Parameter keep / drop
The UTM cleaner knows about tracking parameters. This one takes any list of parameter names — yours, with wildcards — and either keeps only those or drops only those, across every URL in the list. An allowlist is the stronger move: it removes the parameters you have not thought of yet.
Parameters seen
How to use
- Paste the URL list.
- Pick a Preset to fill the names box, or write your own.
utm_*matches every parameter startingutm_; names are matched case-insensitively. - Choose Mode. Drop removes the listed parameters; Keep removes everything else.
- Turn on Sort if the output feeds a cache or a signature, where parameter order changes the key.
- Turn on Remove URLs that become identical to collapse the list — twenty tracking variants of one page become one URL.
- Check the Parameters seen table. It lists every parameter name in the input with what happened to it, which is the fastest way to notice a parameter you did not know your site emitted.
Allowlist beats blocklist
A blocklist removes what you listed. An allowlist removes everything you did not — including the parameter a third-party script started appending last week, the one your email tool adds, and the one a partner site uses for attribution. For canonicalisation, deduplication and cache keys, the allowlist is the correct approach, because the set of parameters that genuinely change the page is small and knowable, while the set that does not is unbounded.
The practical form: list the parameters that select content — id, page, q, lang, variant — set mode to Keep only these, and everything else disappears. Then turn on dedupe and see how much of your URL inventory was noise.
One category deserves separate attention. The Session tokens and secrets preset targets sessionid, token, access_token, api_key, password and similar. A secret in a query string is a genuine incident, not untidiness: URLs are written to server access logs, proxy logs, browser history, and — for outbound links — the Referer header sent to third parties. If these turn up in a real URL list, stripping them from the list is the smallest part of the fix. The URL privacy audit looks specifically for this class of leak.
FAQ
How do wildcards work?
* matches any run of characters, so utm_* catches utm_source and utm_whatever, and *_id catches campaign_id and product_id. Without a *, the name must match exactly (ignoring case).
Are repeated parameters handled?
Yes — every occurrence is evaluated, and a name that survives keeps all its values in order. A URL with ?tag=a&tag=b keeps both.
Why is the output URL re-encoded?
Because rebuilding the query goes through the browser's URL parser: escapes are normalized and the host is lowercased. If you need the rest of the URL byte-identical, use the bulk find and replace in whole-URL mode instead.
What is the difference from the UTM cleaner?
The UTM cleaner has a fixed built-in list of tracking parameters and explains what each one was. This is the general tool: any names you like, wildcards, keep-or-drop, and an allowlist mode.