Why does google index pages with …/?wordfence_logHuman=1&hid=…

Hi @mbeerli,

Generally speaking, Wordfence ?wordfence_lh=x&hid=xxx... query string URLs are used by Live Traffic so are normal to observe. wordfence_lh is checking whether the visitor was detected as human. hid=... is an encrypted unique identifier so the record can be matched to another in the database.

However, if Google bots start listing them as “legitimate” site pages, in our experience this is usually due to a theme misconfiguration where they’re automatically redirecting any invalid page URLs to the homepage, or another page. The expected behaviour when these URLs are visited directly is to return a blank page and for Google not to index them for search results. You may need to consult your theme developer, or address plugin/custom code settings that might be causing this behaviour.

Thanks,

Peter.

Hi @mbeerli,

Let me know how you get on!

Peter.

Hi @mbeerli,

Thanks for the additional information about changing the theme and still seeing the behavior.

Could you send a diagnostic report to wftest @ wordfence . com? You can find the link to do so at the top of the Wordfence Tools > Diagnostics page. Then click on “Send Report by Email”. Please add your forum username where indicated and respond here after you have sent it.

Note: For the fastest response time, please make sure and add any information or questions directly to this topic and not the email address above unless asked.

Thanks,

Peter.

Hi @mbeerli,

The report does send detailed about your WordPress configuration and the environment it’s installed on so that we can help you. Often, issues we address will require quite a high level of background knowledge to diagnose issues that could be preventing Wordfence from running as intended.

We may have seen the problem before because of a WordPress plugin you have installed, or other misconfiguration that we could pick up on from the diagnostic. Naturally we always recommend these details are kept away from the public forums which is why we request them to a private mailbox.

Thanks again,

Peter.

Hi @mbeerli, thanks for sending your diagnostics over. I have been on annual leave and whilst my colleagues have been manning the forums, topics can sometimes get missed. We always endeavour to respond within 10 days regardless of the situation so I apologise for this being on the slightly later end of that scale.

I have reviewed the link mentioned in your original post and notice that either a .htaccess RewriteRule or other theme/plugin action is converting query strings into searchable WordPress terms on your website. The usual action for a url ending with ?wordfence_logHuman=1&hid=6ADB7DE84A85D7F4E428BFD37BF6CE46 is to display a blank page, but the URL that resolves on your site when trying this is actually ?s=%3Fwordfence+logHuman%3D1%26hid%3D6ADB7DE84A85D7F4E428BFD37BF6CE46&search_404=1

This shows ?s= has been appended to the URL to treat the query string as a WordPress search and search_404=1 appears at the end. This seems to be a setting where 404s are turned into search terms rather than resolving as the usual “File Not Found”. I can see a table in your database called wp_redirection_404 which seems to relate to a plugin called Redirection (redirection) – Version 5.1.1

To restore the usual functionality of the Wordfence querystrings resolving a blank page so that Google doesn’t index them, you will need to either disable this plugin, or configure it so that our query strings (or 404s in general) are not affected by the redirect action. Google will also be indexing any links that are converted in this manner as “valid” pages, not just Wordfence.

Thanks,

Peter.

Hi @mbeerli,

If I have mistaken the URL appending search_404=1 and Redirection being involved in reforming an invalid URL into a search string, I apologise but it was to try narrowing down a cause so you could address it directly.

Regardless of this, the rest of my post stands that something is identifying 404 URLs, and choosing to use the default WordPress search function as a way to direct the visitor to a page related to the URL they tried to visit. This could still be a .htaccess RewriteRule, some code included with your theme, or a plugin.

If you open the .htaccess file in the root of your site using your hosting control panel’s file manager, look for something similar to:

<IfModule mod_rewrite.c>
RewriteEngine On
... there may be other code in this section...
RewriteCond %{QUERY_STRING} (^|&)(.*)
RewriteRule ^(.*)$ /?s=%2 [R=404,L]
</IfModule>

Always make a backup of the original file before making any changes yourself in case this file needs to be reinstated for your site to work. The above shows a query string being converted into a search, much like what is happening in your case. Feel free to paste anything you see resembling this here before attempting to go any further.

If there are no custom rewrite rules in your .htaccess, my next hunch would be the theme is causing this, so try switching to a default theme such as Twenty Twenty-One and try hitting one of these querystring URLs again. If the search behaviour continues, disabling all plugins except for Wordfence could help see if the issue stops. If it does, re-enable your other plugins one-by-one to see when the redirect starts cropping up again. You can install a maintenance mode plugin during this time if site visitors are likely to be impacted during your tests.

Thanks again,

Peter.