diff --git a/CHANGELOG.md b/CHANGELOG.md
index d1060f7..1e86d4e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ### Improved
 
+- **Cleaner page paths in your reports.** Pages like `/products?_t=123456` or `/about?session=abc` now correctly show as `/products` and `/about`. Only marketing attribution parameters (like UTM tags) are preserved for traffic source tracking — all other junk parameters are automatically removed, so your Top Pages and Journeys stay clean without us having to chase down every new parameter format.
 - **Refreshed chart background.** The dashboard chart now has subtle horizontal lines instead of the old dotted background, giving the chart area a cleaner look with soft faded edges.
 - **Smoother loading transitions.** When your data finishes loading, the page now fades in smoothly instead of appearing all at once. This applies across Dashboard, Journeys, Funnels, Uptime, Settings, Notifications, and shared dashboards. If your data was already cached from a previous visit, it still loads instantly with no animation — the fade only kicks in when you're actually waiting for fresh data.
 - **Faster tab switching across the board.** Switching between Settings, Funnels, Uptime, and other tabs now shows your data instantly instead of flashing a loading skeleton every time. Previously visited tabs remember their data and show it right away, while quietly refreshing in the background so you always see the latest numbers without the wait.
diff --git a/public/script.js b/public/script.js
index 64afa2c..00ed811 100644
--- a/public/script.js
+++ b/public/script.js
@@ -230,25 +230,29 @@
     return cachedSessionId;
   }
 
-  // * Normalize path: strip trailing slash and ad-platform click/tracking IDs.
-  // * UTM params (utm_source, utm_medium, etc.) are intentionally kept in the path
-  // * because the backend extracts them for attribution before cleaning the path.
-  var STRIP_PARAMS = ['fbclid', 'gclid', 'gad_source', 'msclkid', 'twclid', 'dclid', 'mc_cid', 'mc_eid', 'ad_id', 'adset_id', 'campaign_id', 'ad_name', 'adset_name', 'campaign_name', 'placement', 'site_source_name', 'utm_id'];
+  // * Normalize path: strip trailing slash and all query params except UTM/attribution.
+  // * Allowlist approach — only UTM params pass through because the backend extracts
+  // * them for attribution before cleaning the stored path. Everything else (cache-busters,
+  // * ad click IDs, filter params, etc.) is stripped to prevent path fragmentation.
+  var KEEP_PARAMS = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content', 'source', 'ref'];
   function cleanPath() {
     var pathname = window.location.pathname;
     // * Strip trailing slash (but keep root /)
     if (pathname.length > 1 && pathname.charAt(pathname.length - 1) === '/') {
       pathname = pathname.slice(0, -1);
     }
-    // * Strip UTM/marketing params, keep other query params
+    // * Only keep allowlisted params, strip everything else
     var search = window.location.search;
     if (search) {
       try {
         var params = new URLSearchParams(search);
-        for (var i = 0; i < STRIP_PARAMS.length; i++) {
-          params.delete(STRIP_PARAMS[i]);
+        var kept = new URLSearchParams();
+        for (var i = 0; i < KEEP_PARAMS.length; i++) {
+          if (params.has(KEEP_PARAMS[i])) {
+            kept.set(KEEP_PARAMS[i], params.get(KEEP_PARAMS[i]));
+          }
         }
-        var remaining = params.toString();
+        var remaining = kept.toString();
         if (remaining) pathname += '?' + remaining;
       } catch (e) {
         // * URLSearchParams not supported — send path without query