[Skip to main content](#vessel-content) # Subject: Query string parameters (utm\_source, gclid, fbclid) are converted into ## - **[smoothie](/forum/user/7989-smoothie "View smoothie's Profile")** - [![smoothie's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar7989.jpg)](/forum/user/7989-smoothie "View smoothie's Profile") Topic Author - [ Offline](/forum/user/7989-smoothie) Less More - Posts: 29 - Thank you received: 0 - - 3 weeks 10 hours ago [\#100000079](#100000079) by [smoothie](/forum/user/7989-smoothie "View smoothie's Profile") *[Subject: Query string parameters (utm\_source, gclid, fbclid) are converted into](/forum/32-content-creation/100000018-subject-query-string-parameters-utm-source-gclid-fbclid-are-converted-into#100000079 "-- url of the page with the problem -- : hungarianflavours.com/hu -- HikaShop version -- : 6.6.0 -- Joomla version -- : 6.1.0 -- PHP version -- : 8.3 -- Browser(s) name and version -- : Chrome 150.0.7871.125 Subject: Query string parameters (utm_source, gclid, fbclid) are converted into SEF path segments via redirect – tracking data lost, cookies/session ID leaked into URL Environment * Joomla 6.1.0, HikaShop [VERSION] * PHP 8.3 (CGI/FastCGI), Apache behind nginx * Joomla SEF + URL rewriting enabled, multilingual site (Language Filter, URL prefix ) * HikaShop: "Remove products and categories id in URLs" = Yes, "Force canonical URLs on listings" = "Use canonical URL and generate it if missing", category SEF name = Steps to reproduce * Open any HikaShop page with any query string parameter, e.g.: * * * (menu item of the main category listing) * HikaShop immediately redirects to a URL where every request variable is appended as a path segment: * * → 404 on the main shop listing * → → 404 Joomla com_content pages on the same site keep the query string and do not redirect, so the behaviour is HikaShop-specific. Additional finding (security) On our server was empty, so also contained cookies. Because of this, the redirect URL contained all cookie values, including the session cookie, e.g.: This means a visitor's session ID ends up in the address bar, in shared links and in analytics. We have set as a workaround, but HikaShop should not build redirect URLs from (cookies) at all. Impact * Google Ads auto-tagging ( , , ), Facebook and UTM parameters are removed from the query string before the page loads, so Google Ads / GA4 conversion attribution and campaign tracking do not work for shop pages. * 404 errors for ad and social clicks landing on the main shop listing and on the cart. * Duplicate URLs ( ) that can get crawled. Expected behaviour Unknown or third-party query parameters (at least , , , , , , , ) should be left in the query string, with no redirect. Cookie values must never be used to build URLs. Question Which code or setting triggers this "redirect to SEF URL with all request vars"? Is there a configuration option to disable it, or to whitelist or ignore tracking parameters? A patch or a pointer to the responsible file would be very welcome. Current workaround on our side An rule that 301-redirects any URL containing a tracking segment ( , , ) to the clean URL. This prevents the 404s, but the tracking data is still lost.")* was created by *[smoothie](/forum/user/7989-smoothie "View smoothie's Profile")* -- url of the page with the problem -- : [ hungarianflavours.com/hu](https://hungarianflavours.com/hu) -- HikaShop version -- : 6.6.0 -- Joomla version -- : 6.1.0 -- PHP version -- : 8.3 -- Browser(s) name and version -- : Chrome 150.0.7871.125 **Subject:** Query string parameters (utm_source, gclid, fbclid) are converted into SEF path segments via redirect – tracking data lost, cookies/session ID leaked into URL **Environment** - Joomla 6.1.0, HikaShop \[VERSION\] - PHP 8.3 (CGI/FastCGI), Apache behind nginx - Joomla SEF + URL rewriting enabled, multilingual site (Language Filter, URL prefix Code: /hu ) - HikaShop: "Remove products and categories id in URLs" = Yes, "Force canonical URLs on listings" = "Use canonical URL and generate it if missing", category SEF name = Code: kategoria **Steps to reproduce** 1. Open any HikaShop page with any query string parameter, e.g.: - Code: https://hungarianflavours.com/hu/webaruhaz/bio-ceklale?utm_source=facebook - Code: https://hungarianflavours.com/hu/webaruhaz/kategoria/gyumolcslevek?gclid=abc - Code: https://hungarianflavours.com/hu/webaruhaz?utm_source=x (menu item of the main category listing) 2. HikaShop immediately redirects to a URL where every request variable is appended as a path segment: - Code: /hu/webaruhaz/bio-ceklale/utm_source-facebook - Code: /hu/webaruhaz/utm_source-x → **404** on the main shop listing - Code: /hu/webaruhaz/kosar?utm_source=x → Code: /hu/webaruhaz/kosar/view-category/layout-listing/utm_source-x → **404** Joomla com_content pages on the same site keep the query string and do not redirect, so the behaviour is HikaShop-specific. **Additional finding (security)** On our server Code: request_order was empty, so Code: $_REQUEST also contained cookies. Because of this, the redirect URL contained all cookie values, including the session cookie, e.g.: Code: /hu/webaruhaz/bio-ceklale/utm_source-x/hikashop_blockCols-.../cookie_price_display-2/.../PHPSESSID-<session id>/... This means a visitor's session ID ends up in the address bar, in shared links and in analytics. We have set Code: request_order = "GP" as a workaround, but HikaShop should not build redirect URLs from Code: $_REQUEST (cookies) at all. **Impact** - Google Ads auto-tagging ( Code: gclid , Code: gbraid , Code: wbraid ), Facebook Code: fbclid and UTM parameters are removed from the query string before the page loads, so Google Ads / GA4 conversion attribution and campaign tracking do not work for shop pages. - 404 errors for ad and social clicks landing on the main shop listing and on the cart. - Duplicate URLs ( Code: /product/utm_source-xxx ) that can get crawled. **Expected behaviour** Unknown or third-party query parameters (at least Code: utm_* , Code: gclid , Code: gbraid , Code: wbraid , Code: fbclid , Code: msclkid , Code: _gl , Code: srsltid ) should be left in the query string, with no redirect. Cookie values must never be used to build URLs. **Question** Which code or setting triggers this "redirect to SEF URL with all request vars"? Is there a configuration option to disable it, or to whitelist or ignore tracking parameters? A patch or a pointer to the responsible file would be very welcome. **Current workaround on our side** An Code: .htaccess rule that 301-redirects any Code: /hu/webaruhaz/... URL containing a tracking segment ( Code: utm_*-… , Code: gclid-… , Code: fbclid-… ) to the clean URL. This prevents the 404s, but the tracking data is still lost. Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzMyLWNvbnRlbnQtY3JlYXRpb24vMTAwMDAwMDE4LXN1YmplY3QtcXVlcnktc3RyaW5nLXBhcmFtZXRlcnMtdXRtLXNvdXJjZS1nY2xpZC1mYmNsaWQtYXJlLWNvbnZlcnRlZC1pbnRvP3RtcGw9bWFya2Rvd24=) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. - **[nicolas](/forum/user/63-nicolas "View nicolas's Profile")** - [![nicolas's Avatar](https://www.hikashop.com/media/kunena/avatars/resized/size144/users/avatar63.png)](/forum/user/63-nicolas "View nicolas's Profile") - [ Offline](/forum/user/63-nicolas) Less More - Posts: 86289 - Thank you received: 14266 - - 2 weeks 6 days ago [\#100000080](#100000080) by [nicolas](/forum/user/63-nicolas "View nicolas's Profile") Replied by *[nicolas](/forum/user/63-nicolas "View nicolas's Profile")* on topic *[Subject: Query string parameters (utm\_source, gclid, fbclid) are converted into](/forum/32-content-creation/100000018-subject-query-string-parameters-utm-source-gclid-fbclid-are-converted-into#100000080 "-- url of the page with the problem -- : hungarianflavours.com/hu -- HikaShop version -- : 6.6.0 -- Joomla version -- : 6.1.0 -- PHP version -- : 8.3 -- Browser(s) name and version -- : Chrome 150.0.7871.125 Subject: Query string parameters (utm_source, gclid, fbclid) are converted into SEF path segments via redirect – tracking data lost, cookies/session ID leaked into URL Environment * Joomla 6.1.0, HikaShop [VERSION] * PHP 8.3 (CGI/FastCGI), Apache behind nginx * Joomla SEF + URL rewriting enabled, multilingual site (Language Filter, URL prefix ) * HikaShop: "Remove products and categories id in URLs" = Yes, "Force canonical URLs on listings" = "Use canonical URL and generate it if missing", category SEF name = Steps to reproduce * Open any HikaShop page with any query string parameter, e.g.: * * * (menu item of the main category listing) * HikaShop immediately redirects to a URL where every request variable is appended as a path segment: * * → 404 on the main shop listing * → → 404 Joomla com_content pages on the same site keep the query string and do not redirect, so the behaviour is HikaShop-specific. Additional finding (security) On our server was empty, so also contained cookies. Because of this, the redirect URL contained all cookie values, including the session cookie, e.g.: This means a visitor's session ID ends up in the address bar, in shared links and in analytics. We have set as a workaround, but HikaShop should not build redirect URLs from (cookies) at all. Impact * Google Ads auto-tagging ( , , ), Facebook and UTM parameters are removed from the query string before the page loads, so Google Ads / GA4 conversion attribution and campaign tracking do not work for shop pages. * 404 errors for ad and social clicks landing on the main shop listing and on the cart. * Duplicate URLs ( ) that can get crawled. Expected behaviour Unknown or third-party query parameters (at least , , , , , , , ) should be left in the query string, with no redirect. Cookie values must never be used to build URLs. Question Which code or setting triggers this "redirect to SEF URL with all request vars"? Is there a configuration option to disable it, or to whitelist or ignore tracking parameters? A patch or a pointer to the responsible file would be very welcome. Current workaround on our side An rule that 301-redirects any URL containing a tracking segment ( , , ) to the clean URL. This prevents the 404s, but the tracking data is still lost.")* Hi, The redirect comes from the "Strict routing" option of Joomla's "System - SEF" plugin (added in Joomla 5.2). On a page opened with a query string, Joomla rebuilds the URL from all the request variables and redirects to it when the rebuilt URL has no query string left. HikaShop's router turns any variable it doesn't know into a path segment (name-value), so utm_source, gclid, fbclid, etc. were moved into the path and the query string was lost. Joomla takes these variables from $_REQUEST, which is why the cookies ended up in the URL when PHP's request_order was empty. We have corrected HikaShop's router: tracking parameters (utm_*, gclid, gbraid, wbraid, fbclid, msclkid, _gl, srsltid, and other common ones such as mtm_*, pk_*, dclid, ttclid, mc_cid) now stay in the query string, so Joomla no longer redirects, and a variable that only comes from a cookie is never put in a URL anymore. The fix is in front/router.php (components/com_hikashop/router.php on your site) and is included in a new HikaShop build. Until you update, you can go to Extensions > Plugins > "System - SEF" and set "Strict routing" to No: the redirect will stop and the tracking parameters will stay in the URL. Keeping request_order = "GP" in PHP is also the right setting. But you can just download the new build of HikaShop on our website and install it on your website in order to get the modifications for this to be handled properly by HikaShop's router. The following user(s) said Thank You: [brettv](/forum/user/68705-brettv "View brettv's Profile") Please [Log in](/login?return=aHR0cHM6Ly93d3cuaGlrYXNob3AuY29tL2ZvcnVtLzMyLWNvbnRlbnQtY3JlYXRpb24vMTAwMDAwMDE4LXN1YmplY3QtcXVlcnktc3RyaW5nLXBhcmFtZXRlcnMtdXRtLXNvdXJjZS1nY2xpZC1mYmNsaWQtYXJlLWNvbnZlcnRlZC1pbnRvP3RtcGw9bWFya2Rvd24=) or [Create an account](/component/users/registration?Itemid=101) to join the conversation. Board Categories HikaShop- Install & Update- Product & Category Display- Content Creation- Sales and Orders- - Orders management- - Reports & Statistics- Customers- Checkout- Payment Methods- Shipping Methods- Import & Export (CSV, XLS…)- Specific Features- - Affilation- - Taxes- - Wishlist- - Vote- - Carousel & Slider- - Mass Actions- - Filters & Search- - Discount & Coupon- - Feature Request- Integrations- Showcase- General Talk about HikaShop- Development- - HikaShop 3.0 Beta- Translation- Commercial Jobs HikaShop Components- HikaMarket- - Market: Feature requests- - Market: How to?- - Market: Bug Report- HikaSerial- - General talk about HikaSerial- - Serial: Bug Report- - Serial: How to?- - Support en Français de HikaSerial (French Support)- - HikaSubscription- HikaAuction- - Auction: Feature requests- - Auction: How to?- - Auction: Bug report Hikashop around the world- Support en Français (French Support)- Russian- - FAQ. Курс выживания с Hikashop. Частые вопросы и о- - Расширения Hikashop- - Наши сайты на Hikashop- 日本語版サポート(Japanese Support)- Thai- German Archives- Bug Report- How to? [](/forum/topics/feed/mode-topics?format=feed&type=rss) Time to create page: 0.154 seconds [Powered by](/forum/credits) [Kunena Forum](https://www.kunena.org) [](#top)