Query strings explained: what comes after the question mark, and what it changes

SEO & Marketing·· 17 views· 4 min read

The short answer: everything after the ? in an address is the query string: name=value pairs separated by &, up to the end of the address or a “#”. The page is the same one, but it receives them and may show something else: a search, a filter, page 2 of a list. Some parameters are not yours: ad platforms and social networks add their own click identifiers to links (such as gclid or fbclid). Parameters touch three things: the content, the cache and the addresses Google sees.

Kinds of parameter, and what to do with each

Kind and example What to do
Search: ?s=shoes The site’s own search (in WordPress it is called s). It does not need to appear in Google.
Filters and sorting: ?colour=blue&sort=price Every combination is a new address with almost the same content. The canonical tag should point to the clean version: the canonical tag.
Pagination: ?page=2 Each page of the list points its canonical at itself, not at page 1.
Campaigns and clicks: utm_source, gclid, fbclid They do not change the content: they are for measuring. Canonical to the clean version and, where the cache allows it, a cache that ignores them. See UTM links.
File version: style.css?v=3 Forces the browser to fetch the new version: versioned file names and cache busting.
Sessions, passwords and keys: ?token=... Avoid. They end up in history, in server logs and in any shared link.

Using parameters without breaking pages

1 Only one question mark. The first parameter goes after “?”, the rest after “&”. If the address already has a “?”, add with “&”: asuaempresa.ao/promo?utm_source=email&utm_medium=email, not asuaempresa.ao/promo?utm_source=email?utm_medium=email.
2 Values with spaces or symbols must be encoded: an “&” or a “#” inside a value cuts it in half. See spaces, accents and symbols in links.
3 Make sure redirects carry the parameters. In .htaccess, a Redirect 301 passes them on to the destination by itself. A RewriteRule passes them too, except when the destination has its own “?”: then the old ones are dropped unless you add the QSA flag (the QSD flag drops them on purpose). Test with curl -I "https://asuaempresa.ao/old-page?utm_source=test" and check the destination still carries utm_source. More rules in .htaccess for PHP projects.
4 Review the page cache. A cache usually stores each combination of parameters as a separate page, and a click identifier that changes on every visit makes the cache miss every time. Look in your cache settings for an option to ignore campaign parameters: installing and tuning a page cache.
5 Tell Google which version is the main one: canonical to the clean address, and internal links always without campaign parameters.
6 If you write code, remember anyone can change a parameter in the bar. In PHP, whatever arrives in $_GET is validated and escaped before you display it or use it in a query: a safe website form: validation.
Never put passwords, access keys or personal data in the query string. The full address is kept in browser history, in the server’s access logs, in analytics reports and in any screenshot or link someone copies and shares. That data goes in the body of a form sent by POST, never in the address.
A page only breaks when it comes from an ad? Open it with and without the gclid or fbclid. If it only fails with it, a plugin, a security rule or a redirect rule is reacting to the parameter.

Losing parameters in a redirect, or a page that fails only with them? Send us the full failing address and what you expected to see.

Open a support ticket

SEE ALSO

UTM links: finding out which campaign brought each visit

The canonical tag: duplicate pages, www or not, and which address Google keeps

Visitors still see the old CSS or logo: versioned file names and cache busting

Installing and tuning a page cache

Spaces, accents and symbols in links and file names: URL encoding without broken links

The parts of a web address: scheme, domain, port, path, query and fragment

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.59/mo (3-year plan, with coupon)

See plans
Was this answer helpful? Your answer helps us improve this article.

Related Articles

SEO & Marketing 172 The best SEO plugins for WordPress and how to choose one An SEO plugin gathers, in a single panel inside WordPress, the technical settings that help search engines understand yo...
SEO & Marketing 249 Being found on Google: Business Profile, Search Console and the basics Having a website is not the same as being found. They are different things, and the second does not happen by itself - y...
SEO & Marketing 200 E-mail marketing: doing it properly without burning your domain E-mail is still the channel that returns most per unit of money spent - and also the one where it is easiest to ruin eve...
SEO & Marketing 242 SMS marketing: Sender ID, the rules here, and how to write one that works SMS has an advantage no other channel has here: it reaches everybody, without depending on internet access, an installed...
SEO & Marketing 223 What Yoast SEO is, and what it actually does Yoast SEO is a WordPress plugin that gathers, into a single panel, the technical settings that help search engines under...
SEO & Marketing 12 The slash at the end, capital letters and index.html: one page at several addresses The short answer: to a browser and to Google, /contact, /contact/, /Contact and /contact/index.html are four different a...