I decided to change my various pages to reject unknown URL search parameters. URLs mean things, and ideally only one URL will refer to a given document. And mangling URLs instead of respecting the Expires header is antisocial behavior.

There are lots of badly-behaved feed readers out there. You may be about to find out that yours is one of them. Here are a few terrible things that feed readers do:

• Appending random numbers to the URL of the feed, or of URLs within the feed, to intentionally break cacheing.

• Interpreting "301 Moved Permanently" not as "update your URL" but instead as "keep using the old URL and then processing that redirect every time until the sun goes dark".

• Interpreting both "404 Not Found" and "410 Gone" as "I should keep loading this URL once an hour until the sun goes dark, just in case it comes back."

• And, hoooooboy, a whole lot of other crap that rachelbythebay has been documenting.

Anyway, here's how I did it, if you want to play along. (I decided to allow utm_source and fbclid for now, since they are just absolutely ubiquitous.)

Apache: reject query parameters on HTML documents:

<IfModule mod_rewrite.c>
  RewriteEngine On

  # Reject any HTML or image document that has unknown query parameters:
  RewriteCond %{REQUEST_URI}  /$|\.(html|jpg|gif|png|pl)$
# RewriteCond %{QUERY_STRING} !^$
  RewriteCond %{QUERY_STRING} !^$|^utm_|^fbclid=
  RewriteRule .? - [QSD,E=BADQUERY:1]

  # If it's a bogus query, page is forbidden.
  RewriteCond %{ENV:BADQUERY} =1
  RewriteCond %{REQUEST_FILENAME} -f
  RewriteRule .? - [FORBIDDEN,LAST]

  # If this is the 403 page for a bad query, serve a different error document.
  RewriteCond %{ENV:BADQUERY} =1 [OR]
  RewriteCond %{ENV:REDIRECT_BADQUERY} =1
  RewriteRule ^/?(error/)?4\d\d\.html$ /403q.html [LAST]
</IfModule>

WordPress: reject unknown query parameters:

// Remove some unnecessary query parameters that are allowed by default.
//
add_action ('parse_request', 'jwz_remove_query_vars');
function jwz_remove_query_vars ($query) {

  // If there are no query parameters in the URL, no need for changes.
  if (! preg_match ('/\?/', $_SERVER['REQUEST_URI']))
    return;

  // Omit all built-in WordPress parameters except these:
  //
  $query->public_query_vars =
    array_intersect ($query->public_query_vars,
      [ 'p',                    // Shows up when I first make a post
        's',                    // Searches
        'doing_wp_cron',        // I guess?
        'feed',                 // feed/?feed=rss
      ]);

  // Add these non-WordPress parameters.
  //
  $query->public_query_vars =
    array_unique (array_merge ($query->public_query_vars,
      [ 'replytocom',           // Used in reply notification emails
        'unapproved',           // PERMALINK/?unapproved=N&moderation-hash=X
        'moderation-hash',      //  for just-posted comments being moderated.
        'preview',              // Previewing post edits
        'preview_id',
        'preview_nonce',
	'trashed',		// After deletion by moderator

        'utm_source',           // Bullshit
        'utm_content',
        'utm_medium',
        'utm_campaign',
        'fbclid',               // Facebook bullshit
      ]));

  // If the page does have a legitimate query parameter on it, and it was
  // the result of a rewrite rule, I guess we need to allow those back in?
  // Without this, url_to_postid() fails to parse URLs like "YYYY/MM/SLUG"
  //
  if ($query->matched_query) {
    parse_str ($query->matched_query, $a);
    $query->public_query_vars =
      array_unique (array_merge ($query->public_query_vars,
                                 array_keys ($a)));
  }

}


// Error if there are any unknown query parameters.
//
add_action ('parse_request', 'jwz_disallow_extra_queries');
function jwz_disallow_extra_queries ($query) {
  foreach ($_GET as $k => $v) {
    if (! in_array ($k, $query->public_query_vars)) {
      $k = htmlspecialchars (strip_tags ($k));
      $e = new WP_Error ("unknown_parameter", "unknown parameter \"$k\"");
      wp_die ($e, '',
              [ 'response' => 403,
                'query' => $query ]);
    }
  }
}

More WordPress: serve feed readers an error message in a feed, instead of in an HTTP response, since most of them ignore those:

// Style the "wp_die" page
//
add_filter ('wp_die_handler', function ($r) { return 'jwz_die_handler'; });
function jwz_die_handler ($message, $title = '', $args = []) {

  [ $message, $title, $args ] =
    // Converts a WP_Error object to a string, etc.
    // $message might contain HTML and entities.
    _wp_die_process_input ($message, $title, $args);

  if (!$message || !is_string ($message))
    $message = "Unknown error";

  if (! empty ($args['additional_errors'])) {
    $message = array_merge ([ $message ],
                            wp_list_pluck ($args['additional_errors'],
                                           'message'));
    $message = ("<UL STYLE='text-align: left; display: inline-block;'><LI>" .
                implode ("</LI><LI>", $message) .
                "</LI></UL>");
  }

  $status = $args['response'] ?? 500;

  $query = $args['query'] ?? null;
  $feed_p = ($query && ($query->query_vars['feed'] ?? false));

  // If we get an error serving a feed (e.g., "unknown parameter" for some
  // feed reader trying to do cache-busting) serve them an RSS feed with
  // an error message in it.
  //
  if ($feed_p) {
    $age  = 60 * 60 * 24 * 365 * 10;
    $time = time();
    $now  = gmdate ("D, d M Y H:i:s T", $time);
    $exp  = gmdate ("D, j M Y G:i:s T", $time + $age);
    $tag  = str_replace ('=', '', base64_encode (pack ('N', $time)));
    $url  = get_bloginfo ("url");
    $url2 = ($_SERVER['REQUEST_SCHEME'] . '://' . $_SERVER['HTTP_HOST'] .
             $_SERVER['REQUEST_URI']);
    $name = get_bloginfo ("name");

    $message .= (" <BR><BR>\n\n" .
                 "If you are seeing this, <BR>\n" .
                 "your feed reader is badly behaved. <BR>\n" .
                 "Use a different one.");

    header ("Content-Type: text/xml;charset=UTF-8");
    header ('Expires: ' . $exp);
    header ('Cache-Control: max-age=' . $age);

    print '<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
 <channel>
  <generator>' . wrap_cdata ($name) . '</generator>
  <title>' . wrap_cdata ($name) . '</title>
  <link>' . $url . '</link>
  <description>' . wrap_cdata (get_bloginfo ('description')) . '</description>
  <language>en</language>
  <webMaster>' . wrap_cdata (get_bloginfo ('admin_email') . " ($name)") .
   '</webMaster>
  <pubDate>' . $now . '</pubDate>
  <lastBuildDate>' . $now . '</lastBuildDate>
  <atom:link href="' . $url . '" rel="self" type="application/rss+xml" />
  <item>
   <link>' . $url2 . '</link>
   <guid isPermaLink="false">' . $tag . '</guid>
   <title>' . wrap_cdata ($title) . '</title>
   <description>' . wrap_cdata ($message) . '</description>
  </item>
 </channel>
</rss>
';
    die;
  }


  $body = $message;  // Style your error page here...

  $desc = get_status_header_desc ($status);

  header ("HTTP/1.1 $status $desc");
  header ("Cache-Control: no-cache");
  header ("Pragma: no-cache");
  header ("Expires: " . gmdate('D, d M Y H:i:s T', time()));
  print $body;

  if ($args['exit'])  // Defaulted to true by _wp_die_process_input
    die();
}

function wrap_cdata ($s) {
  $s = html_entity_decode ($s);
  if (preg_match ('/[<>&]/', $s)) {
    $s = str_replace (']]>', ']]]]><![CDATA[>', $s);
    $s = '<![CDATA[' . $s . ']]>';
  }
  return $s;
}

Let me know if I broke something that I didn't mean to break. (There's a good chance I meant to break it.)

Previously, previously, previously, previously.