I work on OnePassApps, so this is our own site, and everything below was measured on app.onepassapps.com today from outside the browser - plain HTTPS requests, no session, no cookies, no JavaScript.

Every link we publish carries tracking parameters. This post is about what the site does with them once they arrive: the query string, the trailing slash, the capital letter and the doubled slash. It is the tracking-link contract, measured on all 56 URLs in our own sitemap.xml.

The query string does not reach the document

I sent every one of the 56 sitemap URLs two GETs - one bare, one with ?utm_source=devto&utm_medium=post&utm_campaign=probe - and compared the two bodies.

  • All 56 answered 200.
  • All 56 came back with the same content-length in both requests.
  • Not one of the 56 was byte-for-byte identical. Every pair differed, and every byte that differed sat inside Cloudflare's per-request email-obfuscation token - the hex in the /cdn-cgi/l/email-protection# link and the data-cfemail attribute. Normalise just those two values and all 56 documents match byte for byte.

So the tracked URL and the bare URL are the same page. The query string is not echoed into the HTML either: on the tracked URL the canonical link and the og:url both point at the bare URL on 56 of 56 and 56 of 56.

A trailing slash is a redirect that keeps your campaign

This is the useful part for anyone who shares a link. Adding a trailing slash to 55 of the 56 sitemap URLs answers 308 with a relative Location header - and in 55 of 55 cases the Location carries the query string through:

Location: /apps/invoice-maker?utm_source=devto&utm_medium=post&utm_campaign=probe

A tracked link with a stray slash at the end does not lose its campaign on the way in. The 56th URL is the home page, which already ends in a slash.

The capital letter is not forgiving

The path is case-sensitive. /Apps/Invoice-Maker, /apps/Invoice-Maker, /apps/invoice-Maker and /STUDIOS/IMAGE each answered 404 with the same fixed miss page - title Page not found — OnePassApps, 13,953 bytes, and an og:url of https://app.onepassapps.com/__not-found__. That placeholder is the same on a tracked miss URL: /apps/no-such-app?utm_source=devto answers 404 with the same document, so a mistyped tracked link does not advertise the mistyped address to a crawler.

A doubled slash is collapsed, not redirected

//apps//invoice-maker and /apps//invoice-maker both answer 200 - no redirect, no 404 - and both carry the canonical https://app.onepassapps.com/apps/invoice-maker. The router resolves the extra slashes, and the canonical tag is what tells a crawler the real address. The home page behaves the same way: // answers 200 rather than 308.

What this means when you share a link

  • A trailing slash costs nothing: the redirect keeps your parameters.
  • The path has to match exactly, including case.
  • Extra slashes are harmless, but they leave the canonical tag to do the tidying.
  • Every tracked link points at the same document as the bare link, so a campaign survives without becoming a second version of the page.

You can try it on app.onepassapps.com, and the rest of the apps are listed at the app guides.

Limits

  • One build, one day, 8 November 2026, measured over plain HTTPS with no browser, no session and no cookies.
  • The query string I used was utm_source=devto&utm_medium=post&utm_campaign=probe. I did not test other parameter names, repeated parameters or a URL-encoded value.
  • I did not test what a visitor's analytics tool does with the parameters. That is outside the server and outside this measurement.
  • The redirect count is over the 56 URLs in our own sitemap.xml. A path outside the sitemap was not swept.
  • The miss-page measurements are four case variants of two paths, not an exhaustive set of missing URLs.