What is the QSA flag in Apache redirects?

Cherry Seed

QSA stands for Query String Append, an Apache mod_rewrite flag that preserves existing query parameters when a URL is redirected. Without QSA, a RewriteRule that redirects HTTP to HTTPS or adds a trailing slash silently drops every query parameter — including utm_source, utm_medium, and gclid — from the destination URL. Apache's official mod_rewrite documentation states that the default behaviour replaces the query string entirely with whatever the RewriteRule target specifies. Adding [QSA] to the rule instructs Apache to carry the original query string forward through the redirect. For any site running paid campaigns, omitting this single flag means attribution data vanishes on the first server hop.

Full Answer

Apache mod_rewrite processes URL transformations using RewriteRule directives, each of which can include optional flags that modify behaviour. The QSA flag addresses a specific and destructive default: when a RewriteRule fires, Apache replaces the entire query string of the original URL with whatever query string appears in the rule's target. If the target has no query string, the original is simply discarded.

This default creates a silent attribution killer. Consider a typical HTTP-to-HTTPS redirect: RewriteRule ^(.*)$ https://example.com/$1 [R=301,L]. A visitor clicking an ad lands on http://example.com/?utm_source=facebook&utm_medium=cpc. The rule fires, redirecting to https://example.com/ — and because no QSA flag is present, the utm_source and utm_medium parameters are stripped. GA4 never sees them. The session is classified as direct traffic. The ad platform receives no conversion signal.

Adding QSA changes the behaviour: RewriteRule ^(.*)$ https://example.com/$1 [R=301,QSA,L]. Now Apache appends the original query string to the redirect target, producing https://example.com/?utm_source=facebook&utm_medium=cpc. Attribution survives.

The same risk applies to trailing-slash normalisation rules, www-to-non-www redirects, and any other RewriteRule that transforms the URL path. Each redirect without QSA is an opportunity for silent data loss. For WooCommerce stores where multiple redirects may chain — HTTP to HTTPS, then non-www to www, then path normalisation — every rule in the chain needs the QSA flag.

Cherry Seed

Quick Answer

Full Answer

Sources