Developer Chris Morgan Bans Unauthorized Query Strings to Prevent URL Tracking

Chris Morgan banea query strings sin autorización en su sitio web

On May 8, 2026, developer Chris Morgan implemented a server-side ban on unauthorized query strings at chrismorgan.info. The measure specifically targets parameters like utm_source and ref that services automatically inject into links, effectively returning a 400 Bad Request error for modified URLs.

Why This Matters

In the modern web ecosystem, URLs have transformed from stable resource identifiers into vectors for third-party tracking. While UTM parameters were originally designed as an internal marketing tool (Urchin, 2005), their current pervasive use by external platforms breaks browser caching, complicates SEO through duplicate content, and bloats server logs with redundant data. By rejecting these strings at the server level, developers can reclaim control over their resource namespaces and enforce privacy without relying solely on client-side browser features. This technical stance highlights the conflict between resource integrity and the data-collection needs of the advertising industry.

Key Insights

• UTM parameters originated from Urchin Tracking Module (UTM) in 2005 before Google Analytics acquisition.
• The HTTP Referer header provides source information without modifying the URL, making most tracking strings redundant for technical analytics.
• Firefox (2021), Safari, and Brave have integrated native features to strip tracking parameters from URLs during navigation.
• Uncontrolled query strings can multiply URL length by five times, significantly impacting CDN cache hit ratios.
• Implementation via Caddyfile allows for precise matching and rejection of the query directive at the infrastructure level.

Working Examples

Caddy configuration to block any request containing a query string with a 400 error.

example.com {
  @hasQuery {
    query *
  }
  handle @hasQuery {
    respond "Query strings not allowed" 400
  }
  root * /var/www/site
  file_server
}

Nginx configuration to strip query strings by redirecting the user to the clean URI.

server {
  listen 443 ssl;
  server_name example.com;
  if ($args) {
    return 301 $scheme://$host$uri;
  }
  location / {
    root /var/www/site;
  }
}

Apache rule to discard original query strings using a 301 redirect.

RewriteEngine On
RewriteCond %{QUERY_STRING} .
RewriteRule ^(.*)$ /$1? [R=301,L]

Practical Applications

• Use Case: Personal blogs and static documentation sites can use whitelists to allow only essential parameters like pagination while dropping marketing trackers.
• Pitfall: Applying blanket bans on CMS platforms like WordPress or Magento will break core functionality such as search filters and administrative dashboards.
• Use Case: SEO optimization via server-side normalization ensures crawlers only index the canonical version of a page, preventing authority fragmentation.

References:

• https://dev.to/lu1tr0n/chris-morgan-banea-query-strings-sin-autorizacion-en-su-sitio-web-4oaa