Visitor using URL that doesn't exist

Question

I had someone visit my site today from a link like this:

www.example.com/pagename.php?_sm_byp=iVVVMsFFLsqWsDL4

Can someone explain to me how that works since my actual URL ends with pagename.php and I never allowed a user to input any PHP query and never have session IDs or anything similar.

Answer 1

This is not unusual. Many sites/servers allow (or rather, ignore) arbitrary query components.

For example, you can append ?foo=bar to those URLs and still get a HTTP status 200:

• https://stackoverflow.com/?foo=bar
• http://en.wikipedia.org/wiki/Stack_Overflow?foo=bar

Now as they are linked here, users might visit them, so these URLs would appear in their logs. Apart from manually appending such a query component, they might also be added by various scripts, e.g. for tracking purposes, or third-party services that link to your pages (… and sometimes their origin is unknown).

If you don’t want your URLs to work with arbitrary query components, you can configure your backend/server in such a way that it redirects to the URLs without the query components, or respond with 404, or whatever.

If you keep allowing this, but want to prevent that bots index your URLs with these unnecessary query components, you can specify the canonical variants of your URLs with the canonical link relation.