How To Remove Query Strings From WordPress For Security

Previously shown how to use the hacking tools like sqlmap to test own WordPress for SQL Injection in White Hat way. We also talked about SQL Injection. Here is how to remove query strings from WordPress for security specially to avoid MySQL injections via PHP files for server running Apache2. For Nginx, we talked about how to remove ?utm_source like query strings in older article. Query strings also affects page loading speed but that is only important for static files. We are actually talking about the PHP files aka WordPress main installation.

How To Remove Query Strings From WordPress For Security

Actually .htaccess is secondary choice for performance over Apache2 main server config file. However, in many cases, we need to depend temporarily or permanently on .htaccess. If you want to remove all query strings and then redirects to the home page without query string (Not recommended at production site) :

Check your server access log file, error logs for URLs with parameters seeking query strings. If a bad request is like :

And you are willing form:

Now, the .htaccess rule will be :

.php? is removed in above example. But if the above case involves too many URLs at log then :

If you use :

then you’ll get :

For WordPress actually there are many common ways including using WordPress plugin and a common method to add this stanza in directory not following WordPress permalink direction :

after the directive line :

RewriteBase / is the main domain, if it is subdirectory, then append the subdirectory name instead of only /. Also, instead of redirecting to remove query string, you can block some files with password.