# Why do I see ?i=1 at the end of a URL **URL:** \ **Category:** Websites and PHP\ **Created:** [March 26, 2020, 11:00pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356 "2020-03-26T23:00:00Z")\ **Posts on this page:** 12\ **Page:** 2
**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\ **Post date:** [January 7, 2026, 3:42pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/25 "2026-01-07T15:42:06Z")
iFN having a half-thought out detector to prevent that does sound vaguely familiar. Just can’t remember if it’s to stop it because it works, or if it’s to stop it to prevent the user from digging their own grave. ---
**Author:** ![YT\_Xaos](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/yt_xaos/32/45201_2.png) [@YT\_Xaos](https://forum.infinityfree.com/u/YT_Xaos)\ **Post date:** [January 7, 2026, 3:57pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/26 "2026-01-07T15:57:26Z")
> [@Greenreader9](#): > > if it’s to stop it because it works, If that were the case, and the JavaScript code didn’t cause any hit issues as you mentioned previously (which I never experienced in the 2+ years of having that in my code), why would [iFastNet](https://www.infinityfree.com/go/ifastnet) _want_ to block it? As far as I understand, it doesn’t tamper with the security system; it’s merely a cosmetic change. It wouldn’t make sense to prevent users from changing how the URL bar looks. > [@Greenreader9](#): > > prevent the user from digging their own grave. _This_ would make sense to have. However, I implemented that code on my website years ago and never once had that problem. > [@dan3008](#): > > my site has reverted to normal and my htaccess file replaced with the default one… That is strange; I never had that happen to me. Are you sure that nothing else caused your .htaccess to revert back to default? ---
**Author:** ![dan3008](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/dan3008/32/68577_2.png) [@dan3008](https://forum.infinityfree.com/u/dan3008)\ **Post date:** [January 7, 2026, 4:47pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/27 "2026-01-07T16:47:24Z")
> [@YT\_Xaos](#): > > That is strange; I never had that happen to me. Are you sure that nothing else caused your .htaccess to revert back to default? I’m certain. I put it on a testing site I have and didn’t touch anything untill checking today ---
**Author:** ![Greenreader9](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/greenreader9/32/22847_2.png) [@Greenreader9](https://forum.infinityfree.com/u/Greenreader9)\ **Post date:** [January 7, 2026, 6:01pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/28 "2026-01-07T18:01:33Z")
Curious to know what happens if you put the code back on the same site again. ---
**Author:** ![aauthentication](https://forum.infinityfree.com/letter_avatar/aauthentication/32/6_449c533f586939b6e5f246632a46421f.png) [@aauthentication](https://forum.infinityfree.com/u/aauthentication)\ **Post date:** [June 20, 2026, 4:28pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/30 "2026-06-20T16:28:39Z")
Stupid way Pretty sure you could recreate this without params with nearly the same amount of code Atleast let us make our own security system, then submit it for review or something, if it’s good enough it can stay instead of this “?i=” system. This hosting site is the best I’ve ever seen (99% better than all I encountered of) Just why. Unless it’s required by [Ifastnet](https://www.infinityfree.com/go/ifastnet), I suggest you replace this. I agree with @super_user_123 and @yanageorge . By the way, if you make plans that ARE NOT CONTROLLED BY [IFASTNET](https://www.infinityfree.com/go/ifastnet), even if it doesn’t affect hosting that much, I would buy it ---
**Author:** ![Meishin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/meishin/32/59902_2.png) [@Meishin](https://forum.infinityfree.com/u/Meishin)\ **Post date:** [June 21, 2026, 12:05am UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/31 "2026-06-21T00:05:07Z")
> [@aauthentication](#): > > it’s required by [Ifastnet](https://www.infinityfree.com/go/ifastnet) You are right, so yep don’t get your hopes up. ---
**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\ **Post date:** [June 21, 2026, 8:42am UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/32 "2026-06-21T08:42:37Z")
> [@aauthentication](#): > > Stupid way > Pretty sure you could recreate this without params with nearly the same amount of code It’s harder than it looks. But if you have any specific ideas on how to achieve this, I’d like to hear them. Please keep in mind that the reason this parameter is added is for the cases where the browser does execute Javascript but doesn’t store or send the cookie. Just leaving out the parameter would result in the security check being hit continuously, which triggers an endless loop. The parameter is designed to break that endless loop. Any system to replace it would need another way to track state. Tracking state across requests is usually done with cookies, but cookies not working is the only reason why this system is needed. This browser validation system is also just the most visible part of a suite of security checks we run. There are also less visible parts, including IP rate limiting and user agent detection to block bad traffic. > [@aauthentication](#): > > Atleast let us make our own security system, then submit it for review or something, if it’s good enough it can stay instead of this “?i=” system. The problem is that it cannot realistically be good enough. Our system is very lightweight and blocks attack traffic with minimal server load, long before hitting your website code. Anything you could build into your own website runs after the request already reached it, so it can’t match that. Also, basically any time when someone says “I want a different security system”, what they actually mean is “I want a less intrusive security system”, but “less intrusive” also means “less effective”. And good to keep in mind: protecting your website against attacks doesn’t just benefit you, it benefits everyone. A website being attacked generates excessive server load, which hurts performance and availability for other websites on the server too. So we cannot just let you weaken the security of your own website. That’s also setting aside a whole category of practical issues. A custom system would require us to design standards for it to conform to, contribute engineering effort to review the code, potentially implement and support integration points, and then monitor on an ongoing basis whether the system stays effective and isn’t weakened after the fact. That’s a lot of ongoing effort to maintain essentially tailored security for individual sites, which is unsustainable for any low-cost hosting service, let alone a free one. So no, per-site custom security isn’t going to happen. There is going to be one solution, applied system wide for all websites. What that shared system actually looks like is something we can debate. > [@aauthentication](#): > > Unless it’s required by [Ifastnet](https://www.infinityfree.com/go/ifastnet), I suggest you replace this. It is setup by [iFastNet](https://www.infinityfree.com/go/ifastnet), so I cannot “just” replace it. But the people at [iFastNet](https://www.infinityfree.com/go/ifastnet) are reasonable, and are willing to consider good ideas. > [@aauthentication](#): > > By the way, if you make plans that ARE NOT CONTROLLED BY [IFASTNET](https://www.infinityfree.com/go/ifastnet), even if it doesn’t affect hosting that much, I would buy it [iFastNet](https://www.infinityfree.com/go/ifastnet)’s premium plans are genuinely good, and don’t have this system. Any plan I could offer either keeps the core hosting the same, just with a few extra features, or means building a completely parallel platform to [iFastNet](https://www.infinityfree.com/go/ifastnet)’s premium plans, which would just be redundant. Either way, there is not going to be anything that’s substantially different from anything available today. ---
**Author:** ![aauthentication](https://forum.infinityfree.com/letter_avatar/aauthentication/32/6_449c533f586939b6e5f246632a46421f.png) [@aauthentication](https://forum.infinityfree.com/u/aauthentication)\ **Post date:** [June 25, 2026, 7:02am UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/33 "2026-06-25T07:02:22Z")
Yeah, you were talking about offering plans that only added a few extra features, if you can make that I would buy it ---
**Author:** ![Admin](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/admin/32/36437_2.png) [@Admin](https://forum.infinityfree.com/u/Admin)\ **Post date:** [June 25, 2026, 9:06am UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/34 "2026-06-25T09:06:26Z")
Offering a small plan with additional features is in the back of my mind, but the tailored security is not going to be a part of it. There are a lot of problems with the whole idea of account specific security, as I already explained in detail in my previous post. If you actually want to get full control over how your website is secured, you’d need your own server where you can decide the setup yourself. A VPS can be had for a pretty low price, but then you’re responsible for managing it, which takes a lot of extra know-how. A middle ground is a Managed VPS, where you get your own server but the provider manages it on your behalf, but those typically cost at least $100 per month, and quickly go up to many times that price. A key aspect of web hosting is that the hosting provider is responsible for managing the hosting server so you don’t need to worry about that. Part of that is that the hosting provider decides how to ensure optimal security and performance of the hosting. The kind of custom security that you want is inherently not part of web hosting because the idea of web hosting is that security is the hosting provider’s problem. So that’s why this won’t be part of any “extra features” plan. It’s not a matter of price. Customizable security simply isn’t something a shared hosting service can offer. Any service at these prices will be a commodity, because custom work is expensive. But if all you want is to get rid of the current security system, there is a very obvious low-cost solution available already: just buy a premium plan at [iFastNet](https://www.infinityfree.com/go/ifastnet). A Start Premium plan can be had for as little as $30 per year and ensures you don’t need to bother with this system at all anymore. What you’re looking for is free hosting that doesn’t behave like free hosting. But I cannot give you that, because that’s what free hosting is: constrained, so we can keep costs low enough to be able to offer it for free. Making the hosting faster, more reliable and more versatile isn’t a feature that can just be added, it’s fundamentally distinct infrastructure. I don’t understand why you’re happy to pay us but not [iFastNet](https://www.infinityfree.com/go/ifastnet). Our free hosting is powered by them, and many decisions about how the hosting works were made by them. [iFastNet](https://www.infinityfree.com/go/ifastnet) isn’t some unknown third party, they’re the provider who has kept your website running this whole time. Their [premium hosting](https://www.infinityfree.com/premium/) is a separate platform, built to be faster and more capable, but it’s run by the same people you’ve already been relying on. ---
**Author:** ![techsavvy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/techsavvy/32/66562_2.png) [@techsavvy](https://forum.infinityfree.com/u/techsavvy)\ **Post date:** [June 25, 2026, 3:17pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/35 "2026-06-25T15:17:38Z")
add a .htaccess file and put this in ```auto # Turn on Rewrite Engine RewriteEngine On # Deny URLs Not Composed of “a-zA-Z0-9.+/-?=&” characters RewriteCond %{REQUEST_URI} !^/(wp-login.php|wp-admin/|wp-content/plugins/|wp-includes/).* [NC] RewriteCond %{THE_REQUEST} !^[A-Z]{3,9}\ [a-zA-Z0-9\.\+_/\-\?\=\&]+\ HTTP/ [NC] RewriteRule .? - [F,NS,L] # Force / Suffix RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^(.*)([^/])$ https://%{HTTP_HOST}/$1$2/ [L,R=301] # Forward Documents to .php Internally RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME}.php -f RewriteRule ^(.*?)/?$ $1.php [L] # Force https:// Prefix RewriteCond %{HTTPS} !on RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L] Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" # Remove www. Prefix RewriteCond %{HTTP_HOST} ^www\. RewriteCond %{HTTPS}s ^on(s)|off RewriteCond http%1://%{HTTP_HOST} ^(https?://)(www\.)?(.+)$ RewriteRule ^ %1%3%{REQUEST_URI} [R=301,L] # Remove .html Suffix RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s([^.]+)\.html [NC] RewriteRule ^ %1/ [R=301,L] # Remove .php Suffix RewriteCond %{THE_REQUEST} ^[A-Z]{3,}\s([^.]+)\.php [NC] RewriteRule ^ %1/ [R=301,L] ``` this is from > [@Clean URL with .htaccess](https://forum.infinityfree.com/t/clean-url-with-htaccess/44742): > > This script forces all URLs with components of http://www.example.com/projects.html?i=# or http://www.example.com/projects.php?i=# to a URL of the design https://example.com/projects/ If you do not care to understand what you’re doing here, follow the Summary. Summary: Create a file named .htaccess in the root directory of your site (the htdocs folder). Copy and paste the code at the bottom of this post into that file. If that file already exists in your root directory, paste the code … ---
**Author:** ![dan3008](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/dan3008/32/68577_2.png) [@dan3008](https://forum.infinityfree.com/u/dan3008)\ **Post date:** [June 25, 2026, 3:28pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/36 "2026-06-25T15:28:03Z")
I’ve seen mixed results with this. Personally, when I’ve tried it, its not worked. I’ve also tried other .htaccess options that have been deleted. Good luck but bare in mind it may not work ---
**Author:** ![techsavvy](https://forum.infinityfree.com/user_avatar/forum.infinityfree.com/techsavvy/32/66562_2.png) [@techsavvy](https://forum.infinityfree.com/u/techsavvy)\ **Post date:** [June 25, 2026, 3:33pm UTC](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356/37 "2026-06-25T15:33:16Z")
it does not work in WordPress or other softaculous installs, but it has worked for me [Previous page](https://forum.infinityfree.com/t/why-do-i-see-i-1-at-the-end-of-a-url/49356.md?page=1)