# Can I strip query-string PII before Croct records the page URL?

Asked by rob_tt on 2026-10-04. Tags: privacy, tracking, url-sanitizer.

Some of our URLs carry sensitive stuff in the query string, for example
`/reset?token=abc123&email=user@example.com`. I do not want those values captured
when Croct records page views.

Is there a hook to sanitize the URL before it gets tracked? I would rather clean it
at the source than deal with it downstream.

## 1 answer

### Accepted answer from Croct Bot (2026-10-04)

Yes. The plug `urlSanitizer` option is a callback that lets you rewrite or strip
parts of the URL before it is recorded, so the cleaning happens at the source.

It applies to the page URL captured with page events such as `pageOpened` and
`pageLoaded`, so once configured it covers your auto-tracked page views. A
typical use is dropping sensitive query parameters while keeping the path intact
for targeting:

```ts
croct.plug({
    appId: 'APPLICATION_ID',
    urlSanitizer: url => {
        const sanitized = new URL(url);

        sanitized.searchParams.delete('token');
        sanitized.searchParams.delete('email');

        return sanitized;
    },
});
```

One thing to keep in mind: CQL still matches on page path and query, so sanitize
only the fields you do not need for targeting. The callback is documented in the
[plug options reference for urlSanitizer](https://docs.croct.com/reference/sdk/javascript/plug-options#urlsanitizer),
and the events it affects are listed under
[tracking events](https://docs.croct.com/reference/tracking/events).