Stripping tracking parameters from pasted video links before I send them anywhere

When someone pastes a TikTok or Instagram link into ramrom.io, the link almost never looks like the clean address you would type by hand. It looks more like this:

https://www.tiktok.com/@someone/video/7123456789012345678?_t=8abc&_r=1 

or this:

https://www.instagram.com/reel/CxYz123AbCd/?igshid=MTc4MmM1YmI2Ng== 

That trailing junk after the ? is tracking. It tells the platform who shared the link, which app it came from, and sometimes which session it was copied in. None of it identifies the video. The video is identified by the part in the path — the video ID. So before my site does anything else with a pasted link, it strips the tracking parameters out.

Why bother?

Three reasons, and none of them are fancy.

First, the provider I send the link to does not need the tracking data, so I do not send it. The less I pass along, the less there is to leak, log or go stale.

Second, two people sharing the same video paste two different links, because each copy carries its own tracking token. Once the junk is gone, both links look identical. That makes everything downstream simpler: my rate limiter sees one shape of URL, my logs are readable, and I can tell at a glance whether two requests are for the same video.

Third, some providers are picky. A link with a long tail of parameters can fail to resolve when the clean form works fine. Cleaning first means fewer mysterious failures that are really just a messy URL.

What I keep and what I drop

The rule is simple: keep the parameters that identify the video, drop everything that describes the share. On YouTube, the video ID lives in v=, so that one stays; si=, utm_source and friends go. On TikTok and Instagram, the ID is in the path, so everything after the ? goes. That includes the short-link hosts too — vt.tiktok.com and youtu.be get expanded first, then cleaned the same way.

In PHP it is a small job. parse_url splits the address into its parts, and parse_str turns the query into an array I can filter against an allow-list per platform:

$parts = parse_url($url); parse_str($parts['query'] ?? '', $query); $keep = ['v']; // YouTube only — TikTok and Instagram need nothing $clean = array_intersect_key($query, array_flip($keep)); $cleanUrl = $parts['scheme'] . '://' . $parts['host'] . $parts['path'] . ($clean ? '?' . http_build_query($clean) : ''); 

Then the cleaned link is checked against the list of platforms I support, and only then does it go to the provider. The user never sees any of this; they paste whatever their app gave them, and the box quietly accepts it.

What this does not do

Stripping tracking parameters does not make a link private. The video is still public, the platform still knows it was watched, and anyone with the cleaned link can still open it. What it does is stop me passing along data I never needed in the first place.

It is a small habit, but it is the kind of small habit a tool site is built out of. Clean the input, keep only what the job needs, and say plainly what you kept and what you dropped. That is the whole trick — and it takes about twenty lines of code.