[wp-trac] [WordPress Trac] #26878: Question mark in the url doesn't return 404 and can be abused

[WordPress Trac]

#26878: Question mark in the url doesn't return 404 and can be abused
--------------------------+----------------------
 Reporter:  Andrew8192    |       Owner:
     Type:  defect (bug)  |      Status:  closed
 Priority:  normal        |   Milestone:
Component:  Query         |     Version:
 Severity:  normal        |  Resolution:  invalid
 Keywords:                |
--------------------------+----------------------

Comment (by TobiasBg):

 You could create some rewrite rules on your server via a `.htaccess` file.
 For details on how to do that, please either ask in the forums at
 http://wordpress.org/support/ or contact your webhost.

 However, you should actually try to find if there's really such unwanted
 content on your site (maybe because you got hacked). Simply
 blocking/rewriting certain URLs won't help against that.

 Adding a general rewrite rule in WordPress for this is not possible, as
 those URLs are perfectly valid and user might have legitimate use cases
 for such URLs.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/26878#comment:4>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform