
+EXTRA_DIST = CMakeLists.txt .checksrc README.md Makefile.example $(COMPLICATED_EXAMPLES)
 
 # Specify our include paths here, and do it relative to $(top_srcdir) and
 # $(top_builddir), to ensure that these paths which belong to the library
diff --git a/docs/examples/http2-upload.c b/docs/examples/http2-upload.c
index 128a4b0bed..d13c5e5806 100644
--- a/docs/examples/http2-upload.c
+++ b/docs/examples/http2-upload.c
@@ -161,7 +161,6 @@ int my_trace(CURL *handle, curl_infotype type,
     known_offset = 1;
   }
   secs = epoch_offset + tv.tv_sec;
-  /* !checksrc! disable BANNEDFUNC 1 */
   now = localtime(&secs);  /* not thread safe but we do not care */
   curl_msnprintf(timebuf, sizeof(timebuf), "%02d:%02d:%02d.%06ld",
                  now->tm_hour, now->tm_min, now->tm_sec, (long)tv.tv_usec);
diff --git a/docs/examples/synctime.c b/docs/examples/synctime.c
index ba5f09cb07..8d7af7c8c4 100644
--- a/docs/examples/synctime.c
+++ b/docs/examples/synctime.c
@@ -298,10 +298,8 @@ int main(int argc, char *argv[])
 
     /* Calculating time diff between GMT and localtime */
     tt       = time(0);
-    /* !checksrc! disable BANNEDFUNC 1 */
     lt       = localtime(&tt);
     tt_local = mktime(lt);
-    /* !checksrc! disable BANNEDFUNC 1 */
     gmt      = gmtime(&tt);
     tt_gmt   = mktime(gmt);
     tzonediffFloat = difftime(tt_local, tt_gmt);
diff --git a/lib/cf-socket.c b/lib/cf-socket.c
index d7463345ad..365ddb62a1 100644
--- a/lib/cf-socket.c
+++ b/lib/cf-socket.c
@@ -369,7 +369,7 @@ static CURLcode socket_open(struct Curl_easy *data,
   }
   else {
     /* opensocket callback not set, so simply create the socket now */
-    *sockfd = socket(addr->family, addr->socktype, addr->protocol);
+    *sockfd = CURL_SOCKET(addr->family, addr->socktype, addr->protocol);
   }
 
   if(*sockfd == CURL_SOCKET_BAD)
@@ -2113,8 +2113,8 @@ static CURLcode cf_tcp_accept_connect(struct Curl_cfilter *cf,
   if(!getsockname(ctx->sock, (struct sockaddr *) &add, &size)) {
     size = sizeof(add);
 #ifdef HAVE_ACCEPT4
-    s_accepted = accept4(ctx->sock, (struct sockaddr *) &add, &size,
-                         SOCK_NONBLOCK | SOCK_CLOEXEC);
+    s_accepted = CURL_ACCEPT4(ctx->sock, (struct sockaddr *) &add, &size,
+                              SOCK_NONBLOCK | SOCK_CLOEXEC);
 #else
     s_accepted = CURL_ACCEPT(ctx->sock, (struct sockaddr *) &add, &size);
 #endif
diff --git a/lib/curl_addrinfo.c b/lib/curl_addrinfo.c
index 22212ac86f..c4ad71a02e 100644
--- a/lib/curl_addrinfo.c
+++ b/lib/curl_addrinfo.c
@@ -507,9 +507,11 @@ curl_dbg_freeaddrinfo(struct addrinfo *freethis,
     if(env)
       r_freeaddrinfo(freethis);
     else
+      /* !checksrc! disable BANNEDFUNC 1 */
       freeaddrinfo(freethis);
   }
 #else
+  /* !checksrc! disable BANNEDFUNC 1 */
   freeaddrinfo(freethis);
 #endif
 }
@@ -540,8 +542,10 @@ curl_dbg_getaddrinfo(const char *hostname,
   if(env)
     res = r_getaddrinfo(hostname, service, hints, result);
   else
+    /* !checksrc! disable BANNEDFUNC 1 */
     res = getaddrinfo(hostname, service, hints, result);
 #else
+  /* !checksrc! disable BANNEDFUNC 1 */
   int res = getaddrinfo(hostname, service, hints, result);
 #endif
   if(res == 0)
diff --git a/lib/curl_mem_undef.h b/lib/curl_mem_undef.h
index f3cca294e9..a70a9fcf53 100644
--- a/lib/curl_mem_undef.h
+++ b/lib/curl_mem_undef.h
@@ -35,17 +35,6 @@
 
 #ifdef CURLDEBUG
 
-#undef send
-#undef recv
-
-#undef socket
-#ifdef HAVE_ACCEPT4
-#undef accept4
-#endif
-#ifdef HAVE_SOCKETPAIR
-#undef socketpair
-#endif
-
 #undef fopen
 #ifdef CURL_FOPEN
 #define fopen(fname, mode) CURL_FOPEN(fname, mode)
diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index 93cbb57056..e49c57231d 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -1083,9 +1083,21 @@ CURL_EXTERN ALLOC_FUNC
   curl_dbg_getaddrinfo(host, serv, hint, res, __LINE__, __FILE__)
 #define CURL_FREEADDRINFO(data) \
   curl_dbg_freeaddrinfo(data, __LINE__, __FILE__)
-
+#define CURL_SOCKET(domain,type,protocol) \
+  curl_dbg_socket((int)domain, type, protocol, __LINE__, __FILE__)
+#ifdef HAVE_SOCKETPAIR
+#define CURL_SOCKETPAIR(domain,type,protocol,socket_vector) \
+  curl_dbg_socketpair((int)domain, type, protocol, socket_vector, \
+                      __LINE__, __FILE__)
+#endif
 #define CURL_ACCEPT(sock,addr,len) \
   curl_dbg_accept(sock, addr, len, __LINE__, __FILE__)
+#ifdef HAVE_ACCEPT4
+#define CURL_ACCEPT4(sock,addr,len,flags) \
+  curl_dbg_accept4(sock, addr, len, flags, __LINE__, __FILE__)
+#endif
+#define CURL_SEND(a,b,c,d) curl_dbg_send(a,b,c,d, __LINE__, __FILE__)
+#define CURL_RECV(a,b,c,d) curl_dbg_recv(a,b,c,d, __LINE__, __FILE__)
 
 #else /* !CURLDEBUG */
 
@@ -1094,8 +1106,16 @@ CURL_EXTERN ALLOC_FUNC
 
 #define CURL_GETADDRINFO getaddrinfo
 #define CURL_FREEADDRINFO freeaddrinfo
-
+#define CURL_SOCKET socket
+#ifdef HAVE_SOCKETPAIR
+#define CURL_SOCKETPAIR socketpair
+#endif
 #define CURL_ACCEPT accept
+#ifdef HAVE_ACCEPT4
+#define CURL_ACCEPT4 accept4
+#endif
+#define CURL_SEND send
+#define CURL_RECV recv
 
 #endif /* CURLDEBUG */
 
diff --git a/lib/hostip.c b/lib/hostip.c
index b6be2ca1f2..fd8f706e7f 100644
--- a/lib/hostip.c
+++ b/lib/hostip.c
@@ -709,7 +709,7 @@ bool Curl_ipv6works(struct Curl_easy *data)
   else {
     int ipv6_works = -1;
     /* probe to see if we have a working IPv6 stack */
-    curl_socket_t s = socket(PF_INET6, SOCK_DGRAM, 0);
+    curl_socket_t s = CURL_SOCKET(PF_INET6, SOCK_DGRAM, 0);
     if(s == CURL_SOCKET_BAD)
       /* an IPv6 address was requested but we cannot get/use one */
       ipv6_works = 0;
diff --git a/lib/if2ip.c b/lib/if2ip.c
index 91ee59c02a..e501921d06 100644
--- a/lib/if2ip.c
+++ b/lib/if2ip.c
@@ -208,7 +208,7 @@ if2ip_result_t Curl_if2ip(int af,
   if(len >= sizeof(req.ifr_name))
     return IF2IP_NOT_FOUND;
 
-  dummy = socket(AF_INET, SOCK_STREAM, 0);
+  dummy = CURL_SOCKET(AF_INET, SOCK_STREAM, 0);
   if(CURL_SOCKET_BAD == dummy)
     return IF2IP_NOT_FOUND;
 
diff --git a/lib/memdebug.c b/lib/memdebug.c
index 0d8d39603c..cffd4b2cf6 100644
--- a/lib/memdebug.c
+++ b/lib/memdebug.c
@@ -311,7 +311,8 @@ curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
   if(countcheck("socket", line, source))
     return CURL_SOCKET_BAD;
 
-  sockfd = (socket)(domain, type, protocol);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  sockfd = socket(domain, type, protocol);
 
   if(source && (sockfd != CURL_SOCKET_BAD))
     curl_dbg_log("FD %s:%d socket() = %" FMT_SOCKET_T "\n",
@@ -328,7 +329,8 @@ SEND_TYPE_RETV curl_dbg_send(SEND_TYPE_ARG1 sockfd,
   SEND_TYPE_RETV rc;
   if(countcheck("send", line, source))
     return -1;
-  rc = (send)(sockfd, buf, len, flags);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  rc = send(sockfd, buf, len, flags);
   if(source)
     curl_dbg_log("SEND %s:%d send(%lu) = %ld\n",
                 source, line, (unsigned long)len, (long)rc);
@@ -342,7 +344,8 @@ RECV_TYPE_RETV curl_dbg_recv(RECV_TYPE_ARG1 sockfd, RECV_TYPE_ARG2 buf,
   RECV_TYPE_RETV rc;
   if(countcheck("recv", line, source))
     return -1;
-  rc = (recv)(sockfd, buf, len, flags);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  rc = recv(sockfd, buf, len, flags);
   if(source)
     curl_dbg_log("RECV %s:%d recv(%lu) = %ld\n",
                 source, line, (unsigned long)len, (long)rc);
@@ -354,7 +357,8 @@ int curl_dbg_socketpair(int domain, int type, int protocol,
                         curl_socket_t socket_vector[2],
                         int line, const char *source)
 {
-  int res = (socketpair)(domain, type, protocol, socket_vector);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  int res = socketpair(domain, type, protocol, socket_vector);
 
   if(source && (res == 0))
     curl_dbg_log("FD %s:%d socketpair() = "
@@ -371,6 +375,7 @@ curl_socket_t curl_dbg_accept(curl_socket_t s, void *saddr, void *saddrlen,
   struct sockaddr *addr = (struct sockaddr *)saddr;
   curl_socklen_t *addrlen = (curl_socklen_t *)saddrlen;
 
+  /* !checksrc! disable BANNEDFUNC 1 */
   curl_socket_t sockfd = accept(s, addr, addrlen);
 
   if(source && (sockfd != CURL_SOCKET_BAD))
@@ -388,7 +393,8 @@ curl_socket_t curl_dbg_accept4(curl_socket_t s, void *saddr, void *saddrlen,
   struct sockaddr *addr = (struct sockaddr *)saddr;
   curl_socklen_t *addrlen = (curl_socklen_t *)saddrlen;
 
-  curl_socket_t sockfd = (accept4)(s, addr, addrlen, flags);
+  /* !checksrc! disable BANNEDFUNC 1 */
+  curl_socket_t sockfd = accept4(s, addr, addrlen, flags);
 
   if(source && (sockfd != CURL_SOCKET_BAD))
     curl_dbg_log("FD %s:%d accept() = %" FMT_SOCKET_T "\n",
diff --git a/lib/memdebug.h b/lib/memdebug.h
index eabdd9c258..96ceb61759 100644
--- a/lib/memdebug.h
+++ b/lib/memdebug.h
@@ -42,10 +42,6 @@
 #define realloc(ptr,size) curl_dbg_realloc(ptr, size, __LINE__, __FILE__)
 #undef free
 #define free(ptr) curl_dbg_free(ptr, __LINE__, __FILE__)
-#undef send
-#define send(a,b,c,d) curl_dbg_send(a,b,c,d, __LINE__, __FILE__)
-#undef recv
-#define recv(a,b,c,d) curl_dbg_recv(a,b,c,d, __LINE__, __FILE__)
 
 #ifdef _WIN32
 #undef Curl_tcsdup
@@ -56,20 +52,6 @@
 #endif
 #endif /* _WIN32 */
 
-#undef socket
-#define socket(domain,type,protocol) \
-  curl_dbg_socket((int)domain, type, protocol, __LINE__, __FILE__)
-#ifdef HAVE_ACCEPT4
-#undef accept4 /* for those with accept4 as a macro */
-#define accept4(sock,addr,len,flags) \
-  curl_dbg_accept4(sock, addr, len, flags, __LINE__, __FILE__)
-#endif
-#ifdef HAVE_SOCKETPAIR
-#define socketpair(domain,type,protocol,socket_vector) \
-  curl_dbg_socketpair((int)domain, type, protocol, socket_vector, \
-                      __LINE__, __FILE__)
-#endif
-
 #undef fopen
 #define fopen(file,mode) curl_dbg_fopen(file,mode,__LINE__,__FILE__)
 #undef fdopen
diff --git a/lib/multi.c b/lib/multi.c
index 918928d03c..442956f844 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -1277,7 +1277,7 @@ static void reset_socket_fdwrite(curl_socket_t s)
   int t;
   int l = (int)sizeof(t);
   if(!getsockopt(s, SOL_SOCKET, SO_TYPE, (char *)&t, &l) && t == SOCK_STREAM)
-    send(s, NULL, 0, 0);
+    CURL_SEND(s, NULL, 0, 0);
 }
 #endif
 
diff --git a/lib/socketpair.c b/lib/socketpair.c
index 4151a9bb97..d2fd41141b 100644
--- a/lib/socketpair.c
+++ b/lib/socketpair.c
@@ -91,7 +91,7 @@ int Curl_socketpair(int domain, int type, int protocol,
 #ifdef SOCK_NONBLOCK
   type = nonblocking ? type | SOCK_NONBLOCK : type;
 #endif
-  if(socketpair(domain, type, protocol, socks))
+  if(CURL_SOCKETPAIR(domain, type, protocol, socks))
     return -1;
 #ifndef SOCK_NONBLOCK
   if(nonblocking) {
@@ -154,7 +154,7 @@ int Curl_socketpair(int domain, int type, int protocol,
   (void)type;
   (void)protocol;
 
-  listener = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+  listener = CURL_SOCKET(AF_INET, SOCK_STREAM, IPPROTO_TCP);
   if(listener == CURL_SOCKET_BAD)
     return -1;
 
@@ -188,7 +188,7 @@ int Curl_socketpair(int domain, int type, int protocol,
     goto error;
   if(listen(listener, 1) == -1)
     goto error;
-  socks[0] = socket(AF_INET, SOCK_STREAM, 0);
+  socks[0] = CURL_SOCKET(AF_INET, SOCK_STREAM, 0);
   if(socks[0] == CURL_SOCKET_BAD)
     goto error;
   if(connect(socks[0], &a.addr, sizeof(a.inaddr)) == -1)
diff --git a/lib/vquic/vquic.c b/lib/vquic/vquic.c
index 3a0ac87238..47fbf63af0 100644
--- a/lib/vquic/vquic.c
+++ b/lib/vquic/vquic.c
@@ -196,8 +196,8 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
 
   *psent = 0;
 
-  while((sent = send(qctx->sockfd,
-                     (const char *)pkt, (SEND_TYPE_ARG3)pktlen, 0)) == -1 &&
+  while((sent = CURL_SEND(qctx->sockfd, (const char *)pkt,
+                          (SEND_TYPE_ARG3)pktlen, 0)) == -1 &&
         SOCKERRNO == SOCKEINTR)
     ;
 
diff --git a/packages/OS400/os400sys.c b/packages/OS400/os400sys.c
index 7be7208549..bc227a0e69 100644
--- a/packages/OS400/os400sys.c
+++ b/packages/OS400/os400sys.c
@@ -333,6 +333,7 @@ Curl_getaddrinfo_a(const char *nodename, const char *servname,
     eservname[i] = '\0';
   }
 
+  /* !checksrc! disable BANNEDFUNC 1 */
   status = getaddrinfo(enodename, eservname, hints, res);
   free(enodename);
   free(eservname);
diff --git a/scripts/checksrc.pl b/scripts/checksrc.pl
index 28ad6315ba..0eeab72323 100755
--- a/scripts/checksrc.pl
+++ b/scripts/checksrc.pl
@@ -77,6 +77,14 @@ my %banfunc = (
     "_waccess" => 1,
     "_access" => 1,
     "access" => 1,
+    "accept" => 1,
+    "accept4" => 1,
+    "freeaddrinfo" => 1,
+    "getaddrinfo" => 1,
+    "recv" => 1,
+    "send" => 1,
+    "socket" => 1,
+    "socketpair" => 1,
     );
 
 my %warnings_extended = (
diff --git a/src/tool_cb_rea.c b/src/tool_cb_rea.c
index 0a3e9ef0ee..b7bd9a7227 100644
--- a/src/tool_cb_rea.c
+++ b/src/tool_cb_rea.c
@@ -92,7 +92,7 @@ size_t tool_read_cb(char *buffer, size_t sz, size_t nmemb, void *userdata)
    execute */
   if(per->uploadfile && !strcmp(per->uploadfile, ".") && per->infd > 0) {
 #if defined(_WIN32) && !defined(CURL_WINDOWS_UWP) && !defined(UNDER_CE)
-    rc = recv(per->infd, buffer, curlx_uztosi(sz * nmemb), 0);
+    rc = CURL_RECV(per->infd, buffer, curlx_uztosi(sz * nmemb), 0);
     if(rc < 0) {
       if(SOCKERRNO == SOCKEWOULDBLOCK) {
         CURL_SETERRNO(0);
diff --git a/src/tool_cb_soc.c b/src/tool_cb_soc.c
index 22048ee6bb..d89870297c 100644
--- a/src/tool_cb_soc.c
+++ b/src/tool_cb_soc.c
@@ -54,5 +54,5 @@ curl_socket_t tool_socket_open_mptcp_cb(void *clientp,
     return CURL_SOCKET_BAD;
 #endif
 
-  return socket(addr->family, addr->socktype, protocol);
+  return CURL_SOCKET(addr->family, addr->socktype, protocol);
 }
diff --git a/src/tool_doswin.c b/src/tool_doswin.c
index bfe013d8e5..0450e5707b 100644
--- a/src/tool_doswin.c
+++ b/src/tool_doswin.c
@@ -785,7 +785,7 @@ static DWORD WINAPI win_stdin_thread_func(void *thread_data)
       break;
     if(n == 0)
       break;
-    nwritten = send(socket_w, buffer, n, 0);
+    nwritten = CURL_SEND(socket_w, buffer, n, 0);
     if(nwritten == SOCKET_ERROR)
       break;
     if((DWORD)nwritten != n)
@@ -889,7 +889,7 @@ curl_socket_t win32_stdin_read_thread(void)
     }
 
     /* Connect to the thread and rearrange our own STDIN handles */
-    socket_r = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    socket_r = CURL_SOCKET(AF_INET, SOCK_STREAM, IPPROTO_TCP);
     if(socket_r == CURL_SOCKET_BAD) {
       errorf("socket error: %08lx", GetLastError());
       break;
diff --git a/tests/libtest/lib1960.c b/tests/libtest/lib1960.c
index 5cdc022426..1ee9277bef 100644
--- a/tests/libtest/lib1960.c
+++ b/tests/libtest/lib1960.c
@@ -96,7 +96,7 @@ static CURLcode test_lib1960(const char *URL)
    * over this socket as "already connected" to libcurl and make sure that
    * this works.
    */
-  client_fd = socket(AF_INET, SOCK_STREAM, 0);
+  client_fd = CURL_SOCKET(AF_INET, SOCK_STREAM, 0);
   if(client_fd == CURL_SOCKET_BAD) {
     curl_mfprintf(stderr, "socket creation error\n");
     goto test_cleanup;
diff --git a/tests/libtest/lib500.c b/tests/libtest/lib500.c
index 0586c1407f..7081ec625d 100644
--- a/tests/libtest/lib500.c
+++ b/tests/libtest/lib500.c
@@ -35,7 +35,7 @@ static curl_socket_t tst_opensocket(void *clientp,
   (void)clientp;
   (void)purpose;
   curl_mprintf("[OPEN] counter: %d\n", ++testcounter);
-  return socket(addr->family, addr->socktype, addr->protocol);
+  return CURL_SOCKET(addr->family, addr->socktype, addr->protocol);
 }
 
 static int tst_closesocket(void *clientp, curl_socket_t sock)
diff --git a/tests/server/.checksrc b/tests/server/.checksrc
index 8b1bcabe77..be8f12cec0 100644
--- a/tests/server/.checksrc
+++ b/tests/server/.checksrc
@@ -1 +1,7 @@
+allowfunc accept
+allowfunc freeaddrinfo
+allowfunc getaddrinfo
+allowfunc recv
+allowfunc send
+allowfunc socket
 allowfunc strtoul