In this particular URL, everything after the
# (hash) is the fragment identifier and is not sent to the server by the browser, so cannot be blocked server-side in
The server only sees:
# was to be removed from this URL then this would be a wholly invalid URL (because of the improperly encoded
% chars) and the server will respond with a "400 Bad Request".
Aside: Not sure why WordPress would still resolve this URL to the "correct" URL? This is technically a different URL.
Rather than blocking special characters, it's probably much easier to allow a whitelist of characters in the URL-path. Most URL-paths will only consist of lowercase
- (hyphen) and
/ (slash - path separator), so we could simply block the request if any other character is present in the URL-path. This could be implemented using the following mod_rewrite directive at the top of your
.htaccess file, before the existing WordPress directives:
RewriteRule [^a-z/-] - [R=404]
If the URL-path contains any characters other than those mentioned then it will trigger a 404.
Note that this only checks the URL-path, not the query string part of the URL.